FileVault is the built-in full-disk encryption on every Mac. Flip it on and the entire drive is scrambled with XTS-AES-128 keyed to your login password, so a stolen or lost MacBook is a paperweight to anyone without that password. It is free, it is built in, and on modern Macs it costs you almost nothing in speed. Here is exactly how to turn it on, where your recovery key lives, and whether you should ever leave it off.
How to turn on FileVault in about two minutes
- Open System Settings (Apple menu > System Settings). On macOS Monterey and earlier this is System Preferences.
- Click Privacy & Security in the sidebar, then scroll down to FileVault.
- Click Turn On. Enter your administrator password if prompted.
- Choose how you want to recover access if you forget your password: iCloud account (Apple can help you unlock) or a local recovery key (a 24-character code you keep yourself). Pick the recovery key if you want zero dependence on Apple, or iCloud if you would rather not manage a code.
- Click Continue. Encryption begins in the background and you can keep using the Mac the whole time.
On an Apple silicon Mac (M1, M2, M3, M4) the drive is already encrypted at the hardware level, so turning on FileVault just ties that encryption to your password — it finishes almost instantly. On older Intel Macs the first full encryption pass can take anywhere from 30 minutes to a few hours depending on drive size and how full it is. It runs while you work.
Save your recovery key somewhere safe
If you chose the local recovery key, macOS shows you a 24-character code (letters and numbers) once. Write it down or store it in a password manager immediately. This key is the only way back in if you ever forget your login password — without it, a forgotten password on a FileVault Mac means the data is gone for good. Apple cannot recover it for you on a local key.
If you tied recovery to your iCloud account instead, you unlock by signing in with your Apple ID, so there is no code to lose — but you do need access to that Apple ID.
Already locked out of a Mac? Our forgot Mac password reset guide walks through using the FileVault recovery key and every other option, step by step.
Does FileVault slow your Mac down?
On any Mac from the last several years, no — not in a way you will feel. Apple silicon Macs and Intel Macs with the T2 chip do the encryption on a dedicated hardware engine, so read and write speeds are effectively unchanged. Independent testing puts the hit in low single-digit percentages at most, which you will never notice in normal use.
The one exception is a very old Intel Mac (pre-2018, no T2) with a spinning hard drive or an early SSD — there the CPU does the work and you might see a small slowdown on heavy disk tasks. On those machines the security is still usually worth it, and if the Mac feels slow it is far more likely the aging drive itself than FileVault. If that describes your machine, it may be time to look at a faster refurbished model on our Apple clearance page rather than nurse an eight-year-old drive.
Should you turn FileVault off?
For almost everyone, the answer is no — leave it on. The whole point is that if your MacBook is lost or stolen, your email, photos, saved passwords, and files stay locked. Without FileVault, anyone can pull the drive or boot to recovery and read everything.
There are only two situations where turning it off makes sense: you are running a very old Intel Mac where the slowdown genuinely bothers you, or you are wiping the machine to sell it and want a clean, unencrypted starting point (though a proper erase handles that anyway). To turn it off, go back to Privacy & Security > FileVault and click Turn Off; decryption runs in the background just like encryption did.
FileVault and selling or buying a used Mac
Planning to sell? You do not need to turn FileVault off first. When you erase the Mac properly, the encryption keys are destroyed and the data is unrecoverable — that is actually a security bonus. Follow our guide on how to wipe a MacBook before selling it and you are covered.
Buying used? Make sure the previous owner erased the Mac and signed out of their Apple ID, so FileVault is not locked to their credentials. Our what to check when buying a used MacBook checklist covers this, and worried about theft? See how to protect your MacBook from theft.
Frequently asked questions
Is FileVault on by default on a new Mac?
On Apple silicon Macs the drive is encrypted at the hardware level from the factory, but FileVault (which ties that encryption to your password) is not automatically turned on unless you enabled it during setup. Check Privacy & Security > FileVault to be sure.
What happens if I forget my password and lose my recovery key?
If you have no recovery key and no iCloud recovery set up, the data is permanently unrecoverable — that is by design. Your only path is to erase the Mac and start fresh. This is why saving the recovery key at setup matters so much.
Does FileVault protect my Mac while it is running and logged in?
FileVault protects data at rest — when the Mac is off or fully shut down. Once you log in, the drive is unlocked for normal use. For protection while it is on, pair FileVault with a strong login password, a short auto-lock timer, and Find My Mac.
How long does FileVault take to finish encrypting?
Apple silicon and T2 Intel Macs finish almost instantly. Older Intel Macs take roughly 30 minutes to a few hours for the first pass, running in the background while you keep working.
Can I use my Mac while FileVault is encrypting?
Yes. Encryption and decryption both run in the background. You can work, sleep the Mac, and restart normally; it picks up where it left off.
Questions about a specific Mac, or want a refurbished one that arrives ready to lock down? Talk to Rick — he has been doing this since 1991.