FileVault vs a Folder Vault: Do You Need Both?

Steps use macOS 14 and later names. Menu wording can differ slightly between versions.

What FileVault does

Apple describes FileVault as a layer of protection for your startup disk: without your login password, others cannot decrypt your data. Macs with Apple silicon or a T2 chip encrypt data automatically, and FileVault adds the requirement for your password. If other user accounts exist, their data is encrypted too, and each person unlocks with their own login password.

1. Open the setting

   Choose Apple menu > System Settings > Privacy & Security and scroll to FileVault. You must be an administrator.

2. Turn it on

   Choose how to recover access if you forget your password: your iCloud account or a recovery key.

3. Keep the recovery key safe

   If you lose both your password and your recovery key, Apple says your files and settings are lost.

Apple's platform security guide explains why the switch matters. On a Mac with Apple silicon or a T2 chip the disk is encrypted either way, but with FileVault off the key is protected only by the Mac's hardware. With FileVault on, the key also depends on your password, and your credentials are required while the Mac starts. Without them or the recovery key, the internal volumes stay encrypted even if the drive is moved to another computer. Step by step: turn FileVault on or off.

How to check that FileVault is working

1. Open System Settings > Privacy & Security and scroll to FileVault. Confirm it is turned on.
2. Confirm you picked a recovery method, your iCloud account or a recovery key. Store a recovery key away from the Mac. See the recovery key guide.
3. Restart the Mac. The login screen must ask for your password. Apple says Touch ID is not accepted for the first login after a shut down or restart.
4. Open the Lock Screen settings. Apple lets you set how long the Mac can sit idle before it asks for a password again. Pick the shortest time the menu offers.

What FileVault does not do

• It does not lock one folder inside your logged-in account.
• It does not stop someone who knows your login password.
• It does not hide files. Everything you can read when logged in stays readable.
• It does not encrypt a Time Machine backup disk for you. Turn on "Encrypt Backup" there separately.
• It does not keep other accounts out of the Public or Shared folder. Apple says all users of the Mac can read items there.

Easy mix-ups

• Screen lock is not FileVault. The lock screen asks for a password when the Mac wakes. FileVault asks for credentials when the Mac starts.
• Touch ID has limits. Apple lists when your password is required instead: after a restart or shut down, after more than 48 hours without unlocking, after five unrecognised fingerprints in a row, and when you change Touch ID settings.
• Other accounts are covered too. Apple says other users' data is encrypted, and each person unlocks the disk with their own login password. See a shared family Mac.
• A work Mac may have a second key. Apple says a business or school can set a recovery key too. See a work laptop with IT access.

Which situation needs which

Use both

Turn on FileVault for the whole disk. Add an encrypted container, such as a Disk Utility image or Hidden Folder, for the files that must stay private on your unlocked Mac. Compare in detail: Hidden Folder vs FileVault.

1. Turn on FileVault and save the recovery method.
2. Put the files that must stay private in an encrypted container. Keep them out of Downloads and Desktop.
3. Encrypt your backup disk too, because Apple recommends it. See how to encrypt a Time Machine backup.
4. Test the container half. Lock it, then try to open a file from Finder. The file must stay closed until you unlock the container again.