Encryption at Rest: macOS (FileVault and VeraCrypt)

Part of the Encryption in Transit and At Rest series.

Encryption at Rest on macOS

macOS has a built-in full disk encryption tool called FileVault. Unlike BitLocker on Windows, FileVault is a reasonable choice as long as you manage the recovery key yourself. The one thing to watch is where that recovery key goes.

For portable encrypted volumes or cross-platform containers that also work on Linux and Windows, VeraCrypt works on macOS the same way it does on other platforms.

FileVault

FileVault encrypts the entire startup disk. When the machine is off, the drive is unreadable without your login password or the recovery key.

Enabling FileVault:

Go to System Settings > Privacy and Security > FileVault and click Turn On.

macOS will ask how you want to store the recovery key. You have two options:

Store with your Apple account: Apple gets a copy of your recovery key, similar to the BitLocker and Microsoft account problem. If Apple’s systems are compromised or Apple receives a legal request, that key is accessible.
Create a local recovery key: macOS generates a 24-character recovery key that only you store. Choose this option.

Write the recovery key down and store it somewhere physically secure and separate from the Mac. If you lose both your password and the recovery key, the data on that drive is gone permanently.

Checking FileVault status from the terminal:

sudo fdesetup status

The output will confirm whether FileVault is on and whether encryption has completed.

How FileVault handles multiple users:

By default, only the user who enabled FileVault can unlock the drive at boot. Other users on the machine need to be enabled separately. Go to System Settings > Privacy and Security > FileVault and click the button to enable other users.

A note on Apple Silicon:

On Apple Silicon Macs (M1 and later) the internal drive is always encrypted at the hardware level by the Secure Enclave. Turning FileVault on is what actually ties that encryption to your password, so the data cannot be read without it. In other words, without FileVault the hardware encryption alone does not protect you from someone who gets the machine. Turn it on.

VeraCrypt on macOS

VeraCrypt on macOS lets you create and open the same encrypted containers you use on Linux and Windows. This is useful when you need encrypted files that move between platforms or when you want encrypted storage that is separate from the system drive FileVault covers.

Installing VeraCrypt:

Download the macOS installer from veracrypt.jp/en/Downloads.html. VeraCrypt on macOS needs a file-system layer to mount volumes, and there are two options:

macFUSE, the long-standing choice, from macfuse.github.io. Install this first, then install VeraCrypt.
FUSE-T, a newer, kernel-extension-free option from fuse-t.org that the VeraCrypt project recommends for Apple Silicon Macs. The downloads page has a separate FUSE-T build of VeraCrypt.

Pick the one that matches the VeraCrypt build you download. On an Apple Silicon Mac, the FUSE-T build avoids the kernel extension approval hassle described below.

Creating and mounting a volume:

The process is the same as on other platforms. Open VeraCrypt, click Create Volume and follow the wizard. Mounting works the same way: select a slot, choose the container file, click Mount and enter the passphrase.

macOS security prompts:

If you use the macFUSE build, macOS may ask for approval the first time VeraCrypt loads its kernel extension. Go to System Settings > Privacy and Security and approve it there, then reboot if prompted. The FUSE-T build does not use a kernel extension, so it skips this step.

FileVault vs VeraCrypt: Which to Use

Situation	Use
Protect everything on the Mac if stolen	FileVault
Encrypted container to share with Linux or Windows	VeraCrypt
Sensitive files on an external drive	VeraCrypt
Cross-platform portable volume	VeraCrypt

FileVault and VeraCrypt are not mutually exclusive. FileVault protects the whole disk while the machine is off. VeraCrypt containers add a second layer for specific sensitive files and for portability.

References

Continue reading:

Questions about a specific Mac model or macOS version? Post below.