FileVault

FileVault is a disk encryption feature in macOS that protects data at rest by encrypting the startup disk. When enabled, the contents of the disk are encrypted and a user must authenticate to unlock the disk during boot or login.

FileVault has evolved from the original FileVault (FileVault 1) to FileVault 2. FileVault 2, introduced with macOS 10.7 Lion, provides full-disk encryption with pre-boot authentication, meaning the startup disk remains encrypted until the user signs in at startup. It later integrated with Apple’s changes to the file system and operating system, continuing as the standard full-disk encryption solution on modern macOS releases.

Encryption in FileVault 2 uses XTS-AES-128 with a 256-bit key to protect data on the disk. A Volume Master Key protects the encrypted volume and is unlocked by user credentials at login. Users can generate a recovery key to regain access if a password is forgotten, and optionally link recovery to an iCloud account on some setups. In organizational contexts, an Institutional Recovery Key or mobile device management (MDM) can escrow recovery access for administrators.

Management and usage: FileVault is configured through System Preferences > Security & Privacy > FileVault. Administrators can decide which users can unlock the disk. Enabling FileVault may require a reboot and will encrypt the disk in the background. Modern Macs with solid-state drives tend to show minimal performance impact, while older hardware may experience more noticeable changes during encryption.

Security notes: FileVault protects data if the device is lost or stolen, but access depends on the availability of a valid unlock method or recovery key. Losing access keys without recovery options can result in data loss. FileVault remains the standard macOS solution for startup-disk encryption and is compatible with APFS-based volumes in current macOS versions.