How to Set Up FileVault Full-Disk Encryption on macOS

FileVault encrypts your entire startup disk, protecting its contents if the machine is lost or stolen — this walks through enabling it correctly and understanding the recovery options before you actually need them.

Step 1: enable FileVault

System Settings → Privacy & Security → FileVault → Turn On

Step 2: choose how to handle the recovery key

Option A: Allow my iCloud account to unlock my disk
          (recovery key is escrowed with Apple, tied to your Apple ID)
Option B: Create a recovery key and do not use my iCloud account
          (you're shown a key you must store safely yourself)

Option A is more convenient — losing your login password can be resolved through Apple ID account recovery — but requires trusting Apple’s escrow. Option B keeps the key entirely under your own control, at the cost of being entirely your responsibility to store safely: lose this key with no login password remembered, and the disk’s contents are unrecoverable, by design.

Step 3: if you chose Option B, store the recovery key immediately, somewhere durable

A password manager, a printed copy in a secure physical location, or both — this key is only ever shown once, at the moment of setup, and macOS does not keep a copy of it for you to retrieve later if you lose it.

Step 4: let encryption complete in the background

System Settings → Privacy & Security → FileVault →
  (progress indicator shows encryption status)

Initial encryption of an existing disk happens in the background while you continue using the Mac normally — it can take a significant amount of time depending on how much data is already on the disk, but doesn’t require you to stop working while it completes.

Step 5: verify FileVault is actually enabled and complete

fdesetup status

This should report FileVault is On once the initial encryption pass has finished.

Step 6: add an institutional recovery key, if managing multiple machines (optional)

sudo fdesetup enable -keychain -institutional

Organizations managing many Macs commonly configure an institutional recovery key alongside or instead of per-user personal keys, letting IT unlock a disk without depending on any individual user’s personal recovery key — this requires MDM/configuration profile setup beyond a single-user walkthrough, but is worth knowing exists.

Step 7: understand what FileVault protects against, and what it doesn’t

FileVault protects data at rest — if the machine is powered off or locked and someone doesn’t have your password or recovery key, the disk’s contents are inaccessible to them, even if they physically remove the drive. It does not protect against someone accessing your data while you’re logged in and the disk is already unlocked — that’s a separate concern (screen lock timeouts, account security) rather than something disk encryption addresses.

Why setting this up before you need it is the only time that matters

FileVault is something you configure once, correctly, well before any device is ever lost or stolen — there’s no way to retroactively encrypt a disk after the fact once it’s already out of your possession. The recovery-key decision in Step 2 in particular is much easier to reason about calmly during setup than during an actual lockout, which is exactly why it’s worth thinking through deliberately now rather than defaulting to whichever option requires the least immediate effort.