# What is FileVault disk encryption, and how does full disk encryption on macOS work? URL: https://webvpn.org/encryption/filevault/ Updated: 2026-09-11 What FileVault disk encryption is, how Mac full disk encryption works with the Secure Enclave, how to turn it on, the iCloud vs local recovery key choice, and its limits. FileVault is the full disk encryption built into macOS. It encrypts the Mac's startup disk with XTS-AES-128 under a 256-bit key so that the data cannot be read without a user's login password or the recovery key, and on Macs with Apple silicon or the T2 chip the Secure Enclave holds the keys and throttles guessing. Turning it on is a single switch in System Settings; the decision that matters is whether the recovery key is stored in your iCloud account, where Apple can access it, or recorded by you alone. Modern Macs encrypt their drives whether or not FileVault is on, which causes confusion about what the setting actually does. This guide explains what FileVault is and how it works with the Secure Enclave, what changes when you enable it on Apple silicon versus Intel Macs, how to turn it on, the recovery key choice, how to encrypt external drives and backups, and the limits shared by all full disk encryption. ## What FileVault is FileVault implements the full disk encryption model described in the guide on this site: a random volume key encrypts every block of the startup disk, and that key is wrapped by keys derived from each user's login password and from the recovery key. When you log in at the startup screen, your password unwraps the volume key, macOS loads it, and the disk decrypts transparently while the Mac runs. When the Mac is shut down, the key is gone and the disk is ciphertext. The macOS login and the disk unlock are the same step, which is why enabling FileVault changes the startup experience slightly: the password prompt appears before macOS finishes loading rather than after. ## How FileVault works on Apple silicon and T2 Macs On Macs with Apple silicon or the T2 security chip, the internal drive is always encrypted with a hardware key held in the Secure Enclave, a separate processor that never exposes its keys. Without FileVault, that key is used automatically at boot, so the drive is protected against being removed and read elsewhere but not against someone who boots the Mac and gets past the login screen by other means. Enabling FileVault adds your password to the chain: the volume key is additionally protected by a key derived from your login password inside the Secure Enclave, which also enforces increasing delays after wrong attempts, making brute force against even a moderate password impractical. Because the disk is already encrypted, turning FileVault on is immediate; there is no lengthy background encryption pass. ## How FileVault works on older Intel Macs On Intel Macs without the T2 chip, FileVault performs the encryption in software. Enabling it starts a background process that encrypts the whole disk over hours, during which the Mac remains usable. Password guessing is limited by software rather than hardware, so a strong login password matters more on these machines. The protection once complete is the same: nothing on the disk is readable without a user password or the recovery key. ## Turning FileVault on - Open System Settings, then Privacy and Security, and scroll to FileVault. On older macOS versions it is in System Preferences under Security and Privacy. - Click Turn On, authenticating as an administrator. - Choose the recovery method. Either allow your iCloud account to unlock the disk, or create a recovery key and write it down. The choice is discussed next. - If several user accounts exist, enable each user who should be able to unlock the disk at startup; users not enabled cannot start the Mac, though they can log in once an enabled user has unlocked it. - Restart if prompted. On Apple silicon and T2 Macs encryption is effectively complete at once; on older Intel Macs it proceeds in the background and you can check progress in the same settings pane. ## The recovery key choice The recovery key is a 24-character code that unlocks the disk if all user passwords are lost. Storing it with iCloud means Apple holds an escrowed copy, protected by your Apple account. If you forget your password, you can recover with your Apple account credentials. It also means Apple can be compelled to produce the key, and anyone who takes over your Apple account can retrieve it. Apple offers Advanced Data Protection to end-to-end encrypt most iCloud data, but escrowed FileVault recovery keys are handled through account recovery rather than that setting; check Apple's current documentation for how they are protected. Creating a local recovery key means you alone hold it. Write it down and store it offline, away from the Mac, or in a password manager. If you lose both it and your password, nobody, including Apple, can recover the data. For most people, either is defensible. If your concern includes the provider or account compromise, choose the local key and guard it, as the full disk encryption software guide on this site discusses in general. ## Encrypting external drives and backups FileVault covers the startup disk only. Two other places need attention. External drives. In Disk Utility, erase a drive with the format APFS (Encrypted) and set a password, or right-click an existing APFS or HFS+ drive in Finder and choose Encrypt to convert it in place. The password can be saved in the keychain so the drive opens automatically on your Mac and prompts elsewhere. Drives that must open on Windows or Linux need VeraCrypt instead, as the cross-platform guides on this site explain. Time Machine. When you select a backup disk, check the option to encrypt backups. An unencrypted Time Machine drive is a complete readable copy of your encrypted Mac. Network backups to a Time Capsule or NAS have their own encryption option in the same dialog. ## What FileVault does not protect FileVault protects data at rest. An unlocked Mac, whether in use, asleep with the screen unlocked, or with an easily guessed password, exposes everything. Files synced to iCloud Drive or other cloud services leave the disk and are protected only by those services. Someone who compels your password gets everything; FileVault has no hidden volumes. And the Find My feature, Activation Lock and firmware passwords are separate protections against theft and misuse of the hardware, complementary to FileVault rather than substitutes. ## A six-point FileVault checklist - Confirm FileVault shows as On in Privacy and Security. - Know where your recovery key is, and if you chose iCloud, decide whether that is acceptable for you. - Use a strong login password, since it is now the disk password; on Intel Macs without a T2 chip this matters most. - Encrypt every external drive and enable Time Machine encryption. - Set the screen to lock quickly and require the password immediately after sleep. - Shut down rather than sleep when the Mac leaves your control for a long period. ## What Apple and security reviewers say The account above follows Apple's platform security documentation and independent assessment. Apple documents that Macs with Apple silicon and T2 chips encrypt internal storage by default with keys in the Secure Enclave, that FileVault adds user-password protection to that encryption and enforces guess throttling, and that FileVault on other Macs performs XTS-AES-128 encryption in software. Apple describes the two recovery key options, including that an iCloud-escrowed key can be used through Apple account recovery and that a personal recovery key not stored with Apple cannot be recovered if lost. Security reviewers rate FileVault as a strong and low-cost protection for data at rest on Macs, recommend enabling it universally and encrypting Time Machine backups, and note that its guarantees end the moment the Mac is unlocked. ## Turn it on and encrypt the backup Open Privacy and Security, switch FileVault on, choose and store your recovery key, and then check the Time Machine and external drive settings so no unencrypted copy of the disk exists. From then on a lost Mac is a hardware problem, not a data problem, and the remaining guides on this site cover protecting the Mac while it is running. ## FAQ Q: What is FileVault on Mac? A: FileVault is macOS's full disk encryption. It encrypts the startup disk with XTS-AES-128 using a 256-bit key so that the data cannot be read without a user's password or the recovery key. On Macs with Apple silicon or the T2 chip, the Secure Enclave holds the keys and limits password guessing. Q: Should I turn on FileVault? A: Yes, on any Mac that could be lost, stolen or accessed by others. On Apple silicon Macs the drive is always encrypted, but without FileVault the key is released automatically at boot; enabling FileVault requires your password to unlock it. The performance cost is negligible. Q: How do I enable FileVault? A: Open System Settings, then Privacy and Security, then FileVault, and click Turn On. Choose whether to allow your iCloud account to unlock the disk or to create a local recovery key. Encryption completes in the background; on modern Macs it is nearly instant because the disk was already encrypted. Q: What is the FileVault recovery key? A: A 24-character code that unlocks the disk if every user password is forgotten. You choose at setup whether to store it with your iCloud account, where Apple holds it, or to record it yourself. If you choose the local key and lose it along with the password, the data cannot be recovered by anyone. Q: Does FileVault encrypt external drives and Time Machine backups? A: Not by itself. Encrypt external drives by formatting them as APFS encrypted in Disk Utility or right-clicking a drive in Finder and choosing Encrypt. Time Machine offers an encrypt backups option when you select the backup disk; enable it, since an unencrypted backup of an encrypted Mac defeats the purpose.