FileVault is Apple’s built-in full-disk encryption for Mac. It helps keep your files unreadable if someone steals the computer and tries to pull data off the drive without your login password. On Macs with Apple silicon or a T2 chip, storage is already encrypted at a hardware level; turning on FileVault adds the requirement that your credentials (or recovery key) are needed to unlock the disk at boot (Apple Mac User Guide; Apple Platform Security — FileVault).

This guide is how to turn on FileVault for a US household Mac. It is not a malware-removal walkthrough (protect a Mac from malware) and not how to erase a Mac before you sell it (wipe device before selling). No third-party purchase required.

1. What FileVault does (and does not)

  1. Does: Encrypt the startup volume so that without a valid login password or recovery key, data stays protected even if the drive is removed and attached to another computer (Apple Platform Security).
  2. Does: On Apple silicon / T2 Macs, make boot unlock depend on your credentials after FileVault is on.
  3. Does not: Replace a strong login password, password manager habits, Find My / lost-device steps (lost phone lock Apple / Google), or careful browsing.
  4. Does not: Magically encrypt data you deleted before enabling FileVault on older setups — Apple notes some pre-enable deleted data may still be recoverable with forensic tools (Apple Platform Security).

2. Before you turn it on

  1. You must be an administrator on the Mac (Apple Mac User Guide).
  2. Decide how you will unlock the disk if you forget your password:
    • iCloud account — convenient if you already use iCloud; you do not keep a separate recovery key string.
    • Recovery key — Apple generates a string of letters and numbers; store it somewhere other than the encrypted Mac, and not taped to the laptop.
  3. Critical warning (Apple): If you forget your login password and cannot reset it, and you also lose the recovery key / iCloud unlock path, you will not be able to log in — files and settings can be lost forever (Apple Mac User Guide).
  4. Optional but smart: confirm Time Machine or another backup you trust exists before you change encryption settings — encryption protects a stolen disk; it does not replace backups.

3. Turn on FileVault (System Settings)

Steps follow Apple’s current Mac User Guide path:

  1. On your Mac, choose Apple menu → System Settings.
  2. Click Privacy & Security in the sidebar, then click FileVault (you may need to scroll).
  3. Turn on FileVault. Enter your administrator password if asked.
  4. Choose how to unlock the disk if you forget your password:
    • iCloud: choose to allow your iCloud account to unlock the disk (or set up iCloud if prompted).
    • Recovery key: choose to create a recovery key and not use iCloud. Write the key down exactly and store it safely offline.
  5. Click Continue.
  6. If other user accounts exist: their data is also encrypted. If you see Enable Users, enter each user’s login password so they can unlock the disk, then continue (Apple Mac User Guide).

Encryption may continue in the background. Leave the Mac plugged in when possible until the process finishes.

4. After FileVault is on

  1. Confirm FileVault shows as on under Privacy & Security → FileVault.
  2. If you chose a recovery key, verify you can still find your copy — Apple also notes the key can appear under FileVault settings / keychain workflows in some macOS versions; do not rely on “I will remember later” (Apple Platform Security — recovery).
  3. Keep your Mac login password unique and stored in a password manager you control.
  4. When you eventually sell or gift the Mac, use Apple’s erase / wipe path — encryption alone is not a substitute for a proper wipe (wipe device before selling).
  5. Pair disk encryption with everyday Mac hygiene — see protect a Mac from malware. Windows households comparing built-in options can read Is Microsoft Defender enough?.

FAQ

Do I need FileVault on an Apple silicon Mac?

Apple says data is encrypted automatically on Apple silicon / T2 Macs; FileVault adds an extra layer so someone cannot decrypt or access your data without your login password (Apple Mac User Guide).

What if I lose the recovery key?

If you also forget the login password and cannot reset it, Apple warns the data can be lost forever. Store the key offline in a place you will remember.

Will FileVault slow my Mac a lot?

Apple’s consumer guide does not frame FileVault as an optional “performance tradeoff” feature for modern Macs with hardware encryption support. Expect normal use after setup; the important part is finishing enablement and keeping unlock credentials safe.

Is this the same as wiping before I sell?

No. FileVault protects a Mac you still own. Selling or giving away the machine needs Apple’s erase process — see wipe device before selling.

Do I need a paid antivirus suite to use FileVault?

No. FileVault is built into macOS. Buy-nothing is valid.

Turning on FileVault does not require paid antivirus. Built-in macOS encryption plus careful passwords is a valid buy-nothing stack. If the household later wants multi-device paid protection, use only these on-site paid links: TotalAV (paid link), Norton (paid link), Bitdefender (paid link), McAfee (paid link), Avast (paid link).