What Is FileVault on a Mac? What It Protects and What It Leaves Open

Steps use macOS 14 and later names. Menu wording can differ slightly between versions.

FileVault in plain words

FileVault is the full-disk encryption of the Mac. It scrambles the contents of your startup disk, so someone who takes the Mac or the drive inside it cannot read your files without your login password. Apple's Platform Security guide calls it full-volume encryption and says it uses AES-XTS.

On Macs with Apple silicon or a T2 chip, Apple says all key handling happens in the Secure Enclave, which is Apple's name for the hardware that holds the keys. The keys are never exposed directly to the main processor. Apple also says the encrypted internal volumes stay locked without valid login credentials or a recovery key, even if the storage is moved to another computer.

Is your Mac already encrypted without FileVault?

It depends on the chip. Apple says Macs with Apple silicon or an Apple T2 Security Chip encrypt data automatically. Macs without either chip need FileVault turned on to encrypt data. FileVault then adds the requirement for your login password.

To see which Mac you have, follow these steps:

1. Open the Apple menu and choose About This Mac. Apple says an Apple silicon Mac shows a line named Chip. An Intel Mac shows a line named Processor.
2. On an Intel Mac, hold Option and choose Apple menu > System Information. Select Controller or iBridge in the sidebar. If you see "Apple T2 chip", your Mac has the T2 chip.
3. Open System Settings > Privacy & Security and scroll to FileVault to see whether it is on.

What FileVault covers and what it does not

• Other user accounts on the disk. Apple says their data is encrypted too, and each person unlocks the disk with their own login password. If an Enable Users button appears, a user's login password must be entered before that user can unlock the disk.
• External drives. FileVault is about the startup disk. Apple says removable media can be read on another computer if lost or stolen, and it describes encrypting such a drive as a separate step. See how to encrypt an external drive on Mac.
• Backups. Apple says that if you back up to an external disk without disk encryption, anyone who gets the disk can read the backed-up data. See how to encrypt a Time Machine backup.
• Copies that leave the Mac. Files you already synced to a cloud service are outside FileVault. See how to encrypt files before cloud sync.
• One folder inside your account. After you log in, your files are readable. For a lock on a single folder, read FileVault vs a folder vault.

If you forget your password

When you turn FileVault on, you choose a way back in: your iCloud account or a recovery key. Apple warns that if you forget your login password, cannot reset it and also lose the recovery key, you cannot log in and your files and settings are lost. The full picture, including what changes on a work Mac, is in the FileVault recovery key guide.

Turning it on or off

The setting is in System Settings > Privacy & Security > FileVault. Apple says you must be an administrator to set it up, and that turning it off removes the extra layer of protection. The steps are in how to turn FileVault on or off. For all the disks and backups around your Mac, see Mac disk encryption.

Questions about the name

Older articles and forums often write "FileVault 2". Apple's current pages say only FileVault. It is a Mac feature, so there is no FileVault for Windows. Microsoft describes its own tool, Device Encryption, as a Windows feature that enables BitLocker encryption automatically. On a work Mac, an administrator may manage FileVault through a device management service, as the recovery key guide explains.

Where Hidden Folder fits