Turn on FileVault full-disk encryption

Steps

1. 01

   Check whether it is already on

   Ventura or later

   • Apple menu›System Settings›Privacy & Security›FileVault

   Monterey or earlier

   • On Monterey and earlier the same setting is at Apple menu → System Preferences → Security & Privacy → FileVault tab

   • If it reads On, the disk is already encrypted — go straight to the recovery-key step and make sure you can actually produce yours

   ✓You should see: FileVault shows On or Off, with a button to change it.

   Why?

   Apple silicon Macs encrypt the disk at rest regardless; FileVault is what ties decryption to your login, which is the part that protects you if the machine is stolen.

2. 02

   Decide how you will get back in — before you encrypt

   • Apple offers two choices when you turn it on: 'Allow my iCloud account to unlock my disk', or 'Create a recovery key and do not use my iCloud account'
   • The Apple Account route lets you reset your login password with that account if you forget it — easiest to recover from, and only as strong as the account, so turn on two-factor authentication there first
   • The recovery key route gives you a string of letters and numbers that you alone keep

   !Careful: If you choose the recovery key, it is genuinely the only way back in. Apple cannot reset it for you. Lose both the password and the key and the data stays encrypted — that is the feature working as designed.

3. 03

   Turn it on

   • Click Turn On, make the choice above, and let it start
   • Keep the Mac plugged in for the first pass — it runs in the background for a few hours and you can keep working

   ✓You should see: FileVault reads On, with a progress note while the first encryption pass runs.

   !Careful: Don't let the battery die partway through the first pass. Plug it in and leave it plugged in.

   Also see: Keep your Mac battery healthy

4. 04

   Store the key off this Mac, then prove the copy works

   • Apple's instruction is to keep a copy of the key somewhere other than your encrypted startup disk — on paper, or in a password manager on another device
   • If you write it down, copy the letters and numbers exactly as shown
   • Check it from a different device now — read it back off the paper copy, or out of the password manager on your phone — before you need it

   ✓You should see: The recovery key readable on something that is not this Mac.

   !Careful: A recovery key stored only on the encrypted disk is no key at all. Do this today, not when you need it.

5. 05

   Enable every account that needs to sign in

   • If more than one person uses this Mac, each account has to be enabled for FileVault individually
   • Enable the others from an account that already can, then restart and have each person sign in once to confirm

   ✓You should see: Every user can log in normally after a full restart.

   Why?

   An account that was never enabled simply cannot unlock the machine after a restart — it looks like a broken password, and it isn't.

   Also see: Can't log in to your Mac: password and FileVault recovery