Mac Disk Encryption: FileVault, Apple Silicon and What Else to Encrypt

Steps use macOS 14 and later names. Menu wording can differ slightly between versions.

The layers of Mac disk encryption

The internal disk: automatic encryption plus FileVault

Apple says Macs with Apple silicon or an Apple T2 Security Chip encrypt data automatically, and Macs without either chip need FileVault turned on to encrypt data. Apple's security guide says the encrypted internal volumes stay locked without valid login credentials or a recovery key, even if the storage is moved to another computer. Learn the details in what is FileVault on a Mac and the steps in how to turn FileVault on or off.

External drives and backups are your job

Apple says removable media such as USB drives and memory cards can be read on another computer if lost or stolen, so you encrypt them as a separate step. Apple's security guide adds that removable storage does not use the Secure Enclave. It is encrypted the same way as on an Intel-based Mac without a T2 chip. Backups follow the same rule: Apple says an external backup disk without disk encryption can be read by anyone who gets the disk.

• Drive steps: how to encrypt an external drive on Mac.
• Backup steps: how to encrypt a Time Machine backup.
• One folder or archive: encrypted disk images.

Check what is encrypted

1. Check the chip

   Open the Apple menu and choose About This Mac. A line named Chip means Apple silicon. A line named Processor means an Intel Mac. On an Intel Mac, hold Option, choose Apple menu > System Information and select Controller or iBridge to look for "Apple T2 chip".

2. Check FileVault

   Open System Settings > Privacy & Security and scroll to FileVault.

3. Check each external disk

   Open Disk Utility and choose View > Show Only Volumes. Select the volume. Apple's notice on encrypted disks says the details under the volume's name list "Encrypted" when it is encrypted.

4. Check your backup disk

   Look at the backup volume the same way in Disk Utility, and open System Settings > General > Time Machine to see your backup disks.

5. List the copies that left the Mac

   Cloud folders, old drives and sent files are outside all of the layers above. Note them, then see how to encrypt files before cloud sync.

A format change to plan for

The encrypted formats that Disk Utility lists for new volumes are APFS (Encrypted) and APFS (Case-sensitive, Encrypted). Apple also published a notice that in macOS 28 and later, the Mac OS Extended format will be supported only for volumes that are not encrypted. If an old external drive is both Mac OS Extended and encrypted, Apple tells you to convert it to APFS, decrypt it or reformat it before you upgrade. The notice says the Convert and Decrypt options do not apply to encrypted Time Machine backup disks. Read it before you upgrade.

Match the layer to your worry

What disk encryption does not do

Disk encryption guards data at rest. Once you log in, or once you unlock a drive, the files are readable by anyone who can use that session. Cryptomator's own security page makes the same point about its vaults: it cannot protect against malware on a computer that is reading unlocked files, and it recommends full disk encryption alongside it. For one folder that stays locked after login, see how to encrypt a folder on Mac and FileVault vs a folder vault.