Turn on FileVault from Apple menu > System Settings > Privacy & Security > FileVault, authenticate as an administrator, and choose how you will recover the disk. On Apple silicon and Intel Macs with a T2 Security Chip, internal storage is already encrypted by the hardware; FileVault adds the requirement for a user credential before that storage can be unlocked. On older Intel Macs without Apple silicon or T2, enabling FileVault is what encrypts the startup volume.
Your most important decision is the recovery method. You can authorize your Apple Account to unlock the disk, or generate a 24-character recovery key that you must copy exactly and keep away from the Mac. If you lose both the login password and every recovery route, Apple says the files and settings may be permanently inaccessible.
As an Amazon Associate I earn from qualifying purchases.
What FileVault protects—and what it does not
FileVault is macOS full-volume encryption based on AES-XTS. It protects data on the internal startup volume when the Mac is powered off, locked before startup authentication, or otherwise inaccessible to an attacker with physical possession of the computer.
Recommended Free Tools
Hardware determines the baseline protection:
| Mac hardware | When internal storage is encrypted | What turning on FileVault adds |
|---|---|---|
| Apple silicon | Storage encryption is automatic, with keys handled in the Secure Enclave. | The volume key is protected by the user’s password as well as the hardware UID, so credentials are required to unlock the data. |
| Intel Mac with a T2 Security Chip | Storage encryption is automatic, with key handling supported by the Secure Enclave. | FileVault adds user-credential protection instead of relying only on the hardware UID. |
| Intel Mac without Apple silicon or T2 | Encryption is not provided by the hardware alone. | FileVault must be enabled to encrypt the startup volume. |
Apple explains the key-protection difference in its FileVault security documentation. FileVault is therefore not redundant on a modern Mac: it changes who can unlock the encrypted volume.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
FileVault is not a replacement for a login password, user permissions, malware protection, or backups. It primarily protects confidentiality if somebody obtains the Mac or its internal storage. Anyone who can sign in to an already unlocked account still has the access that account normally permits.
Check your situation before enabling FileVault
- Confirm you are an administrator. Enabling FileVault requires administrator authentication.
- Update your recovery information. Decide whether you can reliably access the Apple Account on this Mac or whether you will manage a separate recovery key.
- Plan for other users. Additional accounts may need explicit permission to unlock the startup disk after encryption is enabled.
- Identify ownership. A Mac supplied by an employer or school may be configured by device management, with recovery keys escrowed to the organization.
- Keep the Mac connected to power. Encryption is a security operation; avoid interrupting it during setup.
Before accepting a recovery choice, make sure you understand who will be responsible for it. With Apple Account recovery, responsibility is maintaining access to the account and its account-recovery process. With a self-managed key, responsibility is making an accurate copy and protecting it independently. A key that is technically generated but never recorded is not a usable recovery plan.
FileVault encrypts data written after it is enabled. Apple notes that data deleted before encryption may still be recoverable with forensic data-recovery tools, so enabling FileVault is not a guarantee that previously deleted material has been wiped. If the Mac is being retired or transferred, handle old backups and other copies separately; turning on FileVault does not retroactively scrub every place a file may have existed.
How to turn on FileVault in macOS
- Open the Apple menu and choose System Settings.
- Select Privacy & Security in the sidebar.
- Choose FileVault.
- Select Turn On (or the equivalent enable control shown by your macOS version) and authenticate when prompted.
- Choose the recovery route presented on screen: use your Apple Account, or create a recovery key without using the Apple Account.
- Read the confirmation carefully. If a key is shown, copy every character exactly before continuing and store it somewhere separate from the Mac.
- Allow macOS to begin encryption. You can continue using the Mac while the process runs, but keep it powered and do not erase or reinstall it until encryption has completed.
Apple’s user instructions and the labels for the recovery choices are documented in Protect data on your Mac with FileVault. The exact progress wording can differ by macOS release.
If FileVault is already on, the FileVault pane reports its current state rather than offering the same setup prompt. Read the recovery information shown there before changing anything. If the pane indicates that an organization manages FileVault, use the organization’s procedure instead of creating an unrelated personal key.
Choose a recovery method deliberately
FileVault setup presents two practical routes. Neither removes the need to protect access to the Mac, but they place responsibility in different hands.
| Recovery route | How it works | Advantages | Risks and responsibilities |
|---|---|---|---|
| Apple Account (iCloud) recovery | Your Apple Account can be used to unlock the disk or help recover access, according to the options shown during setup. | No separate string to transcribe and maintain; convenient if you keep account credentials and trusted-device access current. | You must retain access to the Apple Account and its account-recovery methods. Losing that access can leave you dependent on Apple’s remaining recovery options. |
| Self-managed recovery key | macOS generates a key that you record and present when a password reset is not otherwise possible. | Recovery does not depend solely on an online account. | You are responsible for an exact copy and secure storage away from the encrypted Mac. A mistyped or misplaced key is unusable. |
Apple describes these choices in FileVault recovery options. An Apple Account recovery key and a FileVault recovery key are different credentials; do not substitute one for the other.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Think through failure scenarios before selecting an option. If you travel without another trusted device and cannot sign in to your Apple Account, account-based recovery may be inconvenient. If you choose a self-managed key but keep the only copy on the Mac, a thief has both halves of the recovery plan. Some people therefore keep an exact copy in a password manager and a second protected copy in a separate physical location, while ensuring that neither location is accessible to someone who can simply pick up the computer.
How to protect a FileVault recovery key
Copy the key exactly
Apple’s security guide describes the generated FileVault key as 24 random numbers and letters (Apple, 2026). Preserve its capitalization, order and grouping exactly as displayed. A single wrong character makes the key fail. Do not “correct” characters that look unusual, remove separators that Apple displays, or rely on a photograph that may be blurred or incomplete.
Keep it separate from the Mac
Do not leave the key in a file on the encrypted startup disk, in a note beside the computer, or with the computer’s carrying case. Apple specifically warns against storing it where someone who finds the Mac could also find the key. A physically separate, access-controlled location is the essential principle; the particular storage medium is your choice. The goal is to survive loss of the Mac without handing the key to the person who finds it.
Use Apple’s supported locations when appropriate
Apple says the key can be viewed in System Settings > Privacy & Security > FileVault and stored in the Passwords app. With iCloud Keychain enabled, it can sync with your other passwords. If you do not use iCloud Keychain, retain the presented key in a safe location as described in Apple’s FileVault recovery-key guide.
Saving a key in Passwords is not the same as writing it in an ordinary local text file. However, you still need to know which Apple Account and iCloud Passwords & Keychain settings are in use. A sync that was disabled, interrupted, or configured for another account cannot be assumed to contain the key. Keep your account sign-in and trusted-device recovery details current as part of the same review.
Check for a key on another device (conditional)
On a Mac running macOS Tahoe 26 or later, Apple says a missing FileVault key may be available in the Passwords app on another device signed in to the same Apple Account, provided iCloud Passwords & Keychain is enabled. This is conditional, not a universal backup: it will not help if the key was never saved there, syncing was disabled, or the other device uses a different Apple Account. Treat this as an additional retrieval possibility, not permission to discard every independent copy.
Review the plan after setup
After FileVault is enabled, verify that you know which recovery route you selected and where the key or account access is maintained. Do not test a recovery key by repeatedly guessing at the startup screen. Instead, confirm the recorded characters against the FileVault pane or Passwords entry while you are still signed in and can correct an obvious transcription mistake. If you change Apple Accounts or hand the Mac to another owner, revisit the recovery arrangement rather than assuming it transfers automatically.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Enable additional users after encryption
FileVault encrypts the data for other accounts on the Mac, but an account may not automatically be authorized to unlock the encrypted startup disk. If FileVault shows an Enable Users control:
- Open System Settings > Privacy & Security > FileVault.
- Select Enable Users.
- Choose the additional account.
- Enter that user’s macOS login password when prompted.
Without this authorization, that person may be unable to unlock the Mac at the pre-boot login screen even though their files are encrypted on the volume. The startup unlock permission and the person’s ordinary access to files are related but distinct. Add only users who should be able to start the Mac; do not enable an account merely because it exists.
What happens if you lose the password and recovery key?
FileVault cannot bypass its own authentication. If you cannot reset the login password and cannot produce the selected recovery method, you may be unable to log in. Apple’s warning is explicit: “If you turn on FileVault and then forget your login password and can’t reset it, and you also forget your recovery key, you won’t be able to log in, and your files and settings will be lost forever.”
Use this order when access fails:
- Try the normal macOS password-reset process described in Apple’s forgotten-login-password instructions.
- If you selected Apple Account recovery, verify that you are using the same Apple Account associated with the Mac and complete the account-recovery prompts.
- If you selected a self-managed key, retrieve the exact copy from its separate storage. On Tahoe 26 or later, check the conditional Passwords-app location on another trusted device.
- If the Mac belongs to an organization, stop guessing and contact the administrator; the organization may hold an escrowed key.
Erasing the Mac can restore use of the hardware but does not decrypt or recover the previous files. Treat an erase as data loss unless you have a verified backup. A backup is valuable here because FileVault recovery is about unlocking the existing volume, while a backup provides another copy of the documents if unlocking is impossible.
FileVault on an employer- or school-managed Mac
Do not assume that a managed Mac follows the same setup path as a personal one. Apple’s deployment documentation allows an administrator to configure FileVault and escrow a personal recovery key through device management. The organization may also control when encryption starts, which users are enabled, and how a key is retrieved.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchApple recommends personal recovery keys over institutional recovery keys for modern management, and Apple silicon has specific limitations for institutional keys. Those implementation details are controlled by the organization’s management system, not by an individual user changing a local preference. A managed Mac can therefore show policies or prompts that differ from the steps on a privately owned computer.
If you are locked out of an organization-owned Mac, contact the help desk or administrator and identify the Mac as FileVault-encrypted. They may be able to retrieve the escrowed personal key or provide the approved recovery procedure. Do not send a recovery key through an unapproved channel or create a second key without asking whether it would conflict with the organization’s escrow record. The relevant deployment references are Manage FileVault with device management and Managing FileVault in macOS.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
How FileVault’s encryption model works
FileVault uses AES-XTS for full-volume encryption. On Apple silicon and T2 Macs, the Secure Enclave handles internal-storage key operations and the encryption keys are not directly exposed to the CPU. With FileVault off, Apple says the volume key is protected only by the hardware UID. Turning FileVault on changes that protection so the user password is combined with the hardware UID before the volume can be unlocked.
This design explains the startup experience: before macOS loads normally, the system must obtain an authorized credential, use it to unlock the volume key, and then continue booting. Once the volume is unlocked, normal macOS permissions still control which files each account can open; FileVault is not a replacement for account security or backups.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesOn an older Intel Mac without Apple silicon or a T2 chip, the hardware does not provide that automatic internal-storage encryption baseline. FileVault is the feature that encrypts the startup volume, which is why the hardware distinction changes the recommendation. On a modern Mac, turning FileVault on still matters because hardware encryption alone does not impose the same user-credential requirement.
Advanced case: unlocking over SSH
For administrators only, Apple documents a way to unlock FileVault over SSH after a restart on Apple silicon running macOS 26 or later. Remote Login must be enabled and the Mac must have network access. This is a specialized recovery or administration workflow, not a substitute for choosing and safeguarding a normal recovery method. See Apple’s deployment documentation for the supported conditions: Intro to FileVault. Home users should not enable remote administration solely to avoid keeping a recovery key.
Common mistakes to avoid
- Assuming automatic encryption means FileVault is unnecessary. On Apple silicon and T2 Macs, storage is encrypted, but FileVault adds password-based protection for the volume key.
- Saving the only key on the encrypted Mac. That copy is unavailable when the Mac is locked or lost.
- Confusing Apple Account recovery with the FileVault key. They are separate credentials and are not interchangeable.
- Forgetting other users. Their files may be encrypted while their accounts remain unable to unlock the startup disk.
- Ignoring ownership. A school or employer may already escrow a personal key and dictate the recovery process.
- Expecting FileVault to erase old deleted data. Apple notes that material deleted before encryption may remain recoverable with forensic tools.
- Erasing without a backup. Reinstalling macOS makes the computer usable but does not bring back an inaccessible encrypted volume.
Practical checklist
- Use an administrator account to enable FileVault.
- Choose Apple Account recovery only if you can maintain reliable account and trusted-device access.
- If you choose a generated key, record all 24 characters exactly and keep the copy away from the Mac.
- Save the key in a supported password store only when you understand whether iCloud Keychain is syncing it.
- Authorize every additional user who must unlock the disk at startup.
- On a managed Mac, ask IT where the personal recovery key is escrowed before changing settings.
- Keep independent backups: FileVault protects confidentiality, but it cannot restore a forgotten key or files deleted before encryption.
- Recheck the recovery route after major account, ownership, or management changes.
Frequently Asked Questions
How do I turn on FileVault on my Mac?
Open Apple menu > System Settings > Privacy & Security > FileVault, choose Turn On, authenticate as an administrator, and follow the recovery prompts. Select either Apple Account recovery or a generated recovery key.
Do I need FileVault on an Apple silicon Mac?
Apple silicon Macs encrypt internal storage automatically, but FileVault adds protection that requires a user credential to unlock the volume. Apple therefore does not treat FileVault as pointless on these Macs.
Where should I keep my FileVault recovery key?
Keep an exact copy in an access-controlled location separate from the Mac and its encrypted startup disk. Apple supports viewing it in the FileVault settings and storing it in Passwords; iCloud Passwords & Keychain can sync it when enabled.
How long is a FileVault recovery key?
Apple describes a generated FileVault recovery key as 24 random numbers and letters. Copy the characters, capitalization, and order exactly.
What if I lose my FileVault recovery key?
First try the recovery route you selected. On macOS Tahoe 26 or later, the key may be in Passwords on another device using the same Apple Account if iCloud Passwords & Keychain was enabled. If you also cannot reset the login password, Apple warns that the files and settings may be lost permanently.
Can another user unlock my FileVault-encrypted Mac?
Only if that account is authorized to unlock the startup disk. In the FileVault pane, use Enable Users when available, select the account, and enter that user’s login password.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Who can recover FileVault on a work or school Mac?
The organization may have configured FileVault through device management and escrowed a personal recovery key. Contact the administrator or help desk rather than assuming you control the recovery setup.
Is a FileVault recovery key the same as an Apple Account recovery key?
No. They are different credentials. Use the specific FileVault recovery method selected during setup.
The Bottom Line
Enable FileVault, then treat recovery as seriously as encryption itself. Keep Apple Account access current or preserve the exact 24-character key away from the Mac, authorize every user who needs startup access, and contact IT for managed computers. Without a working password-reset path or recovery key, Apple says an encrypted Mac’s files and settings may be lost forever.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
