Review FileVault encryption and recovery options
Choose a FileVault recovery path before enabling it, and make sure a personal recovery key remains available when the encrypted Mac cannot start.
Publication & corrections: infostoa · Editorial standards
Individual author and specialist reviewer information is not provided for this article.
Choose a recovery method before turning on FileVault. Apple-silicon and T2 Macs encrypt data automatically; FileVault adds protection against access without the login password. On other Macs, FileVault provides the data encryption. Apple’s FileVault guide
Choose a recovery path
- On a personal Mac, choose Apple Account recovery if you can access that account and do not want to manage a separate key.
- If you choose a personal recovery key, copy every character exactly and store it somewhere secure outside the encrypted Mac that you can reach if the Mac will not start.
- For a work or school Mac, follow the organization’s key process and check with IT.
Turn it on and keep a backup
Using an administrator account, open Apple menu > System Settings > Privacy & Security > FileVault, turn it on, and select the recovery method. FileVault is not a backup; maintain a separate backup.
If you forget the password or cannot find the key
First identify the recovery path you chose. Apple Account recovery does not mean there is a separate key file in iCloud Drive. If you chose a personal recovery key, check where you recorded it; for a managed Mac, follow your organization’s process and contact IT. If the Mac requesting the key runs macOS Tahoe 26 or later, you can also search recovery key in the Passwords app on another iPhone, iPad, or Mac signed in to the same Apple Account with iCloud Passwords & Keychain enabled, then check for an item named for that Mac. Apple distinguishes a FileVault recovery key from an Apple Account recovery key. If you cannot find the key, do not erase the Mac right away: try the password-reset options shown at the login window, then the options in macOS Recovery. If those steps cannot reset the login password and you do not have the personal recovery key, the files and settings may be unrecoverable; erasing the Mac deletes accounts and data, so it is a last resort. See Apple’s password-reset and key-finding guide and Macworld’s recovery guidance.
Related: Restore selected files with Time Machine