In hardware encryption, keys are kept in the Secure Enclave. Software encryption in APFS has no such luxury, just keybags at container and volume level. This explains when they’re created.
FileVault
Apple has announced that support for HFS+ encryption will be removed in a future version of macOS. How this is all about ending support for CoreStorage, and where it has gone since then.
In Ventura, VM disk performance was poor, with write speeds of 0.7 GB/s. How fast is it now in macOS 26.4, and how does using FileVault affect it? Plus a note on problems with BSIs in VMs.
You’ve tried entering your password, but it doesn’t work. Should you try guessing? As that imposes increasing waiting times of up to 8 hours, maybe not. Try this instead.
The T2 chip was designed for FileVault, and it comes at no cost to that and in Apple silicon Macs. Here’s how it works, and why everyone should enable it.
How to check secure boot, SIP, Gatekeeper/XProtect, its SSV, FileVault, macOS and its firmware, and XProtect Remediator scans.
Originally the ‘security enclave’, and subject of a series of patents, it was introduced in the iPhone 5s in 2013, then the T2 in 2017, and blossomed in M-series Macs from 2020.
Explains the sequence of events from Boot ROM to FileVault login, what storage is accessible at different times, and where the code is.
How to check your Mac is booting in Full Security, and how to read its log to verify all the key steps involved in that process.
How your password isn’t used to encrypt the Data volume on your Mac’s internal SSD, but is used to encrypt the key used for that encryption, and the benefits.
