Check your Mac FileVault recovery route before you need it

FileVault protects information on a Mac startup disk when it is locked. The part many people overlook is recovery: when enabling it, you choose an Apple Account recovery route or a personal recovery key. If the only copy of that key sits on the encrypted Mac, it will not help after you lose access to the machine.

Review a recoverable setup​

1. On the Mac, open System Settings → Privacy & Security → FileVault and check whether it is on. If it is a work-managed computer, ask the administrator which recovery path and escrow policy apply before changing anything.
2. Identify the recovery route chosen when FileVault was enabled. If it uses your Apple Account, confirm that you can sign in to that account and receive any needed verification without relying only on this Mac.
3. If you chose a personal recovery key, locate the copy stored somewhere other than the encrypted startup disk. Compare it carefully with the original record you made; do not upload it to a public note or send it to an untrusted helper.
4. Document who should know the recovery process, then back up important files separately. Do not intentionally lock yourself out to “test” the key; use Apple's documented recovery procedure only when needed.

The limit​

Apple's FileVault recovery-options guide explains the Apple Account and personal-key choices and says a key must be kept away from the disk. Its FileVault setup guide shows where to check the setting. Encryption protects an inaccessible disk; it is not a backup and does not fix malware or an unlocked account. A lost key and unavailable recovery route can mean lost data, which is why this check belongs before a failure.