How to unlock your Mac with its recovery key and FileVault active

FileVault hardens macOS by wrapping a layer of login protection around the part of the startup volume that contains your files and other data. With FileVault disabled, the data on this volume is effectively only a password away from an attacker and your files. It is a dangerous situation if someone has physical access to your computer – at your home or office or because they have stolen it – they might be able to use known and as yet undiscovered methods to bypass the connection and access the contents of the player.

FileVault on all Macs puts an extra bar up: your startup volume (or, as in the case of macOS Catalina and later, the startup data volume) is encrypted, and its files are not available until there was no successful macOS login. Only after logging in does macOS enter its normal mode of operation. For Intel Macs without a T2 security chip, FileVault also encrypts the data contents of the startup volume when the computer is turned off. Intel Macs with a T2 security chip and all Apple M1 silicon Macs still encrypt this data. (Read our explanation of how T2 and M1 Macs interact with FileVault.)

The enhanced security offered by FileVault can be a double-edged sword: it can deter attackers with physical access, but it can also block you. Suppose you forget your password (unlikely, I hope!). Or something in macOS breaks or gets corrupted in the account sign-in process or files – also unlikely, but judging by the reader’s email, it happens every once in a while. In these cases, you may not be able to access without owning a component of the FileVault setup process.

When you enable FileVault, macOS generates a recovery key that provides ultimate access if account-based access fails. You can either keep this key private or store it securely in iCloud, with Apple keeping it in escrow for you. (If you can’t immediately find your recovery key or remember whether or not you chose the iCloud escrow option, read “Is your macOS FileVault recovery key up to date? Here’s how to check.”)

Although Apple relies on the FileVault recovery key to help you regain access to your Mac or reset your account password when you forget it, the company does not provide a single set of passwords. simple instructions in one place to learn how it works for the multiple cases you might encounter. Here is our guide to these scenarios.

Retrieve via login window

First, start your Mac if it’s turned off. (If you’re trying to reset the password and your Mac is started and logged in, choose  > Restart.)

Apple

Then, on the login screen, click on your account icon:

• In macOS Catalina and later, a password field appears with a question mark (?) on the far right. Click on the question mark. A long text appears that begins with “If you forgot your password, you can…”
• In macOS Mojave and earlier, you must enter your password incorrectly three times before a prompt appears.

Now, depending on your choice when setting up FileVault, you’ll see one of several options (text may vary in Mojave and earlier versions of macOS):

• iCloud Security Deposit: If you chose to store your key in iCloud when setting up FileVault, the sentence above continues, ellipses and all, “…reset it using your Apple ID”. Click the right-pointing arrow and follow the steps provided to sign in to the iCloud account associated with this Mac. This will retrieve your key, unlock the drive, and allow you to reset your account password.
• You have kept the recovery key: If you chose to write down the recovery key, the text will continue “…reset it using your recovery key”. Click the right-pointing arrow, then enter your recovery key omitting the hyphens – macOS adds the hyphens automatically. Once entered correctly, your drive is unlocked and you can reset your account password.

Apple notes that in some cases that the company does not define, you may see the text “Restart and show password reset options”. If so, click the right-pointing triangle. After your Mac restarts, you’ll be asked for either an Apple ID login or your recovery key as above. Instead of First of all by selecting a user and then entering this information, in this mode you first enter your recovery details and SO select the user for whom you are resetting the password to regain access.

If none of the above solutions work, you can try using macOS Recovery.

Recover via macOS Recovery

The process differs depending on the processor. With an Intel Mac:

1. Restart or press the power button, then hold down Command-R until the Apple logo appears and the OS loading progress bar begins to fill.
2. When the macOS Recovery screen appears, choose Utilities > Terminal.
3. Enter text resetpassword and press return.
4. macOS Recovery launches the special password reset wizard. Select the option “My password does not work during login” and click on Followingthen follow the remaining steps.

With a Mac M1, the steps are a bit more complicated:

1. Shut down the Mac if it is active.
2. Press and hold the power button to boot and keep it pressed until the message “Loading boot options” appears. It takes about 10 seconds. Release the power button.
3. Click it Choice icon.
4. If presented with a list of accounts you can use to log in to access macOS Recovery, click “Forgot all passwords?” You can also or instead use your Apple ID to sign in.
5. When the macOS Recovery screen appears, choose Utilities > Terminal.
6. Enter text resetpassword and press return.
7. macOS Recovery launches the special password reset wizard. Select the option “My password does not work during login” and click on Followingthen follow the remaining steps.

This Mac 911 article is in response to a question submitted by igamesnews reader Julio.

Ask for Mac 911

We’ve compiled a list of our most frequently asked questions, along with answers and column links: read our awesome FAQ to see if your question is covered. Otherwise, we are always looking for new problems to solve! Email yours to [email protected], including screenshots if available and if you want your full name used. Not all questions will be answered, we don’t respond to emails, and we can’t provide direct troubleshooting advice.