should I have firevault on

I pretty much second dialabrain's comments. In my case I do have one of my Mac notebooks that I use when I travel that I do have FileVault enabled.

The important thing to remember if you do decide to enable it, is DON'T forget the password. At least understand what options are available to you if you do.

Ref Use FileVault to encrypt the startup disk on your Mac - Apple Support

The advantage to encrypting the internal disk is safeguarding your data and personal information if the Mac is stolen or physically accessed by an unauthorized person. Without disk encryption, someone with physical access to the hardware could access your data. If they gain access to your keychain they could login with your passwords to a myriad of services if you saved your passwords in the keychain. They could access your email, contacts, text messages, confidential information, etc. It would be very bad for this to occur to most people.

Summary of Important Points:

• Encrypted disks make it vastly more difficult to recover data in the event of a hardware failure or catastrophe
• Solid State Disks (SSDs) can fail without warning while Hard Disk Drives (HDDs) typically give more warning about imminent failure. They also have magnetic properties that allow for data recovery and forensics after failure and performed by data recovery specialists.
• Backups are absolutely essential with disk encryption & SSDs as well as any iMacs equipped with Fusion drives
• Using a strong password with disk encryption is critical as a weak password can be brute force attacked and unlocked
• Newer Intel Mac's 2018+ have a T2 Security Chip and are hardware encrypted at the factory as are all Apple Silicon M1 based Macs
• Older Macs that do not have a T2 Security Chip, File Vault encryption is optional. But not with T2 / M1 based Macs.
• On T2 / M1 based Macs it is very important to turn on FileVault so you generate a recovery key in the event you forget your password (list of T2 equipped Macs https://support.apple.com/en-us/HT208862)
• You should store your Recovery Key on iCloud. If you do not wish to use iCloud to store your recovery key, you can print it out and keep it somewhere safe. If your Mac is managed by your employer / school they are already maintaining a copy of the recovery key and their Help Desk can provide it if you forget your password.
• If you use iCloud to store the Recovery Key you should ensure you have a strong password on your iCloud account as well as enabling multi-factor-authentication.
• Never interrupt a macOS update or upgrade when a T2 / M1 Mac may appear to be turned off. This is typically when a firmware update is being applied and interrupting a firmware update on a T2 / M1 based Mac can result in the Secure Enclave being reset. That means all the private keys are lost and the password as well as the recovery key will be worthless. There will be complete data loss as the result. You should wait a considerable period of time if your Mac appears to be OFF during an update / upgrade. Avoid pressing nor holding down the power button and instead press a key such as Shift a few times instead.

Excellent Strong Password Advice:

source: https://imgs.xkcd.com/comics/password_strength.png

I've never enabled FileVault but no one has access to any of my Macs. If your Macs are not in a secure environment it adds an extra layer of protection.

You should, to recover your Mac, you'll have two options, your password, and the FireVault key. If you forget your password, you could still use your FireVault ket to recover.

Thank you. Excellent write up! I definitely enjoyed the xkcd comic.