Mac Security · FileVault & Mac Data Protection · Lesson 1 of 5

Turning On FileVault

Encrypt your Mac's startup disk and pick a safe way back in.

What FileVault locks up

A lost laptop is a worry. A lost laptop that anyone can read is a much bigger one. FileVault is how a Mac prevents that.

FileVault is the Mac's built-in disk encryption. Encryption scrambles data so it can only be read with the right key. You met this idea with BitLocker on Windows. FileVault is the Mac's version.

FileVault covers the whole startup disk. That is the main drive inside your Mac, where macOS, your apps and your files live. So it protects your documents, photos, mail, messages and settings. A drive you plug in from outside is not covered. It needs its own encryption.

On a Mac with Apple silicon (Apple's own chips) or an Apple T2 Security Chip, the disk is already encrypted automatically. Turning on FileVault adds the part that matters most. Nobody can unlock your files without your login password, the password you type to get into your Mac. On older Macs without those chips, FileVault is what encrypts the data in the first place.

To check it, or turn it on:

1. Open the Apple menu and choose System Settings.
2. Click Privacy & Security in the sidebar.
3. Scroll down and click FileVault.
4. If it is off, click Turn On. You may need your password.
5. Choose how you would get back in if you forget your password. The next task explains this.
6. Click Continue.

If other people use the Mac, you may see an Enable Users button. Use it so each person can unlock the disk with their own password.

Your Mac may have offered FileVault when you first set it up, so it might be on already. Checking takes one minute.

On the practice computer, open FileVault in Privacy & Security and check whether it is on. Turn it on, choose how to unlock the disk if you forget your password, and watch the encryption finish.

Your way back in

When you turn on FileVault, your Mac asks an important question. If you ever forget your login password, how will you unlock the disk? You get two choices.

Use your iCloud account. The option reads "Allow my iCloud account to unlock my disk". Your Apple Account, the sign-in for iCloud and the App Store, can then be used to reset your password. If you don't use iCloud yet, you'll see an option to set it up instead.

• Good for most people at home.
• It only helps if you can still sign in to your Apple Account. Keep its password and two-factor authentication working.

Use a recovery key. The option reads "Create a recovery key and do not use my iCloud account". A recovery key is a long code of letters and numbers that can unlock the disk.

• Write it down on paper the moment it appears.
• Keep it somewhere other than the Mac. Not in a file on that Mac, and not in the laptop bag.
• A locked drawer at home, or a password manager on another device, works well.

A Mac from work may be set up by an IT team, the people who look after the company's computers. They may keep the key for you. Ask before you change anything.

Here is the serious part. Apple says that if you lose both your password and your recovery key, your files are lost forever. Nobody can open them. Not Apple, and not a repair shop.

Then the encryption runs. On Apple silicon and T2 Macs it usually finishes quickly, because the data was already scrambled. On older Macs it can take hours. It works in the background while you keep using the Mac, but only moves ahead while the Mac is awake and plugged in. The FileVault page in Privacy & Security shows how far it has got.