If you keep a lot of valuable information on your Mac, encrypting it will help you keep the data safe. Apple’s built-in FileVault disk encryption on macOS is an effective way to do this.
But what exactly is FileVault, how does it work, and how can you enable it on your Mac? Let’s take a look.
Table of Contents
What Is FileVault Disk Encryption?
Encryption is not new to mankind. The history of encryption dates back to the seventh century BC when the Spartans used Scytale to encode and decode secret messages about war strategies. Over the years, encryption technologies have evolved, and in the 21st century they play a major role.
FileVault is a disk encryption program. It’s built into macOS and helps you encrypt data on your Mac to protect it from unauthorized access.
FileVault has been available on Macs since Mac OS X 10.3 Panther, but it had some shortcomings in terms of security. For one, it would only encrypt the user’s home directory, leaving the rest of the files unprotected. And two, it relied on a weaker encryption standard at the time, which could easily be broken.
Apple realized this and introduced FileVault 2 with OS X 10.7 Lion to address these issues. FileVault 2 abandons the home folder approach and, instead, encrypts the entire startup volume to offer complete protection to the data stored on your Mac. It also uses a stronger disk encryption standard (XTS-AES), which uses 256-bit keys for better security.
How Does FileVault Encryption Work?
FileVault employs a very straightforward approach to encryption. All it requires is for you to enable the option and set up a recovery process (for when you don’t decrypt the files using the default authentication method).
After you do this, FileVault does the heavy lifting in the background and encrypts all the files present on your disk on the fly. Similarly, any new file you create or save to the disk is also automatically encrypted in the background.
The time it takes to complete the process depends on your Mac model and the amount of data on your disk. On Apple Silicon Macs, it’s a matter of a few minutes. Meanwhile, if you’re on an older, Intel-based Mac, the encryption process may take a few hours to complete. You can, however, continue to use your Mac during this time.
Is FileVault Encryption Different From the Disk Utility Encryption?
Disk Utility is another built-in macOS utility that helps you encrypt and keep your data safe, among other things, on your Mac. It uses the same encryption standard as FileVault, and the thing that differentiates the two is they have different use cases.
Encrypting your storage with FileVault encrypts the existing and new data (as it’s saved) on the fly without formatting the drive. On the other hand, doing so with Disk Utility involves drive formatting, which is time-consuming and not ideal for everyone.
Encrypting with Disk Utility is best suited for when you want to both format the disk and encrypt its data at the same time; you can’t use it to encrypt the disk while retaining existing data on it. Plus, you may also find it useful when you want to encrypt only a part of your home directory.
How to Use FileVault to Encrypt Data on Your Mac
FileVault is easy to set up and use. However, if you own a Mac that runs on Apple Silicon or has the Apple T2 Security Chip, it already has the FileVault encryption turned on.
Check if FileVault Is Already Enabled on Your Mac
If you want to check the FileVault encryption status on your Mac, here’s how you do it:
- Launch System Settings.
- Go to Privacy & Security and find FileVault.
- Click on FileVault and check the status of the button next to FileVault.
If it reads Turn Off, then FileVault is enabled on your Mac, and you don’t need to do anything. Otherwise, if it says Turn On, you need to enable it manually.
Enable FileVault on Your Mac
Enabling FileVault encryption on your Mac requires administrative privileges, i.e., you need the administrator password. Considering you have it, here’s how to turn on FileVault:
- Go back to System Settings.
- Head into Privacy & Security > FileVault.
- Click on the Turn On button next to FileVault.
- When prompted for the administrator password, enter it and click the Unlock button.
- FileVault will now give you two recovery methods to unlock your startup disk and reset your password in case you forget it. You can either use your iCloud account or create a FileVault recovery key. [Below we’ve broken down the pros and cons of each method.] Choose one and hit Continue.
- If you pick the iCloud method, FileVault will start encrypting the data on your drive right away without requiring you to do anything else.
- Alternatively, if you choose the recovery key option, FileVault will return a 24-character alphanumeric recovery key on the screen. Note it down somewhere other than the disk you’re encrypting, perhaps in a password manager, in case you forget your password. Hit Continue to begin encryption.
Once encryption begins, you’ll see an estimated time for the process to complete at the bottom. Since the process runs in the background, you can continue using your Mac in the meantime.
Choosing which recovery method to use is very important. But since it can be confusing, we’ll weigh the pros and cons of each to help you decide better.
With the iCloud account method, all you need to know is your iCloud email address and password. This makes it a more convenient option, but it also makes it less secure since if someone gets hold of your iCloud account and password, they can easily decrypt your data.
On the other hand, the recovery key method is more secure, as it’s only you who has the recovery key. However, it’s equally risky: if you lose the recovery key and forget your password, you can’t access the data on your Mac again.
Disable FileVault
If, for some reason, you wish to turn off FileVault encryption and decrypt all your files on the disk, this is how you can do it:
- Open System Settings.
- Go to Privacy & Security > FileVault.
- On this page, click the Turn Off button.
- If prompted for an administrator password, enter it and hit the Turn Off Encryption button.
FileVault will begin decrypting files on your Mac. Again, this process may take some time, but you don’t have to wait for it to finish to get back to your work.
Who Is FileVault for?
Short answer, everyone.
FileVault is a security feature that can help all Mac users, including those using the latest Apple Silicon Macs. While a Mac running Apple Silicon or having an Apple T2 Security Chip encrypts all your data automatically, the FileVault encryption can still be beneficial.
Enabling it can add an extra layer of security to your Mac and prevent someone from decrypting its data or accessing it without the login password.
When Should You Use FileVault?
FileVault secures your data using full-disk encryption. Now, whether you need it or not depends on how and where you use your Mac.
If you carry your Mac everywhere and have a lot of personal or your company’s confidential data on it, it makes sense to encrypt the data using FileVault. You may, however, skip it if you use your Mac at home and it runs on the Apple Silicon or has the T2 Security Chip, as the standard encryption will serve you just fine. Similarly, you may also skip it if you don’t store any sensitive data on your Mac.
If you ask us, we’ll say you should have FileVault enabled, especially if you have one of the Apple Silicon Macs. FileVault encryption and decryption on these machines is a quick process, and leaving it turned on doesn’t affect the performance. So, in essence, you’re boosting your Mac’s security without any trade-offs.
Enhance Your Mac’s Security to Keep Your Data Safe
Using FileVault is just one of the many ways to enhance your Mac’s security and improve the privacy of your data. But it’s not a comprehensive solution for all kinds of privacy and security nightmares.
For protecting yourself from other threats and keeping your data safe, installing updates timely, enabling the built-in firewall, being mindful of programs you install on your Mac, auditing your privacy permissions from time to time, and taking frequent backups are more effective solutions.
