On a Mac with Apple silicon or an Apple T2 Security Chip, data is encrypted automatically. Turning on FileVault adds a further layer: nobody can decrypt or reach your data without your login password. Older Intel Macs without a T2 chip must switch FileVault on to get any disk encryption at all.
Why developers should care
A developer laptop holds more than documents. It carries SSH keys, cloud CLI tokens, browser sessions, source code and local databases. If the machine is lost or stolen, the question is whether someone can read the disk by pulling it out or booting from another system.
Disk encryption is the control that answers that question. It does nothing against malware running while you are logged in, so treat it as the baseline for the lost laptop case, not a complete defence.
How to check and turn it on
On current macOS, open System Settings, then Privacy & Security, then FileVault. You will see whether it is on. To turn it on you must be an administrator. You may be asked for your password, and then you pick an unlock method and click Continue.
If other people have accounts on the Mac, they unlock the disk with their own login passwords. If an Enable Users button appears, you need to enter each user's login password before that user can unlock the disk.
Apple's documentation also notes that the protection works with hardware in the Mac. On Apple silicon and T2 Macs, the Secure Enclave generates and stores the keys used to encrypt data at rest, and a hardware AES engine encrypts and decrypts files as they are written and read. The main processor and the operating system never see the long lived keys.
Pick the recovery option on purpose
When you turn FileVault on, you choose how to recover if you forget your login password.
- iCloud account. Convenient, with no separate key to track.
- Recovery key. A generated string of letters and numbers. Keep a copy somewhere other than the encrypted startup disk, and not with the Mac.
On business Macs, the organisation can also set a recovery key. If you manage a team, decide which option you allow before people choose for themselves. Our post on where to keep recovery keys for encrypted laptops covers the options.
Apple is blunt about the downside. If you lose your login password and cannot reset it, and you have also lost the recovery key, you cannot log in, and your files and settings are lost for good. Copy a written key exactly.
A short checklist
- FileVault shows as on in System Settings.
- A recovery method is chosen and tested, not just assumed.
- Every user account on the machine has a strong login password.
- The Mac locks when you step away.
- You know who to call, and what to do, if it goes missing. See the lost laptop checklist.
Quick check
Does a Mac with Apple silicon need FileVault turned on to be encrypted?
Data on Apple silicon and T2 Macs is encrypted automatically. FileVault adds the requirement for your login password before the data can be decrypted. Intel Macs without a T2 chip need FileVault turned on to encrypt at all.
Where should the FileVault recovery key live?
Somewhere other than the encrypted startup disk and not with the Mac, such as a password manager your team controls or a sealed record held by IT.
Sources
- Protect data on your Mac with FileVault, Apple Support
- Hardware security overview, Apple Platform Security
Last reviewed: 19 October 2026.
