For a personal developer Mac, letting your iCloud account unlock the disk is the lower-effort choice. A recovery key is better when you do not want Apple's account system in the recovery path, but you must store the key away from the Mac. Lose your password and the key, and the data is gone.
What FileVault actually adds
Apple says Macs with Apple silicon or an Apple T2 chip already encrypt data automatically. FileVault adds a layer on top: the data cannot be reached without your login password. On Macs without Apple silicon or a T2 chip, FileVault is what turns encryption on at all.
You need to be an administrator to set it up. The switch lives in System Settings, under Privacy and Security, then FileVault.
The two recovery choices
During setup, macOS asks how you want to unlock the disk if you forget your password. Apple lists two options.
iCloud account. You do not track a separate key. The cost is that it requires you to use or set up iCloud on that Mac.
Recovery key. macOS generates a string of letters and numbers. You pick "Create a recovery key and do not use my iCloud account", and you should store a copy somewhere other than the Mac itself.
Apple's warning is blunt: if you lose both your login password and your recovery key, you cannot log in, and your files and settings are lost permanently.
How to decide
Ask three questions.
- Is this a company-managed Mac? Apple notes that businesses and schools can set a recovery key for managed Macs. If your employer manages the machine, follow their policy and do not pick for yourself.
- Do you already keep a personal iCloud account that you can sign in to from another device? If yes, the iCloud route removes one thing to lose.
- Do you have a place to keep a recovery key that survives losing your laptop, such as a password manager or a printed copy in a safe? If yes, the key route is workable.
If you cannot answer yes to question 2 or 3, fix that before you enable FileVault, not after.
A short setup checklist
- Back up what matters first, including SSH keys and any local-only repositories.
- Open System Settings, Privacy and Security, FileVault, and turn it on.
- Choose the unlock method from the section above.
- If asked, click Enable Users and enter the login password for any other user who should be able to unlock the disk.
- Put the recovery key somewhere that is not on this Mac, and test that you can find it.
What it does not cover
FileVault protects data at rest on a powered-off or locked Mac. It does not stop malware you run yourself, and it does not replace keeping your tokens out of dotfiles. Treat it as the base layer for a lost or stolen laptop, then add the rest.
If you manage several developer Macs, a written decision about which recovery method is allowed saves you from discovering the problem during an incident. Safeguard's free scan at gold.safeguard.sh/scan can check the dependencies in a repository, which is a separate job from protecting the disk the repository sits on.
Quick check
Do Apple silicon Macs need FileVault to be encrypted?
Apple says Macs with Apple silicon or a T2 chip encrypt data automatically. FileVault adds the login password requirement on top of that.
What happens if I lose both my password and my recovery key?
Apple states you cannot log in and your files and settings are lost permanently.
Sources
Last reviewed: 19 October 2026.
