FileVault Recovery Key: Find It, Use It, and What a Work Mac Changes

Steps use macOS 14 and later names. Menu wording can differ slightly between versions.

What the recovery key is

Apple describes the FileVault recovery key as a 24-character alphanumeric code created when FileVault is turned on. It is not the same thing as an Apple Account recovery key. Apple says a recovery key can unlock your startup disk or turn off FileVault, so guard it as carefully as your login password.

Apple's security guide adds that the key can be used in recoveryOS, or at the login window by pressing ⇧⌥Return, instead of the user password. If you chose your iCloud account as the recovery method, Apple says you can also reset a forgotten login password with your Apple Account while logging in.

Where to look for it

1. Where you saved it. Apple says to keep a copy somewhere other than the encrypted startup disk, in a safe place that is not with the Mac.
2. The Passwords app on the Mac. Apple says you get a recovery key during FileVault setup. Open Passwords, click All in the sidebar, click your Mac's name, and hold the pointer over the recovery key to show it. Apple's security guide says the key is stored in the keychain so Passwords can retrieve it.
3. Another device. Apple says that if the Mac runs macOS Tahoe 26 or later, the key may be in the Passwords app on an iPhone, iPad or another Mac. That device must use the same Apple Account, with iCloud Passwords & Keychain turned on. Search for "recovery key" and open the entry with your Mac's name.
4. iCloud Keychain. Apple's security guide says that when you use iCloud Keychain, the recovery key is synchronized with your other passwords. Without iCloud, Apple says you are shown the key and should store it in a safe location.

Use the key to get back in

1. Try the login window first

   Check that Caps Lock is off and the keyboard language is right. If a question mark appears next to the password field, click it. You may see a password hint or a reset message such as "Reset Password".

2. Follow the reset prompts

   If no message appears, enter a password up to three times. Apple says the onscreen steps vary. They may ask for your recovery key or for your Apple Account email and password.

3. Enter the key exactly

   Type the recovery key exactly as you wrote it.

4. Use Recovery if the login window fails

   Start up from macOS Recovery. Select a user whose password you know, or click "Forgot all passwords?", then follow the onscreen steps. They may include your recovery key or the Apple Account used on this Mac.

5. Make a new password

   Create a new password when asked, restart, and log in with it. Apple lists the full steps in "If you forgot your Mac login password".

If the key is gone

Apple says that if you forget your login password, cannot reset it and also lose the recovery key, you cannot log in and your files and settings are lost. Apple's last-resort step is to erase the Mac. It permanently removes each user account, its password and its data. Restoring afterward needs a backup, and an encrypted Time Machine backup needs its own password. See how to encrypt a Time Machine backup.

Work Macs: when an administrator holds a key

Apple says that if a Mac belongs to a business or school, the institution can also set a recovery key. If an administrator configured the encryption, Apple advises you to ask your administrator for help with unlocking your encrypted information. The administrator can also help you reset your password.

For administrators, Apple's security guide says the organization's device management service can optionally escrow the key, meaning a copy is stored with the service. Apple's deployment guide says the Mac encrypts a personal recovery key with a certificate the service supplies, the service can hide the key from the user, and it can rotate the key after use. Apple says the older institutional recovery key is no longer recommended for managing FileVault on Macs.

These Apple pages do not say what a particular employer or product stores, or how a company uses it. A recovery key can unlock the startup disk, so ask your IT team directly. Our work laptop scenario explains why personal files belong on a personal device.

Keep the key safe from now on

• Store it in a password manager or on paper, away from the Mac.
• If you wrote it down, copy the letters and numbers exactly.
• Do not keep the only copy on the Mac it unlocks.