How to enable FileVault on macOS

Why this matters

Without disk encryption, anyone who gets physical access to your Mac — a thief, a repair shop, a customs officer — can pop out the SSD or boot from a USB and read every file. Your login password doesn’t stop them; it only blocks them from logging into macOS.

FileVault encrypts the entire disk. Without your password, the disk is unreadable, even if removed from the Mac. It’s Apple’s built-in implementation of full-disk encryption, runs on hardware acceleration so there’s no perceptible slowdown, and is the security control with the highest return on the lowest effort for any laptop user.

How to do it

1. Open System Settings → Privacy & Security → FileVault.
2. Click Turn On.
3. Choose a recovery method:
   • iCloud account — easiest; Apple stores a recovery key tied to your iCloud login.
   • Recovery key — Apple shows you a 24-character key. Write it down on paper and store it somewhere safe at home (not on the same Mac).
4. Wait for the initial encryption pass. You can use your Mac normally while it runs in the background — it usually finishes in under an hour on modern Macs.
5. After the next reboot, your password unlocks the disk before macOS loads.

What you don’t need

You don’t need third-party disk encryption tools (Veracrypt, etc.) on a Mac — FileVault uses the same XTS-AES-128 standard, is integrated with the Secure Enclave on Apple Silicon, and is audited annually as part of Apple’s certifications.