Changing the FileVault Password on macOS: A Step-by-Step Guide

Introduction / Why This Is Needed

FileVault is a built-in macOS feature for full disk encryption. The password you use to log in (for the first user who enabled FileVault) also serves as the key to decrypt the disk at boot. Changing this password is a regular security recommendation. This guide shows how to update the FileVault password without disabling encryption, to maintain data protection and avoid the multi-minute process of re-encrypting.

After completing, you will be able to use the new password to log in and unlock the disk when booting your Mac.

Requirements / Preparation

1. macOS: These instructions are current for macOS Ventura (13), Sonoma (14), and Sequoia (15). The interface may differ slightly in older versions.
2. Permissions: You must be logged in as the user who originally enabled FileVault (or have administrator rights). Changing the password will require entering the current administrator password.
3. Current Password: You need to know the current password for the user account associated with FileVault. Without it, changing the password is impossible.
4. New Password: Prepare a new strong password that meets macOS requirements (minimum 8 characters, combination of letters, numbers, punctuation).
5. Stable Power: Ensure your Mac is connected to a power source. The password change process must not be interrupted.

Step 1: Identify the FileVault User and Check Status

1. Open System Settings.
2. Go to the Privacy & Security section.
3. Scroll down to the Security section and find the FileVault item.
4. If FileVault is enabled, you will see the status 'FileVault is on' and a list of users under 'Users who can unlock the disk'. The first account in this list is the one whose password is the FileVault key. That is the password you need to change. If your account is not first, you can add it or change the order, but that requires separate actions.

⚠️ Important: If you see the message 'FileVault is off', your disk is not encrypted with this feature. This guide is not required for you. To enable FileVault, use the appropriate guide.

Step 2: Change Password via 'Users & Groups' (Recommended Method)

This is the simplest and safest method, as the system synchronizes the passwords automatically.

1. In System Settings, open the Users & Groups section.
2. In the bottom-left corner, click the lock icon and enter the current administrator password to unlock the settings.
3. From the list on the left, select the user account that is the FileVault user (identified in Step 1).
4. Click the 'Change Password...' button.
5. In the window that opens:
   • Old Password: Enter the current password for this account.
   • New Password: Enter the new password.
   • Verify: Re-enter the new password.
   • Password Hint: (Optional) Add a hint to help you remember the password. Do not include the password itself in the hint.
6. Critical step: After filling in the fields, the system may show an additional window or option asking if you want to update the password for unlocking the FileVault disk. Be sure to agree (click 'Update FileVault Password' or a similar button). If no such window appears, the system usually does this automatically when you click 'Change Password'.
7. Click 'Change Password' (or 'Save Changes').

Step 3: Verify the Result

1. Restart your Mac: Choose 'Restart...' from the Apple menu ().
2. After your Mac shuts down and starts up, the password entry screen for unlocking the disk will appear (usually with a closed lock icon).
3. Enter the new password you set in Step 2.
4. If your Mac successfully boots into the macOS desktop, the FileVault password has been changed successfully.
5. For extra confirmation, go back to System Settings → Privacy & Security → FileVault. The status should remain 'On'. The user list should be unchanged.

Step 4: Change Password via Terminal (For Advanced Users)

This method is useful if the interface is unavailable or for automation via scripts.

1. Open Terminal from the Applications/Utilities folder.
2. Use the fdesetup command. To change the password for the current FileVault user, run:

   sudo fdesetup authrestart -inputplist < /path/to/oldpassword.plist
   

   Important: Passing the password directly on the command line is insecure. The correct way is to create a temporary .plist file.
3. Example of creating a passwords file (optional):
   • Create a file named passwords.plist in your home folder using TextEdit or the command cat > ~/passwords.plist.
   • Its contents must be in this format:

     <?xml version="1.0" encoding="UTF-8"?>
     <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
     <plist version="1.0">
     <dict>
         <key>OldPassword</key>
         <string>YOUR_OLD_PASSWORD</string>
         <key>NewPassword</key>
         <string>YOUR_NEW_PASSWORD</string>
     </dict>
     </plist>
     

   • Replace YOUR_OLD_PASSWORD and YOUR_NEW_PASSWORD with the actual values.
   • Secure the file: chmod 600 ~/passwords.plist.
   • Then run the command from step 2, specifying the path: sudo fdesetup authrestart -inputplist < ~/passwords.plist.
4. After the command executes successfully, the system will request a restart. Agree to it.
5. Test login with the new password as described in Step 3.

💡 Tip: Using Terminal requires care. A typo in the password or command will cause the change to fail. The graphical method (Step 2) is recommended.

Potential Issues

• Error 'Failed to change FileVault password' or 'Incorrect password':
  • Ensure you are changing the password for the exact user account that is the first FileVault user (see Step 1).
  • Verify that the old and new passwords are entered correctly (pay attention to case sensitivity).
  • If you recently changed the account password via iCloud or another device, synchronization may be needed. Wait a few minutes and try again.
• After changing the password, Mac does not boot, FileVault screen does not accept the new password:
  • Do not panic. Try the old password. If it works, the change did not apply to FileVault. Return to 'Users & Groups' and ensure you clicked the button to update the FileVault password.
  • If neither the old nor new password works, and you did not set a Recovery Key when enabling FileVault or link an iCloud account, decrypting the disk and recovering data will be impossible. The only option is to reinstall macOS, which will result in complete data loss on the system volume.
• Do not see the option to update the FileVault password in the account password change window:
  • This may happen if you are changing the password for a user who is not the 'primary' FileVault user. Double-check your account selection in Step 1.
  • In rare cases, especially after data migration or complex configurations, the link between the account password and FileVault may be broken. In such a scenario, you may need to disable and re-enable FileVault (which takes a long time and requires free space). This is a last resort. Before doing this, try resetting the password using the Recovery Key if you have one.
• Terminal returns error fdesetup: Unable to change FileVault password:
  • Ensure you are using sudo and enter the administrator password when prompted.
  • Check that the .plist file has the correct XML format and correct keys (OldPassword, NewPassword).
  • Verify you are running the command as the user whose password you are changing.