FileVault
The facts below are what the maker publishes about FileVault, checked and dated. Our editors have not written about it yet.
The facts
Each one read from FileVault's own pages, with the date it was checked.
What it does
- Automatic encryption
- On Macs with Apple silicon or an Apple T2 Security Chip, data is encrypted automatically; turning on FileVault adds a login-password requirement for access.checked 5 Oct 2026
- Federal standards
- Apple says FileVault encryption uses Apple FIPS-validated cryptographic modules and the AES-XTS algorithm to help meet high-assurance United States federal standards.checked 5 Oct 2026
- Hardware key security
- On Apple silicon and T2 Macs, FileVault key handling occurs in the Secure Enclave, and encryption keys are never directly exposed to the CPU.checked 5 Oct 2026
- Intended users
- Apple describes FileVault as protection for sensitive data, including company financial information on a Mac laptop and organizational data on a lost or stolen Mac.checked 5 Oct 2026
- Organization management
- Organizations can manage FileVault using SecureToken or Bootstrap Token, and a device management service can escrow a personal recovery key.checked 5 Oct 2026
- Pre-activation data limit
- Data added and deleted before FileVault is turned on is not encrypted and may be recoverable with forensic tools.checked 5 Oct 2026
- Protection
- FileVault uses AES-XTS to encrypt full storage volumes.checked 5 Oct 2026
- Purpose
- FileVault is a built-in Mac encryption capability that protects data at rest on internal and removable storage.checked 5 Oct 2026
- Recovery
- Users can choose an iCloud account or a recovery key to unlock the startup disk and reset a forgotten login password.checked 5 Oct 2026
- Recovery risk
- Apple warns that files and settings are lost if the user forgets both their login password and recovery key and cannot reset the password.checked 5 Oct 2026
- Removable storage limit
- Encryption of removable storage does not use Secure Enclave security capabilities.checked 5 Oct 2026
- SSH unlock
- On Apple silicon Macs running macOS 26 or later, FileVault can be unlocked over SSH after restart when Remote Login and a network connection are available.checked 5 Oct 2026
Where it runs
- Older Macs
- Apple says FileVault must be turned on to encrypt data on Macs without Apple silicon or a T2 chip.checked 5 Oct 2026
