How to Set Up FileVault Full-Disk Encryption on macOS

FileVault encrypts your entire startup disk, protecting its contents if the machine is lost or stolen — this walks through enabling it correctly and understanding the recovery options before you actually need them.

Step 1: enable FileVault

System Settings → Privacy & Security → FileVault → Turn On

Step 2: choose how to handle the recovery key

Option A: Allow my iCloud account to unlock my disk
          (recovery key is escrowed with Apple, tied to your Apple ID)
Option B: Create a recovery key and do not use my iCloud account
          (you're shown a key you must store safely yourself)

Option A is more convenient — losing your login password can be resolved through Apple ID account recovery — but requires trusting Apple’s escrow. Option B keeps the key entirely under your own control, at the cost of being entirely your responsibility to store safely: lose this key with no login password remembered, and the disk’s contents are unrecoverable, by design.

Step 3: if you chose Option B, store the recovery key immediately, somewhere durable

A password manager, a printed copy in a secure physical location, or both — this key is only ever shown once, at the moment of setup, and macOS does not keep a copy of it for you to retrieve later if you lose it.

Step 4: let encryption complete in the background

System Settings → Privacy & Security → FileVault →
  (progress indicator shows encryption status)

Initial encryption of an existing disk happens in the background while you continue using the Mac normally — it can take a significant amount of time depending on how much data is already on the disk, but doesn’t require you to stop working while it completes.

Step 5: verify FileVault is actually enabled and complete

fdesetup status

This should report FileVault is On once the initial encryption pass has finished.

Step 6: add an institutional recovery key, if managing multiple machines (optional)

sudo fdesetup enable -keychain -institutional

Organizations managing many Macs commonly configure an institutional recovery key alongside or instead of per-user personal keys, letting IT unlock a disk without depending on any individual user’s personal recovery key — this requires MDM/configuration profile setup beyond a single-user walkthrough, but is worth knowing exists.

Step 7: understand what FileVault protects against, and what it doesn’t

FileVault protects data at rest — if the machine is powered off or locked and someone doesn’t have your password or recovery key, the disk’s contents are inaccessible to them, even if they physically remove the drive. It does not protect against someone accessing your data while you’re logged in and the disk is already unlocked — that’s a separate concern (screen lock timeouts, account security) rather than something disk encryption addresses.

Why setting this up before you need it is the only time that matters

FileVault is something you configure once, correctly, well before any device is ever lost or stolen — there’s no way to retroactively encrypt a disk after the fact once it’s already out of your possession. The recovery-key decision in Step 2 in particular is much easier to reason about calmly during setup than during an actual lockout, which is exactly why it’s worth thinking through deliberately now rather than defaulting to whichever option requires the least immediate effort.

Step 8: how FileVault relates to the T2/Apple Silicon hardware encryption layer underneath it

On any Mac with a T2 security chip or Apple Silicon, the actual disk encryption keys are always managed in dedicated secure hardware regardless of whether FileVault itself is turned on — the drive is encrypted at the hardware level either way. What FileVault specifically adds on top of that baseline hardware encryption is tying the key release to your actual login password (or recovery key), so the data is genuinely inaccessible without proper authentication, rather than being decryptable automatically the moment the hardware itself powers on. This is why enabling FileVault on modern Mac hardware doesn’t introduce the same disk-performance overhead full-disk encryption historically carried on other platforms — the encryption work is already happening in dedicated silicon either way, and FileVault is primarily a policy layer controlling when that hardware releases its keys.

Step 9: what actually happens if you’re genuinely locked out

If both the login password and the recovery key are genuinely lost — no iCloud escrow, no written-down key, nothing — the disk’s contents are permanently unrecoverable by design, including by Apple itself; there is no support-ticket path that reverses this, since the entire security property FileVault provides depends on that being true without exception. This is worth internalizing clearly during setup specifically because it’s the one scenario Step 2’s decision genuinely can’t be undone after the fact — a lost iCloud-escrowed key can potentially be recovered through Apple ID account recovery, while a genuinely lost personal recovery key with no password remembered has no equivalent recovery path at all.

Step 10: disabling FileVault, and why you’d rarely want to

sudo fdesetup disable

Turning FileVault off decrypts the entire disk in place, running as a background process similar in scope to the original encryption pass — a reasonable thing to do temporarily for certain low-level disk recovery tools that can’t operate on an encrypted volume, but not something to do routinely, since it removes the exact protection Step 7 described and leaves the disk’s contents fully exposed to anyone with physical access to the unlocked, running machine or a removed drive.

Related:

Sources: