FileVault unable to decrypt: how to fix decryption error on macOS

What Does the "FileVault unable to decrypt" Error Mean

The "FileVault unable to decrypt" error (or "Could not decrypt") appears when attempting to log in to a Mac with FileVault enabled, and the system cannot decrypt the startup volume. It can also occur when connecting an external FileVault-encrypted disk. The error blocks access to the system or data until the correct password or recovery key is entered. In logs, the system may record an error code (e.g., 0x8a), indicating an authentication issue.

Causes

1. Incorrect password. Entering the password for a different account or a keyboard layout/caps lock error.
2. Password changed after enabling FileVault. If the account password was changed but FileVault did not update automatically (e.g., after a macOS update).
3. Lost or missing recovery key. The FileVault recovery key was not saved or is lost, and the password does not work.
4. Disk or file system corruption. Disk-level errors (e.g., S.M.A.R.T. failure) or APFS volume corruption.
5. System failure. Issues after a macOS update, software conflict, or corrupted system files.
6. Hardware issues. Faulty RAM or disk controller causing read errors.

Method 1: Verify Password and Use Recovery Key

This is the first and simplest step. Make sure you are using the correct credentials.

1. Check the password:
   • Enter the password for the account that was active when FileVault was enabled (usually your primary account).
   • Check that Caps Lock is not on (the icon in the top-right corner of the login screen).
   • If using an external keyboard, ensure it is connected properly.
2. Use the recovery key (if it was saved):
   • After several failed password attempts on the login screen, the "Recovery Key" option will appear.
   • Enter the 24-character key (e.g., ABCD-EFGH-IJKL-MNOP-QRST-UVWX) you saved when enabling FileVault.
   • The key can be found in:
     • A printed copy kept in a safe place.
     • Your iCloud account (if you chose the iCloud storage option).
     • A password manager (e.g., 1Password, Bitwarden).
3. If the password and key do not work, proceed to the next methods.

Method 2: Reset Password via macOS Recovery Mode

This method allows you to reset the account password, which also updates the FileVault password. Data on the disk will be preserved.

1. Restart your Mac into Recovery Mode:
   • Shut down your Mac.
   • Turn it on and immediately hold Command (⌘) + R until the Apple logo or startup screen appears.
   • Release the keys. The macOS Recovery environment will load.
2. Launch the password reset utility:
   • From the top menu, select "Utilities" → "Terminal".
   • In Terminal, type:

     resetpassword
     

   • Press Enter. The password reset assistant will open.
3. Reset the password:
   • Select the system volume (usually Macintosh HD).
   • Select the account for which you need to reset the password.
   • Enter a new password and hint (if required).
   • Click "Next", then "Restart".
4. After restarting:
   • Log in with the new password. FileVault will automatically decrypt the disk.
   • Important: If FileVault was enabled for multiple accounts, ensure you reset the password for the one used for encryption (usually the first one created).

Method 3: Repair the Disk via Disk Utility

If the disk is damaged, you may need to repair the APFS volume. This method does not delete data, but always make a backup if possible.

1. Boot into Recovery Mode (as in Method 2).
2. Open Disk Utility:
   • From the "Utilities" menu, select "Disk Utility".
3. Repair the volume:
   • In the left pane, select the volume (e.g., Macintosh HD), not the physical disk.
   • Click "First Aid" and follow the instructions to check and fix file system errors.
   • If First Aid does not help, try "Restore" from a Time Machine backup (if available).
4. Restart your Mac and try logging in with the password.

Method 4: Unlock the Disk via Command Line (for External Disks)

If the error occurs when connecting an external FileVault-encrypted disk, unlock it via Terminal.

1. Connect the disk to your Mac.
2. Open Terminal (in the regular system or via Recovery Mode).
3. Identify the disk identifier:

   diskutil list
   

   Find the disk in the list (e.g., disk2s1).
4. Unlock the disk:

   diskutil apfs unlockVolume /dev/disk2s1 -passphrase
   

   You will be prompted to enter the disk's password. After successful entry, the disk will mount.

Prevention

To avoid this issue in the future:

1. Regularly update your account password via System Settings → Passwords after changes so FileVault synchronizes it.
2. Save the recovery key in multiple places:
   • Print it and store it in a safe.
   • Save it in a password manager.
   • Enable iCloud storage (less secure but convenient).
3. Create backups via Time Machine. This won't prevent the error but will simplify data recovery.
4. Check disk health monthly via Disk Utility (First Aid).
5. Do not disable FileVault without first decrypting the disk (via System Settings → FileVault → Turn Off FileVault).

If the problem persists after all actions, the disk may need replacement (in case of hardware errors) or a full macOS reinstall may be required.