FileVault Unavailable on Mac: How to Enable Encryption

What Does the "FileVault Unavailable" Error Mean

When attempting to activate system encryption in System Settings → Password & Security, the FileVault toggle becomes inactive, or a warning "FileVault Unavailable" appears. The system cannot initialize the encryption process because the current disk or bootloader configuration does not meet macOS security requirements.

The error occurs at the file subsystem level. macOS verifies the integrity of the recovery partition, the file system type, and the presence of custom boot scripts. If even one parameter does not meet Apple's standards, the interface blocks enabling the protection to prevent data corruption or an inability to boot.

Common Causes

• Unsupported file system. FileVault requires the APFS format. If you are using the legacy Mac OS Extended (Journaled) or a third-party format, encryption is disabled.
• Third-party boot manager. Utilities like rEFInd, Clover, or OpenCore modify the EFI structure, which violates Apple's digital signature verification.
• Corrupted or missing Recovery partition. Without it, the system cannot store recovery keys and verify the integrity of the boot volume.
• Conflict with Legacy FileVault. Residuals from old encryption configurations after migrating from macOS 10.15 or earlier.
• Corporate policy restrictions (MDM). If the device is managed via Jamf or Microsoft Intune, an administrator may have forcibly disabled the ability to activate encryption independently.

Solutions

Solution 1: Check Disk Format and Convert to APFS

Ensure your boot volume uses the correct format. This is a basic requirement for encryption to function.

1. Open the Applications folder → Utilities and launch Disk Utility.
2. In the left sidebar, select the internal disk Macintosh HD.
3. Check the Format field at the bottom of the window. If it says Mac OS Extended (Journaled), conversion is required.
4. Click the Edit... button or use the terminal command for a safe conversion:

diskutil apfs convert /dev/disk1s1

⚠️ Important: Replace /dev/disk1s1 with your volume's identifier (shown in Disk Utility). The process takes 15 to 60 minutes depending on data volume. Do not power off the device.

After completion, restart your Mac and check the FileVault settings.

Solution 2: Clean EFI of Third-Party Bootloaders

Custom bootloaders often hijack control in the early startup stages, which blocks FileVault initialization.

1. Open Terminal and enter the command to mount the EFI partition (administrator privileges required):

sudo diskutil mount disk0s1

2. Navigate to the bootloader directory:

cd /Volumes/EFI/EFI
ls

3. Delete folders that do not belong to Apple (e.g., BOOT, refind, Clover). Leave only the APPLE folder.
4. Unmount the partition and restart:

sudo diskutil unmount /Volumes/EFI
sudo shutdown -r now

After a clean boot, macOS will regain control of the startup process. The FileVault activation button should become available.

Solution 3: Force Activation via Terminal

If the graphical interface shows an error but the system is stable, you can start the encryption process directly using the fdesetup utility.

1. Open Terminal and run:

sudo fdesetup enable

2. The system will prompt for the current user account password. Enter it and press Enter.
3. You will be asked to save a recovery key. Choose Y to display the key on screen or L to save it to a file.
4. Confirm the action. The process will start in the background.

You can monitor progress with:

sudo fdesetup status

💡 Tip: Do not close the laptop lid during the first encryption pass. The process requires stable power and does not pause when entering sleep mode.

Solution 4: Repair Disk Structure via Recovery Mode

If the previous steps did not work, the disk's service area is likely corrupted.

1. Shut down your Mac. On Apple Silicon, hold the power button until the options window appears. On Intel, hold Cmd + R at startup sound.
2. Select language preferences and go to Utilities → Disk Utility.
3. Select the boot volume and click First Aid. Wait for the check to complete.
4. If the utility reports structure damage, click Repair Disk.
5. Restart the system in normal mode and try enabling FileVault.

Prevention

To avoid re-locking encryption, follow these rules. Always use the standard macOS bootloader and do not install third-party utilities to modify the startup order. Regularly update the operating system: security patches often fix vulnerabilities in the encryption subsystem. Store recovery keys in a password manager separate from the device itself. If you plan to install a second OS (e.g., Windows via Boot Camp), first configure FileVault, then create partitions—this way the system will correctly register new mount points.