FileVault

Spec sheet

Purpose

FileVault is a built-in Mac encryption capability that protects data at rest on internal and removable storage.Read 5 Oct 2026 · support.apple.com

Intended users

Apple describes FileVault as protection for sensitive data, including company financial information on a Mac laptop and organizational data on a lost or stolen Mac.Read 5 Oct 2026 · support.apple.com

Automatic encryption

On Macs with Apple silicon or an Apple T2 Security Chip, data is encrypted automatically; turning on FileVault adds a login-password requirement for access.Read 5 Oct 2026 · support.apple.com

Federal standards

Apple says FileVault encryption uses Apple FIPS-validated cryptographic modules and the AES-XTS algorithm to help meet high-assurance United States federal standards.Read 5 Oct 2026 · support.apple.com

Hardware key security

On Apple silicon and T2 Macs, FileVault key handling occurs in the Secure Enclave, and encryption keys are never directly exposed to the CPU.Read 5 Oct 2026 · support.apple.com

Older Macs

Apple says FileVault must be turned on to encrypt data on Macs without Apple silicon or a T2 chip.Read 5 Oct 2026 · support.apple.com

Organization management

Organizations can manage FileVault using SecureToken or Bootstrap Token, and a device management service can escrow a personal recovery key.Read 5 Oct 2026 · support.apple.com

Pre-activation data limit

Data added and deleted before FileVault is turned on is not encrypted and may be recoverable with forensic tools.Read 5 Oct 2026 · support.apple.com

Protection

FileVault uses AES-XTS to encrypt full storage volumes.Read 5 Oct 2026 · support.apple.com

Recovery

Users can choose an iCloud account or a recovery key to unlock the startup disk and reset a forgotten login password.Read 5 Oct 2026 · support.apple.com

Recovery risk

Apple warns that files and settings are lost if the user forgets both their login password and recovery key and cannot reset the password.Read 5 Oct 2026 · support.apple.com

Removable storage limit

Encryption of removable storage does not use Secure Enclave security capabilities.Read 5 Oct 2026 · support.apple.com

SSH unlock

On Apple silicon Macs running macOS 26 or later, FileVault can be unlocked over SSH after restart when Remote Login and a network connection are available.Read 5 Oct 2026 · support.apple.com

Where Specifiction places it

• Camera Apps#9 of 186.7
• Desktop Search Software#40 of 576.7