You press the power button on a used MacBook, and instead of the login screen you get a dark screen with a padlock icon and a password field — no username, no hint, nothing else. That is a firmware lock, also called an EFI lock or firmware password. It is one of the most misunderstood locks in the used-Mac world, and it is the reason some second-hand MacBooks sell for a fraction of their normal price.
This guide explains what the pre-boot padlock actually is, how it differs from iCloud Activation Lock, why firmware-locked machines sell so cheap, and the only legitimate way to remove one.
What a firmware (EFI) lock actually does
A firmware password is a security setting stored in the Mac's boot firmware itself — below macOS, below the login screen, below everything. On Intel-era MacBooks (roughly 2010–2020) it is set through the Startup Security Utility (or Firmware Password Utility) in macOS Recovery. Once enabled, the Mac demands that password before it will:
- Boot from any external drive or USB installer
- Enter macOS Recovery (Command-R)
- Use Startup Manager (Option key) to pick a boot disk
- Boot into Target Disk Mode or single-user mode
Crucially, a firmware lock does not stop the Mac from booting normally into its existing macOS install. If the previous owner's account still works, the machine may boot fine day to day — the padlock only appears when you try to reinstall macOS, wipe the drive, or boot from anything else. That is exactly why the lock so often surfaces after a used purchase: the new owner tries to erase and reinstall, and hits a wall.
Padlock screen vs. the other Mac locks
People use "locked MacBook" for at least four different things, and they have very different fixes and very different resale consequences:
| Lock type | What you see | Who controls it |
|---|---|---|
| Firmware / EFI lock | Padlock + password field before boot, when entering Recovery or booting external media | Whoever set it in Startup Security Utility |
| iCloud Activation Lock | "This Mac is linked to an Apple ID" during setup after an erase | The previous owner's Apple ID (Find My) |
| MDM / remote-management lock | "This device is managed by your organization" enrollment screen | A company or school IT department |
| Login / admin password | Normal macOS user login you can't get past | The previous owner's local account |
Activation Lock is the iCloud one — we cover it in depth in what an iCloud-locked MacBook means. A plain login password is the mildest case and is usually fixable; see our Mac password reset guide. The firmware lock sits in the middle: it doesn't brick the machine, but it blocks every path to a clean reinstall.
What about Apple silicon and T2 Macs?
On Macs with the T2 security chip (2018–2020 Intel) and all Apple silicon models (M1 and later), the old-style EFI password largely disappeared. Security is enforced instead by the Secure Enclave, secure-boot policy, and Activation Lock — so on a modern Mac, the "firmware lock" role is effectively played by Activation Lock tied to the owner's Apple ID. If you're shopping 2018-or-newer, read our guide to what the T2 chip means for used buyers — the checks are different from the Intel-padlock era.
Why firmware-locked MacBooks sell so cheap
Scroll eBay or Facebook Marketplace and you'll find "EFI locked" MacBooks listed at steep discounts — sometimes a third of the going rate for the same model clean. There are three reasons:
- You can't wipe or reinstall. No Recovery, no external boot, no clean install. For most buyers that makes the machine unusable as a daily computer.
- Provenance is uncertain. Some locked machines are honest — a forgotten password on grandma's old MacBook, or a corporate machine that skipped decommissioning. Others are stolen. Buyers price in that risk.
- Removal is gated by Apple. There's no legitimate DIY unlock on most models, so the discount reflects a problem money can't easily fix.
That cheap listing is only a bargain if you can actually clear the lock — and for most buyers, you can't. A $250 padlocked 2017 MacBook Pro you can never reinstall is worth less than a clean, warrantied M1 Air at $450. If the appeal of a locked machine is the price, look at unlocked refurbs first — our Apple clearance collection is where clean, tested machines land when we cut prices, and every one boots, erases, and reinstalls like it should.
The only legitimate removal: proof of purchase
Apple will remove a firmware password — but only in person, and only with original proof of purchase (a receipt or invoice showing the serial number, from an authorized seller). You book a Genius Bar appointment, they verify the paperwork, and the lock is cleared. No receipt, no removal — Apple does not make exceptions, because the whole point of the lock is theft deterrence.
What about the "EFI unlock" services you'll find online? On pre-T2 Intel Macs the password is stored in a chip on the logic board, and some independent shops physically reprogram it. It can work, but it voids any pretense of a clean history, costs real money, and on T2/Apple silicon machines it is simply not possible — the Secure Enclave can't be reflashed around. Treat any "guaranteed iCloud/EFI unlock for $30" listing as a scam.
How to set a firmware password yourself (Intel only)
On an Intel Mac you can add a firmware password so no one can boot from another disk or wipe it without your code:
- Restart and hold Command-R to enter Recovery.
- In the menu bar choose Utilities › Startup Security Utility (or "Firmware Password Utility").
- Click Turn On Firmware Password, set a password you will not forget, and restart.
Write that password down somewhere safe. Apple silicon and most M-series Macs have no firmware password at all — a restart is all it takes, and account security is handled by the login password and Find My instead. If you ever forget an Intel firmware password, only an Apple Store or Authorized Service Provider can clear it with proof of purchase.
Buying used? Check for the padlock before you pay
Two 30-second checks catch a firmware lock before money changes hands:
- Restart holding Option. If Startup Manager appears (a row of boot drives), there's no firmware lock. If a padlock and password field appear, walk away or renegotiate hard.
- Restart holding Command-R. Same logic — Recovery should load without asking for a firmware password.
Also confirm the seller signs out of iCloud and erases the Mac in front of you — that rules out Activation Lock at the same time.
Stuck with a firmware-locked Mac?
If you own a locked machine and can't produce proof of purchase, you still have options. The parts inside — screen, battery, logic board, keyboard — hold real value even when the firmware is locked. We buy admin-locked, firmware-locked, and activation-locked MacBooks that other buyers turn away, verify the serial isn't reported stolen, and pay based on hardware value: see selling a locked MacBook for exactly how that works and what screens we ask you to photograph.
FAQ
Is a firmware lock the same as iCloud Activation Lock?
No. A firmware (EFI) lock is a password stored in the Mac's boot firmware and shows a padlock before boot. Activation Lock is tied to the previous owner's Apple ID through Find My and appears during setup after an erase. A used Mac can have either, or both.
Can I remove an EFI lock myself?
Not legitimately on most models. Apple removes it in person with original proof of purchase. On older pre-T2 Intel Macs, some repair shops physically reprogram the firmware chip, but on T2 and Apple silicon Macs there is no bypass.
Does a firmware lock mean the MacBook is stolen?
Not necessarily — forgotten passwords and un-decommissioned corporate machines are common, honest cases. But because stolen machines are also in the mix, always check the serial and assume the discount exists for a reason.
Will the Mac still work with a firmware lock on it?
Often yes, for normal day-to-day booting into the existing macOS install. What you cannot do is erase it, reinstall macOS, boot from external media, or use Recovery — which makes it a dead end as a used purchase.
How much is a firmware-locked MacBook worth?
Well below a clean machine — the value is essentially the parts. If you're selling one, expect a quote based on hardware condition, not the model's normal resale price. If you're buying, compare against clean refurb prices first (an unlocked M1 Air runs $450, an M2 Air $549) before a locked "deal" tempts you.