Tend
Explainer

FileVault on Mac: should you turn it on?

Yes, on almost every Mac, and certainly on a MacBook. On Apple silicon your disk is already encrypted, but without FileVault the key is protected only by the hardware, so the disk unlocks itself whenever the Mac starts. FileVault ties that key to your login password. Turning it on is immediate on these Macs and costs no noticeable speed. The one real risk is forgetting your password and losing the recovery key, so set that up carefully.

By · Updated · 7 min read · For Macs with Apple silicon running macOS 15 or later

What FileVault adds on Apple silicon

Apple's Mac User Guide says that on a Mac with Apple silicon or a T2 chip, your data is encrypted automatically, and that FileVault adds a layer by requiring your login password to decrypt it (Apple, Protect data on your Mac with FileVault).

Apple's security guide explains the difference in more detail (Apple Platform Security, Volume encryption with FileVault in macOS):

  • FileVault off: the internal volume is still encrypted, but its key is protected only by a key built into the chip's Secure Enclave. The Mac can unlock the disk by itself at startup, without you.
  • FileVault on: the key is protected by a combination of your password and that hardware key. Without your password (or the recovery key), the data can't be decrypted.

In practice that means FileVault is about a Mac that leaves your hands: lost, stolen, or sent off for repair. Your login password protects a running Mac either way; FileVault makes the data itself depend on it. Apple also notes that turning FileVault on later is immediate on these Macs, because the data is already encrypted, and that the Secure Enclave prevents the old hardware-only key from being used afterwards.

Check whether it's on

Open System Settings › Privacy & Security and scroll down to FileVault. Or, in Terminal, which only reads and needs no password:

fdesetup status

On our MacBook Pro with macOS 27.0.1 it printed FileVault is On. If yours says Off, the next section turns it on.

Turn on FileVault

The path is the same on macOS 15 Sequoia, macOS 26 Tahoe and macOS 27. You need an administrator account (Apple, macOS 15; macOS 26; macOS 27):

  1. Choose Apple menu › System Settings, click Privacy & Security in the sidebar, then click FileVault (you may need to scroll).
  2. Click Turn On… and enter your password if asked.
  3. Choose how to recover the disk if you forget your password. The options are below.
  4. Click Continue. If other people have accounts on the Mac, an Enable Users… button lets each of them unlock the disk with their own password.

Two things can stop it, both spelled out in macOS 27.0.1's own messages: FileVault can't be turned on while automatic login is enabled, and every user account needs a password first.

The recovery key

This is the part to get right. Apple's warning is plain: if you forget your login password and can't reset it, and you've also lost the recovery key, you won't be able to log in, and your files and settings are lost for good.

On macOS 15

You choose between Allow my iCloud account to unlock my disk (or Set up my iCloud account to reset my password if you don't use iCloud yet) and Create a recovery key and do not use my iCloud account. With the second, macOS shows a recovery key once; write it down.

On macOS 26 and 27

Apple's guide still lists the same choices, but the system has changed. Six Colors reported that from macOS 26 the recovery key is stored in iCloud Keychain, where the Passwords app can show it, and can be revealed again later with a Show button in FileVault settings; Apple hadn't documented the change (Six Colors, September 2025, updated May 2026). In a later piece it reported that from macOS 26.4, Macs that had used the older iCloud option are moved to the new method (Six Colors, May 2026). macOS 27.0.1's FileVault settings agree with that: their text says you can view the recovery key on any device with iCloud Keychain turned on.

Whichever version you have, keep a second copy of the key somewhere that doesn't depend on this Mac: a password manager you can reach from your phone, or on paper. Apple's advice is to keep it away from the encrypted disk and not in the same place as the Mac. Devices still on an older system than macOS 26 can't see the key in Passwords.

What changes day to day

  • You log in after every start-up. Automatic login is off while FileVault is on, which is the point: someone who starts the Mac meets your password first.
  • Speed: Apple's security guide describes a dedicated AES-256 engine built into the path between storage and memory, which makes file encryption highly efficient (Apple Platform Security, Secure Enclave). Eclectic Light found no detectable overhead on the internal disk (Eclectic Light, October 2025).
  • External drives aren't covered. FileVault protects the startup disk. To encrypt an external drive, use Finder or Disk Utility on that drive.
  • Erasing and selling stay quick. Because the disk is encrypted, a factory reset only has to destroy the key; how to factory reset a MacBook covers it.

When you might leave it off

There are only a few cases. A Mac mini that runs as a home server and must come back after a power cut without anyone typing a password is the classic one, because FileVault and automatic login don't mix. A work Mac is another: if an organization manages it, FileVault is usually set by its IT team, and you'll see a note that a recovery key has been set by your company or school. For a laptop that travels, there's no good reason to leave it off.

To turn it off later, open the same FileVault setting and click Turn Off…; macOS asks for an administrator password. On Apple silicon the data stays encrypted by the hardware, as it was before you turned FileVault on.

How Tend helps

Tend's free Security check shows whether FileVault is on, alongside the firewall, Gatekeeper, System Integrity Protection and XProtect's version, so you can see your Mac's security settings at a glance. Tend only reads these settings and tells you where to change them in System Settings.

Questions

Should I turn on FileVault on my MacBook?

For almost everyone, yes. A MacBook can be lost or stolen, and FileVault makes the data on it depend on your login password rather than only on the hardware. On Apple silicon it turns on immediately and has no noticeable cost. Just keep the recovery key somewhere safe.

Does FileVault slow down a Mac?

Not in a way you'll notice on Apple silicon. Apple's security guide describes a dedicated AES engine between storage and memory that makes file encryption highly efficient, and the internal disk is encrypted whether or not FileVault is on.

Is my Mac's disk encrypted without FileVault?

On a Mac with Apple silicon or a T2 chip, yes. Apple says the data is encrypted automatically, but without FileVault the key is protected only by the hardware, so the disk unlocks itself at startup. FileVault adds your login password to that protection.

What happens if I forget my FileVault password?

You can unlock the disk and reset the password with your recovery key, or with your iCloud account if you chose that option. Apple warns that if you forget your password and lose the recovery key, your files and settings are lost for good.

How long does FileVault take to encrypt a Mac?

On Apple silicon, Apple says turning on FileVault is immediate, because the data is already encrypted. Only the way the key is protected changes. Older Intel Macs without a T2 chip had to encrypt the whole disk in the background.

What is XProtect on Mac, and do you still need antivirus?

The rest of macOS's built-in protection

Should you turn on the Mac firewall? What it does

The other security switch people ask about

How to factory reset a MacBook before you sell it

Why encryption makes erasing quick

How to check a Mac for malware and remove it

What FileVault doesn't protect against

More detailed guides:

Sources

Spotted something out of date? Tell us and we'll fix it.

See FileVault and your other security settings at a glance

Tend is free to download. Pro is $1.99 a month, $12.99 a year with a 7-day free trial, or $29.99 once.

Download TendSee pricing