Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
For protecting a Mac’s internal drive when the computer is lost or stolen, enable FileVault first. It is macOS’s built-in full-volume encryption and is the only protection established in Apple’s documentation for this specific startup-volume job. A third-party security app may protect against malware, provide privacy controls, create encrypted file containers, or encrypt removable media, but those functions are not automatically substitutes for FileVault.
The important nuance is that newer Macs already encrypt storage in hardware. FileVault still matters because it changes how the volume key is protected and requires a user credential during startup. Your Mac model, the type of data you need to protect, and your recovery plan determine whether you need anything beyond FileVault.
What FileVault does
FileVault is macOS’s built-in capability for encrypting complete storage volumes. Apple describes it as using AES-XTS to protect full volumes on internal and removable storage. When the Mac is powered off, the contents of an encrypted startup volume should not be readable simply by removing the storage or booting another operating system.
FileVault is primarily a data-at-rest control. It does not scan downloads, block phishing, manage application permissions, or make an unlocked Mac safe from someone already using your account. Once you unlock the Mac and log in, the operating system and approved processes can access your files according to your account and security settings.
#1 Best Overall
- Hardware encrypted drive
- Simple to use pin access. RPM-5400
- Administrator password feature
- Bus powered
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
What “full volume” means
FileVault protects the volume rather than just a folder. That includes user documents, application data, caches, system files and other data stored on the protected volume. This broad coverage is why it is the appropriate starting point for a lost-device scenario: you do not have to predict every file that might contain sensitive information.
What FileVault does not replace
- A strong account password and a separate password for your Apple Account remain important because FileVault does not prevent account takeover after login.
- Backups are still required. Encryption prevents unauthorized reading; it does not recover a failed or erased drive.
- Operating-system updates, malware defenses and safe browsing practices address threats that occur while the Mac is running.
- Encrypted containers or encrypted external drives protect selected data or portable media, not necessarily the entire internal startup volume.
Why a newer Mac can be encrypted before FileVault is turned on
The phrase “the drive is encrypted” can describe two different protections on modern Macs. Apple says APFS volumes are created with a volume encryption key by default. On Apple silicon Macs and Macs with a T2 Security Chip, internal storage connected directly to the Secure Enclave is encrypted even when FileVault is off after initial setup.
With FileVault off, Apple describes the volume encryption key as protected by the hardware UID in the Secure Enclave. Turning FileVault on changes the key-encryption arrangement: the key is protected by a combination of the user’s password and the hardware UID. In practical terms, hardware encryption at rest and FileVault’s password-gated startup protection are related but not identical states.
Apple’s technical description calls the Apple-silicon implementation Data Protection Class C, using a volume key. The hybrid design provides protection similar to FileVault for user data while adding hardware-backed key handling. Encryption being present by default therefore does not make FileVault pointless; enabling FileVault adds the user-credential requirement and gives you an explicit recovery-key workflow.
How your Mac model changes the answer
| Mac or storage situation | What Apple documents | Practical implication |
|---|---|---|
| Apple silicon Mac | Internal APFS storage is encrypted by default; Secure Enclave and the AES Engine handle supported internal-storage operations. FileVault changes protection of the volume key so the user password participates. | Turn on FileVault for password-gated startup and a managed recovery path, even though hardware encryption already exists. |
| Mac with a T2 Security Chip | Supported internal storage uses Secure Enclave and AES Engine capabilities. FileVault adds password-based protection of the volume key. | FileVault remains the control that ties access to a user credential at boot. |
| Intel Mac without T2 | FileVault is the documented mechanism for encrypting the startup volume. Apple distinguishes this Intel implementation from the Data Protection approach used on Apple silicon. | FileVault is especially important because you should not assume the same default hardware-backed behavior as on newer models. |
| Internal storage added to an older Mac | Apple notes that enabling FileVault encrypts existing files and future data in this context, but data added or deleted before activation may remain recoverable with forensic tools. | Enable encryption as early as possible and treat previously stored or deleted data as potentially exposed. |
| External or removable storage | Apple documents FileVault for removable storage, but says removable-storage encryption does not use Secure Enclave capabilities and works like encryption on an Intel Mac without T2. | Do not assume an external drive receives the same hardware-backed key handling as supported internal storage. |
The older-Intel and pre-existing-data caveat is specific to the situations Apple describes. Do not generalize it to every internal drive in every modern Mac.
What changes when FileVault is enabled
Startup authentication
After activation, credentials are required during boot. The Mac cannot simply start to a usable desktop without an authorized credential. This is a security benefit for a lost computer, but it also means that a forgotten password or unavailable recovery method can prevent access to your own data.
Rank #2
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
- Software Free Design - With no admin rights needed
- Sealed from Physical Attacks by Tough Epoxy Coating
- Brute Force Self Destruct Feature
Recovery-key generation
Apple says a recovery key is generated when FileVault is enabled. Depending on setup, it may be synchronized through iCloud Keychain or shown to you for safe storage. On a managed Mac, an organization can escrow the key through its device-management service. The exact choices shown depend on macOS version and whether the Mac is managed.
Secure Enclave key handling
On Apple silicon and T2 Macs, Apple says FileVault key handling occurs in the Secure Enclave and that encryption keys are not directly exposed to the CPU. This hardware boundary is one reason a generic “encryption” label in a third-party app cannot be assumed to provide the same startup and key-protection behavior.
How to turn on FileVault safely
Menu names vary by macOS release, but the current and legacy paths are consistent in purpose. Before enabling it, make sure your backup and recovery arrangements are usable.
- Confirm your Mac model and macOS version. Open the Apple menu and choose About This Mac. Note whether the Mac uses Apple silicon, has a T2 Security Chip, or is an older Intel model.
- Make a current backup. Use your normal backup system and verify that important files can be restored. FileVault does not protect against accidental deletion, drive failure or a lost recovery key.
- Open the FileVault controls. On recent macOS releases, go to Apple menu > System Settings > Privacy & Security > FileVault. On older releases, use Apple menu > System Preferences > Security & Privacy > FileVault.
- Choose to turn on FileVault. Authenticate with an administrator account when prompted. macOS may ask whether your recovery method uses iCloud Keychain or a separate recovery key.
- Record the recovery method immediately. If macOS displays a recovery key, store it in a secure password manager or another protected location that you can reach when the Mac is unavailable. Do not leave the only copy on the Mac being encrypted.
- Keep the Mac powered and connected. Encryption can continue in the background. Avoid interrupting the process or forcing a shutdown while macOS reports that encryption is in progress.
- Verify the status. Return to the FileVault pane and confirm that encryption is on or complete. On a managed Mac, verify with your administrator that the recovery key was escrowed.
If the Mac is used by more than one person, check which accounts are authorized to unlock the startup volume. A user who can log in after startup may not automatically be authorized for the pre-boot unlock screen.
FileVault versus a third-party security app
There is no single category called “third-party Mac encryption.” Products described as security apps can perform very different jobs. The reviewed Apple documentation establishes FileVault’s role but does not establish a named third-party product as a direct equivalent or improvement for full-volume startup encryption. Therefore, a blanket claim that any third-party app is stronger or safer than FileVault would be unsupported.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →| Question | FileVault | Third-party app you are considering |
|---|---|---|
| What is encrypted? | Full internal volume, with documented support for removable storage. | May be a whole volume, selected files, a mounted container or something else. Confirm in the product’s technical documentation. |
| When is protection active? | It protects data at rest and requires credentials during startup after activation. | Check whether protection exists before login, only after an app starts, or only when a container is mounted. |
| How are keys protected? | On Apple silicon and T2 Macs, Apple documents Secure Enclave-backed handling; the user password participates when FileVault is enabled. | Look for a precise description of key generation, hardware integration and where keys are stored. Marketing terms alone are not evidence. |
| How is access recovered? | Apple documents a recovery key, iCloud Keychain synchronization in applicable setups and organizational escrow on managed Macs. | Determine who controls recovery, whether a reset is possible, and what happens if the vendor account or subscription is unavailable. |
| Who manages policy? | macOS and, on managed devices, the organization’s device-management service. | Check compatibility with your management platform, macOS release and startup security configuration. |
| Does it replace FileVault? | It is the built-in control for the startup volume. | Only product-specific documentation proving equivalent scope and pre-boot behavior could support that conclusion. |
Functions that are not equivalent to FileVault
- Malware protection: useful against malicious software, but it does not encrypt a powered-off internal volume.
- Privacy or network controls: these can limit tracking or connections while the Mac is running, but they do not provide startup-volume encryption.
- Password vaults: they protect stored credentials inside a vault, not every file on the Mac.
- Encrypted file containers: they protect files placed inside the container, leaving other data outside it unaffected.
When an encrypted disk image or external drive makes sense
Apple documents encrypted disk images as secure containers for storing or transferring sensitive documents and files. This is a useful narrower control when you need a protected project folder, archive or hand-off package rather than encryption of the whole Mac.
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Choose a container when
- Only a defined set of files needs an extra encryption boundary.
- You need to transfer an encrypted collection between Macs.
- You want the container to remain locked while the rest of the account is in use.
A container does not replace FileVault: files outside it, temporary copies and application caches may remain unprotected if the internal volume itself is not encrypted.
Choose removable encrypted storage when
- You keep sensitive archives on a portable drive.
- You need to move data between systems without placing it on each computer’s internal disk.
- You can document the drive’s encryption method, compatibility and recovery process before storing irreplaceable files.
For an optional purchase, an encrypted external SSD is a category to evaluate, not a specific product recommendation. Compare the encryption method, key recovery, compatibility with your Mac and other devices, capacity, physical durability and backup plan. Do not infer current price, availability or performance from the category name.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A practical decision framework
If your concern is a lost or stolen Mac
Enable FileVault on the internal startup volume, keep the Mac’s account password private, maintain backups and secure the recovery method. This is the core case in which FileVault is the direct answer.
If you need protection for only a few files
Keep FileVault enabled for the Mac and add an encrypted disk image for the selected files if a second boundary is useful. This limits exposure when sharing or archiving that set, but it does not make other files on the Mac encrypted separately.
If you exchange data on portable media
Use encryption supported by the removable drive or by macOS, and verify how the key is recovered on every device that must open it. Remember that Apple documents different hardware handling for removable storage than for supported internal storage.
If an employer manages the Mac
Ask the administrator whether FileVault is enforced and whether the recovery key is escrowed in the organization’s device-management service. Do not create a personal recovery process that conflicts with company policy or leaves the organization without access to its escrowed key.
Rank #4
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
If you are evaluating a third-party app
Require current technical documentation for your exact macOS versions and Mac models. The documentation should state encryption scope, pre-boot behavior, credential and recovery design, key ownership, management support and what happens during uninstall, upgrade or account cancellation.
Free tools Windows power users keep installed
One-click scans. No signup required.
Common mistakes and how to avoid them
Assuming hardware encryption means FileVault is on
On Apple silicon and T2 Macs, storage can be encrypted before FileVault is enabled, but Apple describes a different protection of the volume key. Check the FileVault setting instead of relying on a general statement that the drive is encrypted.
Losing the recovery key
A recovery key that exists only on the encrypted Mac is not a recovery plan. Store it separately, test that the storage location is reachable, and understand whether your setup uses iCloud Keychain or organizational escrow.
Expecting FileVault to protect an already compromised session
FileVault addresses data at rest. If an attacker has your logged-in account, encryption will not stop access to files that the account can open. Use account security, updates and malware defenses for that threat.
Encrypting a removable drive and assuming the internal disk is covered
External-storage encryption protects that external volume. It does not automatically encrypt the Mac’s startup volume, backups stored elsewhere or temporary copies created during editing.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Installing an app without checking startup behavior
An app that encrypts a folder after login is not equivalent to a control that blocks access before macOS starts. Confirm the exact unlock point and recovery process before treating it as a replacement.
Ignoring older-drive history
For the older Mac and storage situations Apple identifies, files added or deleted before FileVault activation may remain recoverable with forensic tools. If that history matters, minimize further use of the drive and seek specialist advice rather than assuming a later activation erased old traces.
Bottom line
Use FileVault for the Mac’s internal startup volume. On modern Macs it complements default hardware encryption by protecting the volume key with the user password and enforcing authentication during boot; on older Intel Macs it is the principal built-in full-volume encryption mechanism Apple documents. Add an encrypted disk image or removable encrypted drive only for a narrower selected-file or portable-media requirement. Consider a third-party security app for the separate functions it actually documents, and never treat a generic security or privacy label as proof that it replaces FileVault.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
