Manage FileVault
Overview
Mac automatically encrypts user data. Turning on FileVault adds another layer of security by requiring a login password to decrypt user data. This protects the data even if someone has physical access to the Mac.
macOS Recovery contains tools and utilities that an administrator uses to manage accounts and security on the Mac. FileVault protects macOS Recovery from access by anyone who isn’t an administrator on the Mac.
Note: FileVault can be managed by a device management service. A device management administrator can turn on FileVault and the service can store the recovery key.
On a Mac with macOS 26.4 or later, signing in to an Apple Account during Setup Assistant turns on FileVault automatically. Otherwise, Setup Assistant asks whether to turn it on. If the user isn’t an administrator, they need an administrator name and password to turn on FileVault later.
Turning on FileVault creates a recovery key, a 24-character code of letters and numbers. If the user forgets their login password, they can use the recovery key to reset it. Keep the key somewhere safe and away from the Mac. If you write it down, copy the letters and numbers exactly.
WARNING: Don’t forget or lose the recovery key. If a user can’t reset their login password and lost their FileVault recovery key, all files and settings on the Mac become unrecoverable.
When FileVault isn’t managed by a device management service, the recovery key appears in the Passwords app on any device with iCloud Keychain turned on, such as an iPhone, iPad, or Mac.
On the Mac, the user can also choose Apple menu > System Settings, click Privacy & Security in the sidebar, click FileVault, then click Show next to Recovery Key.
When turned on, FileVault locks the startup disk each time the Mac starts up or restarts. A user unlocks it in the login window with their login password. You might need to unlock the disk with the FileVault recovery key instead. Press Option-Shift-Return to reveal the recovery key field, enter the key, then press Return.
Unlocking the disk with the FileVault recovery key doesn’t log in a user. After the disk unlocks, the login window appears again, and a user still needs to log in to their account.
Turn on FileVault
Either you or the user can complete this task:
On the Mac, choose Apple menu > System Settings, then click Privacy & Security in the sidebar.
Click FileVault, then turn on FileVault.
Enter an administrator name and password, then click Unlock.
If the Mac has additional users, their information is also encrypted. Users unlock the encrypted disk with their login password.
If there’s an Enable Users button, you need to enter a user’s login password before they can unlock the encrypted disk. Click Enable Users, select a user, enter the login password, click OK, then click Continue.