Use FileVault to encrypt the startup disk on … – Apple Support

FileVault full-disk encryption(FileVault 2) usesXTS-AES-128 encryption with a 256-bit key tohelppreventunauthorizedaccess to the information on your startup disk.

Turn onFileVault

Reset password

Turn offFileVault

FileVault 2 is availablein OS X Lion or later.When FileVault is turned on, your Mac always requires that you log in with your account password.

If other users have accounts on your Mac, you might see a message that each user must type in their password before they will be able to unlock the disk. For each user, click the Enable User button and enter the user's password. User accounts that you add after turning on FileVault are automatically enabled.

Choose how you want to be able to unlock your disk and reset your password, in case you ever forget your password:

If you lose or forget both your account password and your FileVault recovery key, you won't be able to log in to your Mac or access the data on your startup disk.

When FileVault setup is complete, your Mac restarts and asks you to log in with your account password. Your password unlocks your disk and allows your Mac to finish starting up.FileVault requires that you log in every time your Mac starts up, and no account is permitted to log in automatically.

After your Mac starts up, encryption of your startup disk occurs in the background as you use your Mac. This takes time, and it happens only while your Mac is awake and plugged in to AC power. You can check progress in the FileVault section of Security & Privacy preferences. Any new files that you create are automatically encrypted as they're saved to your startup disk.

If you forget your account password or it doesn't work, you might be able toreset your password.

If you want to change the recovery key used to encrypt your startup disk, turn off FileVault in Security & Privacy preferences. You can then turn it on again to generate a new key and disable all older keys.

If you no longer want to encrypt your startup disk, you can turn off FileVault:

After your Mac starts up, decryption of your startup disk occurs in the background as you use your Mac. This takes time, and it happens only while your Mac is awake and plugged in to AC power. You can check progress in the FileVault section of Security & Privacy preferences.

* If you storeyour recovery key with Apple or your iCloud account, there's no guarantee that Apple will be able to give you the key if you lose or forget it. Notall languages and regions are serviced byAppleCareor iCloud, and not allAppleCare-serviced regionsoffer support in every language. If youset up your Mac for a languagethat AppleCare doesn't support, then turn on FileVault and store your key with Apple (OS X Mavericks only),your security questions and answers could be in a language that AppleCare doesn't support.

Published Date: Dec 9, 2016

Link:
Use FileVault to encrypt the startup disk on ... - Apple Support