FileVault is the full-disk encryption feature of macOS that protects all data on the startup volume so that it can be read only after an authorized user unlocks the Mac with a login password or a FileVault recovery key. In macOS security it is the primary defense for data at rest, which matters most when a Mac is lost, stolen or sent for repair.
The current implementation, introduced with OS X Lion in 2011 and often called FileVault 2, encrypts the entire volume with XTS-AES-128 using a 256-bit key. It replaced the original FileVault of 2003, which encrypted only the home folder as a disk image. On modern Macs, FileVault works hand in hand with the Secure Enclave, the dedicated security processor that guards the encryption keys.
How FileVault encrypts the startup volume
FileVault uses a hierarchy of keys rather than encrypting data directly with the user password. A volume encryption key protects the data, a key encryption key protects that volume key, and user passwords and the recovery key each unwrap the key encryption key. Changing a password therefore re-wraps a small key instead of re-encrypting the whole disk.
On Apple silicon Macs and Intel Macs with the T2 chip, internal storage is always encrypted by a hardware AES engine, even with FileVault turned off. In that state the keys are protected only by the hardware, so the Mac boots without a password. Turning FileVault on adds the user password as a required factor, which is why enabling it on these Macs takes effect almost instantly.
| Mac type | Encryption when FileVault is off | Effect of enabling FileVault |
|---|---|---|
| Apple silicon | Hardware encryption, keys tied to the Secure Enclave | Instant, password becomes required |
| Intel with T2 chip | Hardware encryption through the T2 | Instant, password becomes required |
| Intel without T2 | No encryption | Background encryption that can take hours |
The Secure Enclave also limits password guessing. After repeated failed attempts it imposes increasing delays, making brute-force attacks against a removed storage chip impractical, because the hardware key never leaves the security processor.
Unlock methods and the FileVault recovery key
Only users that are enabled for FileVault can open the encrypted disk at startup. On Apple silicon these are users holding a secure token, typically the first administrator account and accounts created by an existing enabled user. When the Mac starts, the user enters a password on the pre-boot unlock screen, after which macOS usually logs that user in directly.
| Method | Who holds it | Typical use |
|---|---|---|
| User password | Each FileVault-enabled user | Everyday startup |
| Personal recovery key | The owner, printed or stored securely | Forgotten password |
| iCloud account recovery | The user’s Apple Account | Consumer Macs |
| Escrowed recovery key | The organization’s MDM server | Managed company Macs |
| Institutional recovery key | IT department certificate | Legacy deployments on Intel Macs |
The personal recovery key is a 24-character code shown in groups of four characters. It is the last resort when all passwords are forgotten, and Apple cannot recover it. If both the passwords and the recovery key are lost, the encrypted data is permanently inaccessible.
Managing FileVault with fdesetup and MDM
FileVault can be turned on in System Settings under Privacy and Security, but administrators usually manage it with the command-line tool fdesetup or a mobile device management profile that enforces encryption and escrows the recovery key centrally.
| Command | Purpose | Note |
|---|---|---|
fdesetup status | Shows whether FileVault is on and progress | Works without admin rights |
sudo fdesetup enable | Turns FileVault on interactively | Prints a new recovery key |
sudo fdesetup list | Lists users able to open the encrypted disk | Helps find missing secure tokens |
sudo fdesetup changerecovery -personal | Generates a new personal recovery key | Use after a key is exposed |
sudo fdesetup validaterecovery | Checks that a recovery key is correct | Useful in audits |
In managed fleets, MDM can defer enablement until the next login, rotate the recovery key after each use and use a bootstrap token so that newly created accounts receive a secure token automatically.
How FileVault compares with related protections
FileVault protects data at rest, but it does not prevent anyone from erasing or reusing a Mac, and it gives no protection once the user has logged in. Other macOS features cover those gaps.
| Feature | What it protects against | Relation to FileVault |
|---|---|---|
| FileVault | Reading data from a powered-off Mac | Encrypts the startup volume |
| Activation Lock | Reactivating a stolen Mac | Complements it, tied to Find My Mac |
| Firmware password | Booting from other media on Intel Macs | Not used on Apple silicon |
| Gatekeeper and XProtect | Malware running on the system | Unrelated to encryption |
| BitLocker on Windows | Same threat as FileVault | Equivalent feature on another platform |
Risks and common mistakes
The greatest practical risk with FileVault is not an attacker but key loss. Users who skip iCloud recovery and misplace the printed key can lose all data after forgetting a password.
- Storing the recovery key on the same Mac makes it useless in an emergency.
- Sleep instead of shutdown leaves keys in memory; a powered-off Mac offers the strongest protection.
- Missing secure tokens prevent some users or administrators from unlocking the disk.
- Relying on FileVault for backups is a mistake, since encryption does not protect against disk failure or ransomware.
A sensible baseline is FileVault enabled on every Mac, a recovery key stored outside the device, and regular backups with Time Machine or another solution that is itself encrypted.
The simple explanation
FileVault scrambles everything stored on a Mac so that it looks like random noise to anyone who does not know the password. When you log in, the Mac unscrambles data as you use it, so you notice no difference.
If someone steals a switched-off laptop, they cannot read your files even by removing the storage. The one thing to remember is the recovery key: it is the spare key to your house, and if you lose both it and your password, nobody can open the door.
How it is used in practice
A consulting firm issues MacBook Air laptops with Apple silicon to 60 consultants who carry client documents while traveling. The IT administrator configures the MDM server to enforce FileVault at the first login and to escrow each personal recovery key in the management console.
Months later, a consultant forgets the password after a long vacation. The help desk verifies the employee’s identity, retrieves the escrowed key and guides the consultant through the reset on the startup screen. The MDM then rotates the recovery key automatically.
When another laptop is stolen from a car, the firm documents that its disk was encrypted and the device was shut down. The result is that client data stays protected and the incident does not count as a reportable data breach under the firm’s risk assessment.