How to Turn FileVault On or Off on a Mac, and Check Its Status
To turn FileVault on, open System Settings, click Privacy & Security, click FileVault, turn it on and choose a recovery method: your iCloud account or a recovery key. To turn it off, use the same setting and click Turn Off Encryption. You must be an administrator to set it up. Save your recovery key first.
Steps use macOS 14 and later names. Menu wording can differ slightly between versions.
Before you turn FileVault on
- Be an administrator. Apple says you must be one to set up FileVault.
- Choose your recovery method now. You pick one during setup. The table below compares them.
- Know the risk. Apple warns that if you forget your login password, cannot reset it and lose the recovery key, you cannot log in and your files and settings are lost.
- Back up first. A backup on a disk you control is your safety net. Encrypt that disk too: see how to encrypt a Time Machine backup.
- On a work Mac, ask IT. Apple says a business or school can set its own recovery key. See the work Mac section of the recovery key guide.
| Choice | Fits when | Watch for |
|---|---|---|
| iCloud account | You use iCloud or plan to, and want no separate key to track | Your way back in is tied to that Apple Account |
| Recovery key | You do not want iCloud involved | You must record and track the key yourself |
| Institution key | The Mac belongs to a business or school | The institution sets it. Ask your administrator. |
Turn FileVault on
-
Open the setting
Open the Apple menu, choose System Settings, click Privacy & Security in the sidebar, then click FileVault. You may need to scroll down.
-
Turn it on
Turn on FileVault. You might be asked for your password.
-
Choose how to unlock your disk
Choose your iCloud account, or choose a recovery key. Apple's recovery page words these as "Allow my iCloud account to unlock my disk" and "Create a recovery key and do not use my iCloud account". The recovery key is a string of letters and numbers.
-
Record the key
If you made a recovery key, copy the letters and numbers exactly as shown. Keep a copy somewhere other than the encrypted startup disk, and somewhere safe that is not with the Mac.
-
Click Continue
Click Continue. If an Enable Users button appears, select a user, enter that user's login password, click OK, then click Continue.
-
Check the result
Return to System Settings > Privacy & Security > FileVault and confirm that it shows as on.
Apple's pages do not say how long the first encryption takes. Use the Terminal commands below to watch it.
After you turn it on
- Store the recovery key now. Put it in a password manager or on paper, away from the Mac. Apple says to keep it somewhere other than the encrypted startup disk.
- Check each user. Apple says other users unlock the disk with their own login passwords. Make sure each person who needs to log in has been enabled.
- Check your backups. Apple says a backup disk without disk encryption can be read by anyone who gets it, so it needs its own encryption. See how to encrypt a Time Machine backup.
Turn FileVault off
- Open the Apple menu, choose System Settings, click Privacy & Security, then click FileVault.
- Turn off FileVault.
- Click Turn Off Encryption.
Apple warns that turning FileVault off removes that extra layer of protection. Apple does not say how long it takes or whether you will be asked for a password. What happens to the data depends on the Mac. Apple says Macs with Apple silicon or a T2 chip encrypt data automatically. On Apple silicon, the security guide says the key is then protected by the hardware only, not by a password. An Intel Mac without a T2 chip is not encrypted once FileVault is off.
Check whether FileVault is on
The setting under Privacy & Security > FileVault is the simple check. For Terminal, the manual page for fdesetup says the status command indicates whether FileVault is on or off, and that -extended adds an approximate time remaining while the Mac encrypts or decrypts. Run man fdesetup to read it.
fdesetup statusfdesetup status -extendedIf you cannot turn it on or off
- You are not an administrator. Apple says an administrator must set up FileVault.
- An Enable Users button is showing. Click it and enter each user's login password, so those users can unlock the disk.
- It is a work Mac. Apple's guide for administrators says an organization can require FileVault during Setup Assistant, and can escrow the recovery key to stop users turning FileVault off afterward. Ask your IT team.
- You lost the recovery key. See the FileVault recovery key guide.
The idea behind FileVault is in what is FileVault on a Mac. For protection that stays in force after you log in, read FileVault vs a folder vault.
Frequently asked questions
Do I need to be an administrator to turn on FileVault?
Yes. Apple says you must be an administrator to set up FileVault.
How long does FileVault take to turn on?
Apple's pages do not give a time. While it runs, fdesetup status -extended in Terminal shows an approximate time remaining, according to its manual page.
Can I use my Mac while FileVault encrypts?
Apple's FileVault page does not say. Its page on encrypting removable drives says you can keep using the Mac while a drive encrypts, but that is a different job.
Does turning FileVault off delete my files?
Apple's page says turning it off removes the extra layer of protection. It does not describe any deletion.
Why can I not turn FileVault off on my work Mac?
Apple says administrators can use device management to keep users from turning FileVault off after setup. Ask your IT team.
Is FileVault already on when I buy a new Mac?
Apple says Macs with Apple silicon or a T2 chip encrypt data automatically, which is not the same as FileVault being on. Check System Settings > Privacy & Security > FileVault.
References
Your files. Your Mac. Locked.
Coming soon. Join the waitlist and we email the link.
Get early access