Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Encryption key for MacBook Pro disk

Hello,


During the installation of my MacBook Pro - two days ago - I chose for disk encryption. I can't remember I have seen any encryption / decryption key though. I do remember the key would be stored in the iCloud of my Apple ID according to one of the messages.


1) is it true no key has been displayed when it is stored in the iCloud?

2) is my Apple ID password also the password for the encryption key?

3) what will happen if I change the password of my Apple ID?

4) can I regenerate an encryption key? Should I do so and write it down?

5) in the meantime I have more than one user account on my MacBook Pro and I want to make a separate administrator (Windows habit :-)). Can I make the first user a Standard user now or should it stay an administrator?


Thanks in advance!


SJW

MacBook Pro (M3 Pro, 2023)

Posted on Nov 17, 2023 2:08 PM

Reply
Question marked as Top-ranking reply

Posted on Nov 18, 2023 10:59 PM

Hello,


I believe I found the answer to my question here: https://www.macworld.com/article/231249/how-to-find-your-filevault-recovery-key-in-macos.html


I'll quote the text that contains the answer just in case you have the same question sooner or later:


"When you first set up FileVault, one of the steps asks you whether you want to use your iCloud account as a way to unlock your disk and reset your macOS account password if you can’t find your recovery key. (In Monterey and earlier, go to System Preferences > Security & Privacy > FileVault; in Ventura or later, go to System Settings > Privacy & Security and scroll down to the FileVault section.)


If you choose iCloud, the recovery key isn’t stored loosely in iCloud Drive or as a file. Instead, it’s tied into behind-the-scenes account information that Apple maintains. It’s fully encrypted in such a way that even Apple doesn’t have access to the unencrypted recovery key data, but Apple can deliver the encrypted recovery key to your Mac if you need to reset your password. You never see the recovery key nor have to enter it in this configuration. (The process is a little involved: Apple describes it in the section “Reset using the Reset Password assistant (FileVault must be on)” in this support document.)


If you choose the other path, where FileVault generates a recovery key and displays it, you need to make sure and write it down or enter it electronically and store it securely in such a way that you’ll have access even when your Mac can’t be booted."


The referenced Apple support document confirms the recovery key is either displayed during the setup of FileVault or stored invisibly in the iCloud (Apple ID) account:


"If you're asked for your FileVault recovery key, enter the long string of letters and numbers you received when you turned on FileVault and chose to create a recovery key instead of allowing your iCloud account (Apple ID) to unlock your disk."


Kind regards,


SJW

2 replies
Question marked as Top-ranking reply

Nov 18, 2023 10:59 PM in response to sjwestra

Hello,


I believe I found the answer to my question here: https://www.macworld.com/article/231249/how-to-find-your-filevault-recovery-key-in-macos.html


I'll quote the text that contains the answer just in case you have the same question sooner or later:


"When you first set up FileVault, one of the steps asks you whether you want to use your iCloud account as a way to unlock your disk and reset your macOS account password if you can’t find your recovery key. (In Monterey and earlier, go to System Preferences > Security & Privacy > FileVault; in Ventura or later, go to System Settings > Privacy & Security and scroll down to the FileVault section.)


If you choose iCloud, the recovery key isn’t stored loosely in iCloud Drive or as a file. Instead, it’s tied into behind-the-scenes account information that Apple maintains. It’s fully encrypted in such a way that even Apple doesn’t have access to the unencrypted recovery key data, but Apple can deliver the encrypted recovery key to your Mac if you need to reset your password. You never see the recovery key nor have to enter it in this configuration. (The process is a little involved: Apple describes it in the section “Reset using the Reset Password assistant (FileVault must be on)” in this support document.)


If you choose the other path, where FileVault generates a recovery key and displays it, you need to make sure and write it down or enter it electronically and store it securely in such a way that you’ll have access even when your Mac can’t be booted."


The referenced Apple support document confirms the recovery key is either displayed during the setup of FileVault or stored invisibly in the iCloud (Apple ID) account:


"If you're asked for your FileVault recovery key, enter the long string of letters and numbers you received when you turned on FileVault and chose to create a recovery key instead of allowing your iCloud account (Apple ID) to unlock your disk."


Kind regards,


SJW

Nov 18, 2023 5:37 AM in response to sjwestra

PS attached the FileVault settings. At the bottom it says "a recovery key has been set".


As said in my post I'm not aware of the detailed key other than that it has been stored in the iCloud / Keychain? Is my Keychain password equal to my Apple ID password or is it equal to my MacBook password?


Therefore may main question is how the get the detailed key and the password that I will need sooner or later.


Encryption key for MacBook Pro disk

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.