Turn on FileVault so a stolen Mac can't be read — via Apple Support

Hidden settingmedium riskNeeds adminmacOS 14 Sonoma and later

On Apple silicon and T2 Macs the disk is always encrypted, but without FileVault it isn't tied to your password. Turning FileVault on means nobody can get at your files without your login password or recovery key. On older Intel Macs without a T2 chip it's the only disk encryption.

Takes effect right away

How to do it

  1. Open System Settings > Privacy & Security and click FileVault.
  2. Turn it on and choose how to unlock it if you forget your password: your iCloud account, or a recovery key.
  3. If you choose a recovery key, write it down exactly and keep it somewhere safe away from the Mac.
You need to be an administrator. Other users on the Mac unlock the disk with their own login passwords. Your data is only lost for good if no working route back in is left: no login password that can unlock the disk, no iCloud account recovery set up, and no recovery key.

Sources

Source reviewed
2026-11-02
Link checked
2026-11-02
Tested hands-on
Not by Oddbyte.Me

Oddbyte.Me hasn't tried this on every macOS version, so keep the undo handy.

filevaultencryptionstolen macrecovery keysecurity

More in Security & Privacy

Find which app is using your mic or camera — via Apple Support

Tricklow risk

A coloured dot next to the Control Center icon tells you something is recording: orange means the microphone is in use, green means a camera is in use, and purple means system audio is being recorded. Opening Control Center tells you which app it is, so you can catch anything listening or watching when it shouldn't be.