How to definitely securely erase a 1TB internal SSD in an M1 and be left with a fresh OS?

This:

What to do before you sell, give away, trade in or recycle your Mac - Apple Support

Because of the way SSDs store data, the secure erase process formerly used for HDDs is unnecessary.

Contrary to what you may have gleaned on YT, a properly erased SSD and prepared M-series Mac will render data unrecoverable for all practical intents and purposes.

After you have taken the steps provided in the link above, you would be prompted to setup the Mac as new again. In that process - or upon first logging in after - you will have the opportunity to enable FileVault.

Protect data on your Mac with FileVault - Apple Support

For all intents and purposes, data recovery from an SSD is radically different (and exponentially harder) than for hard drives.

There are few practical ways to recover data from an SSD for most users. This is doubly-true if you were using FileVault to encrypt your data.

Ultimately, to wipe your system, use System Settings -> General -> Transfer or Reset -> Erase All Content

This actually does more than just wipe your disk. It unregisters the system from your Apple Account (so the machine is no longer registered to you), turns off Activation Lock (if it was on), so that another user can legitimately add it to their Apple Account, erases all content and wipes the drive, and sets the machine up with a clean OS install.

If you're really, really insecure, you can THEN reboot the system in Recovery Mode to boot into a minimal OS, where you can re-erase the drive (using Disk Utility) and re-install a clean OS, but this doesn't add more levels of security, and doing this alone won't unregistered the machine from your account, hindering whoever you pass it on to.

So, seriously, just use System Settings -> Transfer or Reset and sleep easy. :)

On an Apple Silicon Mac like your M1, your data is already automatically encrypted on the SSD. FileVault adds further protection by linking the encrypted SSD to your user account & password. If/when you remove your user account there is no way to decrypt any data for that account that may remain on the SSD; unless (and only maybe if) someone obtains your Recovery Key and somehow reconstructs your user account and uses the Recovery Key ... but that is a wholly unlikely scenario.

A properly prepared Mac, following the procedures in the article linked above by @D.I. Johnson, will be sufficient for a complete erase of the SSD. The result will be an SSD from which file recovery is all but impossible except perhaps for the most sophisticated sovereign entities (even then it will be difficult to impossible). If you think you may be a target of one of those you should just destroy the Mac.

You're welcome.

Turning FV on or off only takes the time to click the button. The encryption or decryption process will take longer, but will be done in the background as you use the Mac. You won't even know it is happening. The amount of time that process takes will depend on the amount of data to be affected.

If you enable FV on a new drive, the initial encryption of existing data is swift because there is little data. And once enabled, FV will encrypt your data as it is newly written to the drive during the regular use of the Mac. Decryption and use of that data is also very quick when those files are needed in regular use.

If one were to enable FV on a drive with lots of data already saved, then the encryption process could take hours or even days. If one were to disable FV on a drive that has many GB or TB of encrypted data then the decryption would again take hours or days.

Yes, the clean install with the enabling of FV will link the drive encryption security to the Mac's local user account, no iCloud necessary.

Erasing the "free space" provides no additional security on the SSD because by the nature of the SSD function when a file is deleted (erased) the cells used to store the data are immediately marked as available and during SSD housecleaning and management by its controller the cells are recovered and made available for the next use.

RAMSLOT wrote:

How does one securely erase a 1TB internal SSD before donating or selling it. Disk Utility no longer has secure erase, and articles are unclear on the role of TRIM and FILE VAULT.

How to proceed in an orderly fashion and have any s fresh OS? At which point should File Vault be turned on?

ref: Erase your Mac and reset it to factory settings

https://support.apple.com/en-us/102664

D.I. Johnson wrote:

You're welcome.

Turning FV on or off only takes the time to click the button. The encryption or decryption process will take longer, but will be done in the background as you use the Mac. You won't even know it is happening. The amount of time that process takes will depend on the amount of data to be affected.

That is true (sort of) for the older 2017 and earlier Macs, but for the 2018+ Macs with the T2 security chip or M-series Macs....turning Filevault on/off only a encrypts the encryption key since these 2018+ Macs are using hardware encryption on the internal SSD all the time.

From the first paragraph of the Apple article:

Protect data on your Mac with FileVault

If you have a Mac with Apple silicon or an Apple T2 Security Chip, your data is encrypted automatically. Turning on FileVault provides an extra layer of security by keeping someone from decrypting or getting access to your data without entering your login password. If you use a Mac that doesn’t have Apple silicon or the T2 chip, you need to turn on FileVault to encrypt your data.

I am still getting used the changes and differences between the olde Intel Macs and these newfangled Apple Silicon doodads! 😃

Thanks for the clarification and the refresher. I appreciate you, my friend.