FileVault
Ranked 5 of 7 disk encryptions by recommenders
Built-in macOS disk encryption that people find dependable for years, with the account password unlocking the disk. Critics object to recovery keys being escrowed with Apple and stored in plaintext when turned off.
Built-in macOS disk encryption that people find dependable for years, with the account password unlocking the disk. Critics object to recovery keys being escrowed with Apple and stored in plaintext when turned off.
17 people gave an opinion
- recommend it
- 8
- criticize it
- 9
- approval share
- 47%
Recommended in 3 of 13 months
- November 2025: not recommended
- December 2025: not recommended
- January 2026: recommended
- February 2026: not recommended
- March 2026: not recommended
- April 2026: not recommended
- May 2026: recommended
- June 2026: not recommended
- July 2026: recommended
- August 2026: not recommended
- September 2026: not recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 8 people recommend itNeeds 10 or more, not met.
- 0.8 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 3 of 13 monthsNeeds 4 or more, not met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Strong security, keys kept local
“Filevault for MacOS (which is wonderful and never sends your key to be kept somewhere else)”
Comment from 2 Jul 2026 in “Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory” “I do think that Apple have some better security defaults for FileVault”
Comment from 14 May 2026 in “Microsoft BitLocker – YellowKey zero-day exploit” “Nobody is going to bypass LUKS or FileVault like this.”
Comment from 14 May 2026 in “Microsoft BitLocker – YellowKey zero-day exploit” Unlocks with account password
“In MacOS it's literally your account password, which follows along with your in-OS account credentials”
Comment from 2 Jul 2026 in “Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory” “the obvious thing that FileVault does and use the user's password as an additional wrapper”
Comment from 14 May 2026 in “Microsoft BitLocker – YellowKey zero-day exploit” Works reliably for years in fleets
“Managing an Apple fleet is similarly fine, and that includes using any of the MDM tooling that also does key escrow on enterprise Filevault devices.”
Comment from 2 Jul 2026 in “Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory” “It sure works fine for a about a decade.”
Comment from 24 Jan 2026 in “MS confirms it will give the FBI your Windows PC data encryption key if asked”
What people warn about
Each mark is one comment
Recovery keys escrowed to Apple or iCloud
“the FileVault key you (optionally) escrow with Apple is stored in the iCloud Keychain”
Comment from 23 Jan 2026 in “Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops” “FileVault Full Disk Encryption (FDE) recovery keys are, by default, sent to Apple if the user requests them.”
Comment from 2 Jul 2026 in “Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory” “Others report Filevault keys are also being backed to iCloud since September and they didn't tell anyone”
Comment from 24 Jan 2026 in “MS confirms it will give the FBI your Windows PC data encryption key if asked” - Comment from 24 Jan 2026 in “MS confirms it will give the FBI your Windows PC data encryption key if asked”
Frequent problems, worse than BitLocker
“it's really common to have it fail to follow the logged-in user's credentials”
Comment from 2 Jul 2026 in “Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory” “We have more issues with FileVault than we do with BitLocker”
Comment from 2 Jul 2026 in “Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory” “FileVault is a nightmare in this scenario”
Comment from 2 Jul 2026 in “Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory” Key stored in plaintext when off
“Apple placing the encryption key for Filevault as plaintext on disk when it is turned off (the default)”
Comment from 25 Jan 2026 in “MS confirms it will give the FBI your Windows PC data encryption key if asked” “placing the encryption key for Filevault as plaintext on disk when it is turned off”
Comment from 24 Jan 2026 in “Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops”
Other disk encryptions people recommend
The four most recommended other disk encryptions, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| VeraCrypt | 45 | 18 | 71% | 10 | — | Approved |
| Microsoft BitLocker | 45 | 115 | 28% | 8 | 10.7 yrs3 owners | — |
| LUKS | 32 | 6 | 84% | 13 | — | Approved |
| TrueCrypt | 9 | 7 | 56% | 6 | — | — |
| FileVaultThis page | 8 | 9 | 47% | 3 | — | — |
What people said
All 22 comments that mention it, newest first. Each links to the original comment.
“FileVault is a nightmare in this scenario”
“We have more issues with FileVault than we do with BitLocker”
“it's really common to have it fail to follow the logged-in user's credentials”
“FileVault Full Disk Encryption (FDE) recovery keys are, by default, sent to Apple if the user requests them.”
“there's no "issue" if the device loses trust because ultimately you always use the real unlock key”
“In MacOS it's literally your account password, which follows along with your in-OS account credentials”
“Managing an Apple fleet is similarly fine, and that includes using any of the MDM tooling that also does key escrow on enterprise Filevault devices.”
“Filevault for MacOS (which is wonderful and never sends your key to be kept somewhere else)”
“I do think that Apple have some better security defaults for FileVault”
“the obvious thing that FileVault does and use the user's password as an additional wrapper”
“Nobody is going to bypass LUKS or FileVault like this.”
“That's a bad implementation and seems like a bad afterthought”
“Whole disk encryption is pretty fast today, but probably is a bit slower than unencrypted.”
“it's still not a guarantee if you upgraded from an older version”
“Apple placing the encryption key for Filevault as plaintext on disk when it is turned off (the default)”
“placing the encryption key for Filevault as plaintext on disk when it is turned off”
“It sure works fine for a about a decade.”
“Others report Filevault keys are also being backed to iCloud since September and they didn't tell anyone”
“Your laptop encryption key is stored in your keychain (without telliing you!)”
“the FileVault key you (optionally) escrow with Apple is stored in the iCloud Keychain”
“What sucks is that you can't disable SIP without _also_ disabling disk encryption”
“That might work in a country with due process, but in a place with secret police they can just torture you until you give up the keys.”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.