How to set a firmware password on your Mac

To protect the data on your Mac, you can set a user account password (login password) to prevent unauthorized users from logging in to your user account. You can also encrypt your startup disk using FileVault, so that only users who can log in to your Mac can read the data on that disk.

For even more protection, you can set a firmware password. A firmware password prevents users who don't have the password from starting up from any disk other than the designated startup disk. As a result, it prevents using some startup key combinations.

The following steps apply to OS X Mountain Lion or later.

1. Start up from macOS Recovery: Press and hold Command (⌘)-R immediately after turning on your Mac, and release the keys when you see the Apple logo or a spinning globe. 
2. When the utilities window appears, click Utilities in the menu bar, then choose Firmware Password Utility or Startup Security Utility. This utility is available only on Mac models that support use of a firmware password.
3. Click Turn On Firmware Password.
4. Enter a firmware password in the fields provided, then click Set Password. Remember this password.
5. Quit the utility, then choose Apple () menu > Restart.

Your Mac asks for the firmware password only when attempting to start up from a storage device other than the one selected in Startup Disk preferences, or when starting up from macOS Recovery. Enter the firmware password when you see the lock icon and password field:

1. Start up from macOS Recovery: Press and hold Command (⌘)-R immediately after turning on your Mac, and release the keys when you see the lock icon  and password field.
2. Enter the firmware password.
3. When the Utilities window appears, click Utilities in the menu bar, then choose Firmware Password Utility or Startup Security Utility.
   
4. Click Turn Off Firmware Password.
5. Enter the firmware password again when prompted.
6. Quit the utility, then choose Apple () menu > Restart.

You can also use the Lost Mode feature of Find My Mac to remotely lock your Mac with a passcode for one-time use. Your Mac receives the lock instruction from iCloud, restarts, and asks for the system lock PIN code you created. When you enter that passcode, the Mac starts up from your designated startup disk and disables the passcode.

Lost Mode works even while using a firmware password. Unlike the passcode set by Lost Mode, a firmware password remains on until you turn it off with Firmware Password Utility or Startup Security Utility.

If you can't remember your firmware password or passcode, schedule an in-person service appointment with an Apple Store or Apple Authorized Service Provider. Bring your Mac to the appointment, and bring your original receipt or invoice as proof of purchase.