Windows PC users are used to hearing about BitLocker drive encryption and other encryption features in Windows that offer an additional level of protection for securing hard drives.
Mac users also get to enjoy built-in encryption in macOS (and since there is only one version of macOS that ships, it does not require running a “Pro” or “Ultimate” or “Enterprise” flavor to get access to the encryption features).
FileVault 2
The feature that allows for encrypting one’s internal hard drive is known as FileVault, although longtime Mac users may refer to it as FileVault 2. What’s the difference between FileVault 2 and FileVault “1” (also known as legacy FileVault)? Legacy FileVault/FileVault “1” (Snow Leopard and before) only encrypted a user’s home directory (not the entire drive) using AES 128 Bit encryption. There were some issues with legacy FileVault’s performance, backups using Time Machine, and some operating system upgrades and migrations, so at times one would need to disable legacy FileVault when performing certain actions.
FileVault 2 (Lion and later) offers full-drive encryption, better performance over legacy FileVault, and better compatibility with Time Machine backups, operating system upgrades and migrations, etc.
Setting up FileVault 2 is easy (instructions here). On legacy FileVault, a “master password” was created that allowed one to access FileVault-encrypted home directories in the event of a password being lost. With FileVault 2, a recovery key is generated that is required to use to access a FileVault 2-encrypted volume in the event of a password being lost. The recovery key can either be stored locally or printed or it can be stored in iCloud, allowing Apple to assist with the recovery process if need be.
T2 Security Chip Hardware Full-Drive Encryption
Macs with T2 security chips installed already include hardware full-drive encryption out of the box, although it is still a good idea to enable FileVault 2 on the drive. On Macs with a T2 security chip, FileVault 2 enabling happens near instantaneously due to the T2 chip. On Macs without a T2 security chip, full-drive encryption can take a while to apply to the drive.
Encrypting External Hard Drives
External hard drives and flash drives can also have encryption applied to them easily using the built-in tools in macOS (instructions available here). They need to be formatted using either APFS or HFS+ format using GUID partitioning. I also recommend encrypting Time Machine backups, which is as easy as checking “encrypt backups” when creating the initial Time Machine backup.
Sharing Encrypted Files With Other Mac Users
One can also share encrypted files with other Mac users by creating an encrypted disk image using macOS (which acts as a virtual hard drive), then sharing the encrypted disk image on another hard drive, flash drive, via email, or cloud sharing (instructions on creating encrypted disk images available here).
Third-Party Encryption Software
In the past, I also used Intego’s FileGuard for encrypting files, although the software has long been discontinued for good reason. FileGuard required the installation of Intego’s software, as well as an annual license, to use it. With the built-in encryption features in macOS, Mac users have solid choices for file encryption without the need for third-party software.
Nathan Parker
