FileVault

Free plan Mac

What FileVault is

FileVault is Apple’s built-in encryption capability for Mac computers. It protects data at rest on internal and removable storage by encrypting complete storage volumes with AES-XTS. On Macs using Apple silicon or an Apple T2 Security Chip, data is encrypted automatically; enabling FileVault adds a requirement for the login password when accessing the protected data. Macs without either chip need FileVault turned on before their data is encrypted. During setup, users can select an iCloud account or recovery key to unlock the startup disk and reset a forgotten login password. Losing both the login password and recovery key, without another way to reset the password, can result in lost files and settings. On Apple silicon and T2 Macs, key handling occurs in the Secure Enclave. Organizations can manage FileVault with SecureToken or Bootstrap Token and escrow a personal recovery key through device management. Removable-storage encryption does not use Secure Enclave capabilities, and data added or deleted before activation may remain recoverable.

Who it suits

FileVault suits Mac users protecting sensitive information on internal or removable storage, including company or organizational data. It also supports organizations managing encryption and recovery keys across Macs.

What it does well

Built into macOS
Encrypts full storage volumes with AES-XTS
Supports iCloud or recovery-key recovery
Secure Enclave handles keys on supported Macs
Organizations can escrow recovery keys

What to know first

Older Macs require manual activation
Losing credentials can lose files and settings
Removable storage lacks Secure Enclave protection
Pre-activation data may be recoverable

Verdict

FileVault provides full-volume Mac encryption with recovery options and organization controls. Check the recovery requirements and removable-storage limitations before relying on it for every device or file.

Facts from FileVault's own pages

Automatic encryption: On Macs with Apple silicon or an Apple T2 Security Chip, data is encrypted automatically; turning on FileVault adds a login-password requirement for access. · support.apple.com, 5 Oct 2026
Federal standards: Apple says FileVault encryption uses Apple FIPS-validated cryptographic modules and the AES-XTS algorithm to help meet high-assurance United States federal standards. · support.apple.com, 5 Oct 2026
Hardware key security: On Apple silicon and T2 Macs, FileVault key handling occurs in the Secure Enclave, and encryption keys are never directly exposed to the CPU. · support.apple.com, 5 Oct 2026
Intended users: Apple describes FileVault as protection for sensitive data, including company financial information on a Mac laptop and organizational data on a lost or stolen Mac. · support.apple.com, 5 Oct 2026
Older Macs: Apple says FileVault must be turned on to encrypt data on Macs without Apple silicon or a T2 chip. · support.apple.com, 5 Oct 2026
Organization management: Organizations can manage FileVault using SecureToken or Bootstrap Token, and a device management service can escrow a personal recovery key. · support.apple.com, 5 Oct 2026
Pre-activation data limit: Data added and deleted before FileVault is turned on is not encrypted and may be recoverable with forensic tools. · support.apple.com, 5 Oct 2026
Protection: FileVault uses AES-XTS to encrypt full storage volumes. · support.apple.com, 5 Oct 2026
Purpose: FileVault is a built-in Mac encryption capability that protects data at rest on internal and removable storage. · support.apple.com, 5 Oct 2026
Recovery: Users can choose an iCloud account or a recovery key to unlock the startup disk and reset a forgotten login password. · support.apple.com, 5 Oct 2026
Recovery risk: Apple warns that files and settings are lost if the user forgets both their login password and recovery key and cannot reset the password. · support.apple.com, 5 Oct 2026
Removable storage limit: Encryption of removable storage does not use Secure Enclave security capabilities. · support.apple.com, 5 Oct 2026
SSH unlock: On Apple silicon Macs running macOS 26 or later, FileVault can be unlocked over SSH after restart when Remote Login and a network connection are available. · support.apple.com, 5 Oct 2026

Where FileVault stands on Freedom251

Camera Apps#6 of 18
Desktop Search Software#20 of 57