Mac

Your Mac has a low-level secret-managing system called Keychain, which is covered more fully in where Apple stores your passwords and passkeys. Keychain contains passwords for lots of different things that need to be both available on demand and secured against unauthorized access. This includes passwords to log in to apps and Wi-Fi networks, passkeys for websites at which you’ve enrolled to use them, credentials for local network servers, encryption certificates, and other important information your Mac needs to function securely.

If you sync Passwords with iCloud, Keychain also contains credentials for websites where you have accounts and may include your credit card details, separate from the stored Apple Pay payment card information on Macs with Touch ID or an Apple silicon Mac paired with a Magic Keyboard with Touch ID.

Because this information is valuable and potentially sensitive, a Mac encrypts the contents of your keychain. However, whenever your Keychain is unlocked, your credentials can be passed to apps, websites, and network services without any intervention on your part.

And how do you unlock your keychain? That’s the wild part: all you have to do is log in to your Mac’s user account. And—as covered in what launches on your Mac—another default setting is to log you in to your account automatically.

As noted earlier, if you have FileVault enabled, you can’t log in automatically. However, after you manually log in, you’re in the same boat as anyone else. See how to turn on FileVault.

In other words, unless you take steps to change the defaults, merely turning on your Mac might unlock your keychain!

Anyone else who might have physical access to your Mac could then log in to all your web accounts (like your bank, Amazon, or PayPal), file servers, and other resources where you’ve saved credentials (like Music or the App Store).

There are a few bright spots:

• No one can see the actual keychain entry’s secure text without knowing your macOS account login password.
• Within Safari, an unwanted party can’t get a list of all the sites at which you have passwords stored from Safari, Keychain, or the Passwords app without your password.
• Even when a password is autofilled in Safari or in an app, there’s typically no way to copy the password to view it as text.
• Macs with active Touch ID hardware and password autofill enabled will drop in your password only when you use a valid fingerprint or enter your password (System Settings > Touch ID & Password > “Use Touch ID for autofilling passwords”).

Touch ID can be built in, as with a laptop model, or for an Apple silicon Mac, provided via a paired Magic Keyboard with Touch ID. See how to set up Touch ID and Face ID.

Yet the storm cloud lingers: someone can use all your passwords when the conditions above aren’t true. These actions will help prevent that:

• Leave FileVault enabled: Because FileVault is a high-value way to prevent power-up access to your computer, most people should leave it enabled, and it is on by default starting in macOS 26. Some people may find it more trouble than the potential of losing access to their files; see how to turn on FileVault for both sides.
• Turn off automatic login, if you don’t have FileVault enabled: See what launches on your Mac for how to disable it.
• Enable Touch ID and AutoFill: This blocks access to autofilled passwords without your fingerprint or password.
• Lock your Mac after a duration: See the Mac settings worth changing.

Lock the keychain separately

For most people, setting their Mac to lock when it sleeps, when the display is off, or after a screen-saver duration has passed, as described in the Mac settings worth changing, is enough. But macOS also lets you lock the keychain after a set period, even if your Mac remains unlocked.

First, open Keychain Access, located at /System/Library/CoreServices/Applications. Click Open Keychain Access at the prompt.

Select your login keychain, and choose Edit > Change Settings for Keychain “login”. You can select “Lock after X minutes of inactivity,” pick a time delay, and click Save. (The “Lock when sleeping” option makes little sense—you should set your Mac to lock when sleeping, as that locks the Keychain and your session.)

Note that you can only change settings for the login keychain and your custom keychains, if any. You cannot change these settings for the System, System Roots, or iCloud (if enabled).

The basic idea of a sandbox is that an app has restrictions that define where it can read and write data, as well as the kinds of inputs and outputs it can monitor or make use of. It has to “keep its sand in the sandbox”: it can’t see or touch files anywhere outside its designated space, or listen to mics, view video, or capture keystrokes without explicit permission that you give it when prompted or that you configure to allow.

Apple rarely uses the term sandboxing in end-user materials, though they employ the concept all over.

The intention is to prevent buggy, corrupted, or malicious apps from messing with data and files from other apps or macOS itself. It has the additional benefit of limiting legitimate software from accessing personal information and inputs that you don’t think it needs to.

There are three kinds of sandboxing in macOS. The oldest affects apps as a whole.

App sandboxing

Available since Mac OS X 10.7.5 Lion, macOS’s app sandboxing restricts the kind of behavior apps can engage in outside their bounds—particularly their own set of data and caches.

Suppose you visit a rogue website in Safari that attempts to execute some dastardly code through an exploit someone has discovered in JavaScript, the popular programming language that powers web apps. Because Safari runs in a sandbox, that malicious code can’t affect other files: it can’t read your contacts, delete system files, add a startup item, or do any other mischief outside the browser window without your permission.

System files are additionally protected in yet another kind of sandbox. See how macOS protects its own system files.

Apps downloaded from the Mac App Store must be sandboxed (with some exceptions for older apps). In addition, Apple apps included with macOS are sandboxed, and so are many third-party apps available directly from their developers. (That’s usually because they also offer the apps in the App Store and don’t want to create two entirely different versions.)

But nothing in the design of macOS (at least, not yet) prevents you as a user from running a non-sandboxed app if you want to. Unless you get an app from the App Store or the developer tells you the app is sandboxed you have no easy way to know.

Sandboxed apps can read and write files in non-default places if you agree to let them do so. You’re prompted when you try to access a new location, and have to give simple permission: a click, not a password. That’s then remembered by macOS from then on. (Under certain rare circumstances, you might have to reauthorize an app.)

You can’t turn off sandboxing or adjust its settings. All you can really do is be alert—if an app asks for access to a folder you don’t think it should be using, that’s because the folder isn’t currently within its sandbox. Think carefully before saying yes—if it’s unexpected, the app could be trying to do something it shouldn’t.

Camera and microphone permission

Since Mojave, macOS asks you questions when an app or other software tries to use audio input or video cameras for the first time.

This was added to prevent potential snooping by malicious software, by having a deeply wired system opt-in requirement. It’s one thing for a malware developer to hack into your camera through software that runs with user-level permissions; it’s another for them to subvert the system and block the warning.

A lot of security and privacy companies offer A/V input features in their anti-malware software or standalone apps, some with more granularity (like “allow for an hour”) and a different workflow for detection. The free OverSight app from security researcher Patrick Wardle is a great place to start (along with all his other apps).

Apps don’t have to do anything special to request access. If it hasn’t been granted access, the first time an app attempts to use a camera, mic, or other audio input, macOS prompts you to approve it or not. If the app wants to bypass Apple’s built-in system, as with Zoom, you see a more severe warning about what it could access.

Once approved, manage access for apps and other components via System Settings > Privacy & Security. In some cases, deselecting an item results in a prompt to choose to quit and restart the app you changed settings for and offers Later as the other option.

Notebook Macs have a hardware disconnect switch that cuts off mic input when the lid is closed, too.

Some apps may have multiple entries in the list: one is for the user-facing app you launch and another for helper software that runs in the background.

Apps may respond differently if you deselect mic or camera permission. Some may not recognize they lack access and crash or behave erratically. Others test for access and prompt, such as Zoom after I allowed and then disabled camera access.

To let you know when certain inputs are in use, Control Center briefly displays a message showing recent use of your mic or camera. Click to reveal Control Center, and you’ll see a mic or camera icon followed by an app name, sometimes followed by “recently” if it’s active or was just active. The status message disappears quickly.

Any use of video, audio, or screen control/screen sharing lights up a colored icon in the menu bar—a green video icon, an orange mic icon, or a purple screen use icon—that indicates active or recent usage. Click the menu to reveal available specialty options for camera and mic effects, like Studio Light for your video or Voice Isolation for your mic, or to see what app is making use of your screen. (I’ve even seen two screen use icons: one for the Screen Sharing app and one for general screen-recording.)

Folder permission

In addition to app-based and A/V input sandboxing discussed above and personal-data privacy controls discussed just below, Apple uses sandboxing for all apps, which requires your permission for them to access certain folders. These locations include:

• The Desktop, Documents, and Downloads folders in your account
• Your iCloud Drive access
• Cloud storage from third parties that appears via Finder-accessible folders, like Dropbox and Google Drive
• Network volumes and removable volumes, each as a separate category of permission

The idea is that it’s suspicious if an arbitrary app needed to read from, much less write to, any of these locations without your explicit knowledge and permission. This can also help subvert ransomware, which tries to access important files wherever they are stored.

Whenever an app first tries to access items in any of these locations, your Mac prompts you to ensure you want to allow it.

If you use an external startup drive, you will see this message frequently. Every time an app wants to save a file on the startup volume, a Mac prompts for permission. By design, Apple prevents apps from saving to external volumes without a grant of permission.

As with mic and camera input, you can view and revoke permissions in System Settings > Privacy & Security: select Files and Folders and scroll to find the app.

Once you grant permission, you can only disable it—you can’t remove it from the list. The only way to remove an app from the list is to empty the list entirely using the command-line utility tccutil. It’s rare you would need to do this.

While macOS is a friendly operating system, it’s all Unix under the hood, which means it runs by partitioning access to files and apps by users and groups, selectively providing permission based on who you are and what groups you belong to.

If your Mac has only one user—you!—it’s all very simple, because you don’t need to secure yourself from yourself. However, you still need the following information, as it relates to how you manage a single-user Mac, too.

There are several important principles about user accounts, and how private your files really are covers the other side of the same question:

• There are four main types of Mac user accounts: administrator, standard, guest user, and sharing-only. Of these, administrator and standard are by far the most common. The usual reason to have more than one account is so that each person who uses a particular Mac can have a separate space for files and settings. But accounts can also be used to restrict access to certain files or resources in order to improve your security.
• Every Mac needs at least one administrator account. When you set up a new Mac or perform a clean installation of macOS, you’ll be prompted to create an administrator account before you can do anything else. That’s because only administrators can perform certain crucial tasks (see the next bullet point). You can have more than one administrator account, and in fact, it isn’t a bad idea to set up an extra one to use for testing and troubleshooting.

When something fails for me on one account, such as a software app or Safari extension, I often log in to a second administrator account on the same Mac to determine whether it’s a problem with my account or the software—or the whole Mac.

• Administrator accounts are all-powerful. Administrators can create, modify, and delete other user accounts. They can unlock any pane of System Settings, and authorize any type of software installation. They can (with a quick trip to the Terminal utility) open any file on the Mac, belonging to any user—and can change any non–system file’s permissions. They can upgrade macOS to a new version. The list goes on and on.
• Standard accounts can do most ordinary things. Standard users can run apps, work with files, and perform most ordinary day-to-day tasks. When a user with a standard account tries to do something that only an administrator is allowed to do, simply entering an administrator’s username and password (or having an administrator do so) does the trick—there’s no need to log out or switch accounts first.
• Apps get their privileges from the user who opens them. If someone with a standard account launches an app, that app can access only the files and folders available to that user. If someone with an administrator account launches an app, that app has more expansive access to files on the Mac, although sandboxing limits that scope somewhat; see how to control which apps use your Mac camera and files. A malicious or compromised app launched by someone with an administrator account might be able to do serious damage across the Mac.

You can create as many user accounts as you need, and switch between them easily. To keep your Mac secure, you should make sure you have the right number and types of accounts, as below.

Set up a standard account for others

A standard account has permission mostly to affect files and applications installed within the Home > Username folder. It’s the right kind of account to set up for people using a Mac who aren’t sophisticated users, don’t need system-level access or the ability to install apps for all users, or shouldn’t be given the same level of trust on a shared computer as its owner or administrator.

At one point many Mac experts recommended a standard account for day-to-day use even by its main user or owner, and to use the credentials for an administrator account only when you’re installing software or engaged in other tasks that require access to the depths of your system.

However, macOS has changed significantly over the last several years. System files are now locked down and can’t be accidentally deleted or overwritten. Many actions you take require a Touch ID or password confirmation. To be frank: I’ve never used a standard account as my regular login, and I don’t see a reason for anyone else to do so at this juncture, either. (I have great backups that I can fall back on if I do anything epically poorly thought out.)

If your main account is currently an administrator account but you want to make it a standard account, you can create a new administrator account (for occasional use only) and then remove the administrative privileges from your main account.

1. Go to System Settings > Users & Groups.
2. Click the Add User button.
3. Enter your password if prompted.
4. Choose Administrator from the New User pop-up menu.
5. Fill in the fields for Full Name and Account Name (that is, a short username, such as your initials). They can be anything you like, but they must be different from those used for other accounts on your Mac. Every account, especially an administrator account, should have a password that is both strong and unique.
6. Create a strong password and enter it in the Password and Verify fields; optionally enter a password hint.
7. Click Create User. If you had automatic login enabled, an alert appears, asking if you want to keep it on or turn it off. Click Turn Off Automatic Login. (This won’t appear with FileVault enabled.)
8. Choose Apple menu > Log Out Username to log out of your old administrator account.
9. Select or enter the name of the new administrator account you just created, enter its password, and click the arrow button or press Return.
10. Once again, go to System Settings > Users & Groups.
11. Click the info button next to the old administrator account, then use the credentials for your new administrator account to authenticate.
12. Deselect or disable “Allow this user to administer this computer”; this turns your erstwhile administrator account into a standard account. An alert appears, claiming that you must restart for the changes to take effect. That’s not entirely true (you need only log out), but click OK anyway.
13. Choose Apple menu > Log Out username, then log in to your old account, now a standard one, with your password.

At this point, you may be prompted to enter the Apple Account for the new account. Since this administrator account will be for occasional use only, I suggest selecting the Don’t Sign In radio button, clicking Continue, and then confirming by clicking Skip again. If it turns out you need iCloud services with your new administrator account, you can always set them up later.

Screen Time for a child account

Screen Time is Apple’s cross-device, Apple Account-linked system for monitoring device usage and, for kids and other people one serves as a guardian for, controlling access. You can use Screen Time to track your behavior and set alerts about limits.

Screen Time isn’t strictly a security feature, and Apple overhauled it in the 27 releases; the parental controls are covered separately.

Set up a guest account

As long as you’re making changes in Users & Groups, you should think about whether you want to have a guest user account. It’s enabled by default starting way back in Yosemite. That’s usually a good idea, but if it doesn’t suit your needs, you can disable it.

With a guest user account enabled, you have a spare—and, importantly, non-administrator—account that anyone can log in to without a password. When logged in, they can run apps installed for all users, browse the web, or perform any other task that doesn’t require saving private information to disk permanently. (Guest users can, however, save data to publicly shared locations.)

If you prefer to not have a guest account, you can also restart your computer in recovery mode and choose Safari as an option. This lets a guest use Safari with zero access to locally stored files. See how macOS protects its own system files.

As soon as the guest logs out, macOS deletes the guest’s temporary home folder, leaving everything just as it was beforehand. If you ever need to give someone temporary access to your computer, using the guest account is simpler than having to set up and later delete a conventional account for that person, and more secure than letting them use your account.

If you have FileVault enabled, the Guest user can access only Safari.

1. Go to System Settings > Users & Groups.
2. Click the info button to the right of the Guest User entry.
3. Enter your administrator password if prompted.
4. Enable or disable “Allow guests to log in to this computer”.

With guest access enabled, you can optionally select either or both of the following checkboxes in the Guest User settings:

• Limit adult websites: Apple blocks risqué-and-beyond sites.
• Allow guest users to connect to shared folders: This doesn’t affect the way someone logged in as a guest can access shared folders on this Mac, as you might expect. Rather, when selected, people on other devices on the network can connect to this Mac’s shared folders without supplying a username and password.

Give every user their own account

If you’re the only person who uses your Mac, you can skip this topic. But if you share your Mac with family members, coworkers, or friends, do yourself—and them—a favor and create a separate (standard) account for each person. And then, insist that everyone log in to their user-specific accounts when using the Mac. That way, any damage (accidentally deleted files, changed preferences, and so on) will be restricted to that user’s space and not affect the entire Mac.

To enable switching from one user to another without having to log out (and thus quit all your apps):

1. Click the Control Center button.
2. Click Edit Controls.
3. Enter “fast” in the search field.
4. Click the Fast User Switching icon.
5. Choose either Add to Control Center or Add to Menu Bar. You can choose one and then the other.

If you add it to Control Center, you can drag to put it where you want among other controls.

To switch users, access the list of users by clicking the account button, account name, or full name from the menu bar or opening Control Center and clicking the Fast User Switching control. Choose the name of the user you want to log in as. That list also includes Login Window: select it to drop into the Login Window screen.

We are all fallible, and the way of all flesh is to age—and sometimes we forget things. I can’t tell you how many times I have “forgotten” a password because I try to remember it, but fortunately I then try to use my fingers to type it, and they “remember” it for me.

If you can’t log in to your main account on your Mac because the password isn’t accepted, you have several options.

Resetting your password on a Mac locks your login keychain, because it’s permanently locked to the account password; see how the Mac keychain works. As a result, you will lose access to locally stored entries, and may have to reset or create a new login keychain manually.

If you forgot the password, try another account

Is there another account you’ve created and can log in to, or another user on the Mac with administrator access? Log in to that administrator account, then go to System Settings > Users & Groups and unlock the pane.

Select your locked-out account and click Reset Password. Now enter and verify the password, adding a hint if you want, and click Change Password. Log out, or use Fast User Switching, then log in to your account with that password.

Reset with the FileVault Recovery Key

FileVault recovery begins when you power on or restart your computer (see how to turn on FileVault). The process takes place using Recovery Assistant. Here’s what to do:

“Apple Account or recovery key” means something different starting in Tahoe than it used to. With Tahoe and Golden Gate, you can either enter the recovery key directly after restarting, or use another of your devices that is also logged in to the same Apple Account to retrieve the recovery key from Passwords. You can no longer use an Apple Account to trigger a macOS password reset if FileVault is enabled.

1. Go to the login window. To get there, restart your Mac or choose Apple menu > Log Out Account Name.
2. In the login window, select an account if one isn’t already selected. Then click the question-mark button to the right of the password field.
3. Click the right-pointing arrow button to restart.
4. After your Mac restarts, you see the Reset Password utility as the primary screen. This is a special restart mode that doesn’t let you exit into macOS Recovery. Enter your Recovery Key — you can type it in lowercase without dashes, and the utility adds them — then click Next.
5. If accepted, you’re asked to enter a new password with a hint, and then verify it. Click Reset Password and Verify Password.
6. Your Mac restarts. Log in with your account and the new password.

If you have upgraded to Tahoe through version 26.3 and have your FileVault Recovery Key stored in your iCloud account, I recommend resetting the key to provide better access to it across your devices, among other advantages. See where to find your FileVault Recovery Key. If you’ve updated to 26.4 or Golden Gate, Apple already made you do this!

Reset via Activation Lock

On Macs with a Secure Enclave coprocessor without FileVault enabled, you can use your Apple Account to reset your password through Activation Lock. Here’s how:

1. Follow steps 1 to 3 above.
2. Your Mac restarts and displays an Activation Lock login, showing part of your associated Apple Account. Enter your account name, click Next, then enter the password and click Next.
3. If successful, a screen appears that notes “Authentication succeeded.” If not, work through the first three steps again.
4. Click Exit to Recovery Utilities.
5. Choose Utilities > Terminal.
6. Type resetpassword and press Return. This opens the Reset Password utility.
7. Select “I forgot my password” and click Next.
8. Create a new password as above: enter, verify, and add a hint. Click Reset Password. Your Mac restarts.
9. Log in with your account and the new password.

This process is also how you reactivate a Mac if it’s been set as lost in Find My.

Reset from recovery mode

There’s a command-line password reset utility available in recovery mode, also, which you can use without having to know the administrator password. Here’s how to reset your password on an Apple silicon Mac:

1. Choose Apple menu > Shut Down. When your Mac has powered down, hold the power button until you see a prompt that says “Loading startup options.”
2. Click Options.
3. Click “Forgot all passwords?”
4. Choose Utilities > Terminal.
5. Type resetpassword and press Return. This opens the Reset Password utility, but without the prompt for a Recovery Key.
6. Select “I forgot my password” and click Next.
7. Create a new password as above: enter, verify, and add a hint. Click Reset Password. Your Mac restarts.
8. Log in with your account and the new password.

You might wonder why anti-malware software is not on the list of things to install on a Mac. After decades of using anti-malware software, some of it quite sophisticated, I don’t think any package’s benefits outweigh the cost in terms of price, false positives, and system load.

Anti-malware software has a distinct weakness: it can’t protect against unknown threats. It’s 100% designed to keep out-of-date systems protected from well-known viruses and the like, and to safeguard an up-to-date system as quickly as possible from malware that has just been discovered and characterized. If you keep your Mac up to date and never install software of any kind from the internet (besides the App Store) or software handed to you by other people, you can probably forgo anti-malware software, as it has no real path to find you.

For everyone else, it’s worth considering. While a portcullis doesn’t protect a castle when it’s open, cutting the rope and dropping it is an effective way to keep hordes from rampaging through that front door. Likewise, automatic updates and scanning are terrific ways to ensure you aren’t caught out by a prior or current exploit.

What antivirus software cannot catch

You’d think with all the AI in the world and decades of research about viruses, there should be a way to detect malicious behavior and shut it down. And yet that’s still largely a dream, with one exception for ransomware that I describe below.

Instead, anti-malware software’s virus-protection portion largely relies on the same technology it has for decades. A hash is made of a malicious payload—in just the same way that Apple creates a cryptographic summary of legitimate software—and stored in a list. When the anti-malware app scans a drive for bad actors, it generates a signature of each item it finds and compares it against its stored list, which is frequently updated.

The best current anti-malware software helps you with five distinct issues:

• Known malware: Blocking already known and extant malware, including routinely scanning files on your Mac, volumes you mount on your Mac, and attachments that arrive via email
• Phishing websites: Blocking phishing websites and those that host links to malicious software, either loaded in the browser or as downloads
• Behavior alerts: Identifying dubious behavior that might be fine, but you should review to be sure, such as opening a file or accessing a folder in an unexpected location

macOS requires you to grant permission the first time an app attempts to access files in certain locations, which is a coarse but useful version of this. See how to control which apps use your Mac camera and files.

• Ransomware: Blocking ransomware activities based on the way that ransomware functions, discussed below
• Windows malware: Preventing you from passing Windows viruses on to someone else

Ransomware is the exception

Ransomware is the odd one out in this whole discussion. While being the biggest likely threat to Mac users, it’s also by far the easiest to track. Ransomware operates by suddenly creating a mass of new, encrypted files and deleting ones with similar names. It’s rarely sophisticated; it just has to be launched by a user or through some method that lets it insert itself and run.

Some anti-malware software can detect this broad category of behavior because it’s so specific, and can lock down folders and prompt your response before more than one or a handful of files are locked away.

Windows malware on a Mac

macOS can’t run malware that’s written for Windows machines, so even if a Windows virus appeared on your drive, it wouldn’t do any damage; it would simply be inert.

Mac anti-malware apps, however, do identify, quarantine, and remove Windows malware, because of the chance you might pass it on via email or as part of an infected Microsoft Office document to someone else who uses Windows.

And even though macOS isn’t Windows, you can run Windows via virtualization software like Parallels Desktop. Mac anti-malware software won’t protect you there, so you should absolutely run Windows anti-malware software within your Windows installation.

Because FileVault prevents direct access to your data volume at startup, turning it on requires a backup plan. That backup plan is the FileVault Recovery Key. This key is a precious object that you should treat like the gold that it is virtually made of. If anything were to go wrong with the boot portion of your Mac’s operating system, or in the unlikely event you forget the password to your computer’s account, the only way you can decrypt the drive is using the Recovery Key. Without it and any accessible backup, its contents are truly gone for good.

This Recovery Key is entirely unrelated to the Apple Account Recovery Key, used to regain access to your online account.

When you need a Recovery Key

You should only ever need to use your Recovery Key if you attempt to log in with your macOS account password or username and password, and macOS refuses to let you proceed. In such cases, you should see text that reads Reset Password with a right-pointing arrow to its left. You can also bring up that link right away by clicking the question-mark button to the right of the password field. Follow the instructions to reset your password with the Recovery Key.

Apple has historically had two different ways it manages the Recovery Key. The first lasted for several years, through Tahoe. The second, in Tahoe and later, was optional through version 26.3. It’s mandatory starting in 26.4 and Golden Gate.

The older method is worth understanding if you set up FileVault years ago; the newer one is much safer.

How to view the key

With Tahoe, Apple made three key changes:

• View anytime: You can view the FileVault Recovery Key at any time after it is created—it’s no longer shown just once ever.
• No iCloud account escrow: Simple iCloud escrow is no more.
• Recovery Key in Passwords: The FileVault Recovery Key is added to Passwords. If you have Passwords syncing enabled with iCloud, the key is synced using end-to-end encryption—not simple Apple Account access—among your devices.

If you didn’t interact with FileVault when upgrading to Tahoe or installing 26.1, 26.2, or 26.3, you will be forced in a simple process when you install 26.4 or later, or upgrade from any pre-26.4 version of macOS to Golden Gate. I recommend upgrading manually in 26.0 to 26.3, using the steps below.

In System Settings > Privacy & Security > FileVault, you can click the Show button, validate with Touch ID or a password, and display the key in full.

You can also view the key in Passwords.

In the initial iOS 26/iPadOS 26 release (or maybe the first few), the Recovery Key synced to iPhones and iPads, appearing in the Passwords app, but lacking any information except the Recovery Key label and the key itself. Apple fixed this in a later update, ensuring the information appears identically on all platforms.

Even though the Recovery Key now syncs via iCloud, you could still wind up with a problem:

• With Passwords, if you lose access to all your devices besides your Mac, and it cannot start up using your password, you need another way to access the Recovery Key. Storing it in Passwords is not enough given the consequences of not having it.
• If you don’t use Passwords, you must use another password manager or some other secure method to make sure you can access it if your Mac becomes unavailable.

Check an older key still works

If you set up a locally stored Recovery Key before Tahoe, you can use a Mac command-line tool to validate that the Recovery Key you have on hand is truly accurate without trying to reset an account password. In Terminal, enter sudo fdesetup validaterecovery and press Return.

At the prompt, enter your administrator password, and then paste or enter the Recovery Key. If the result is anything but true, try re-entering. If it continues to produce false or an error, it’s time to reset FileVault.

If you want to disable FileVault, rotate your Recovery Key (because it was exposed), or upgrade to the new method in Tahoe 26.0–26.3, follow these steps:

1. Go to System Settings > Privacy & Security > FileVault and disable FileVault.
2. Click Turn Off Encryption.
3. Use Touch ID or enter your password, as prompted.
4. “Decryption” may take a moment; really, it’s making a few low-level changes in the startup partition. Stop here if you simply wanted to disable FileVault; otherwise, proceed.
5. Now, re-enable the switch. If it’s been more than a moment since you carried out step 3, you may be prompted to use Touch ID or enter your administrator password.
6. “Encrypting” may appear for a moment as macOS rewrites the startup information. There’s no additional action you need to take.

Unlocking remotely, as a last resort

Starting in Tahoe, Apple added an option to enter a Recovery Key via SSH if Remote Login is enabled on your Mac and it’s connected to a network. This could be useful in desperate circumstances, where you’re unable to type directly on the Mac, or it’s located in a hard-to-reach location. Whatever the reason, consider enabling Remote Login if you’re concerned, as described in which Mac sharing services are safe to turn on.

What Apple changed, and why

Before Tahoe, Apple let you choose between two options:

• Store locally: The key was generated, displayed to you, and never stored anywhere. You could never retrieve it after seeing it once.
• Use escrow: The key was securely stored in your iCloud account.

I never liked the iCloud option much, though it was less scary than a “show once, lose forever” local key. However, iCloud escrow had three implications:

• If you somehow lost access to your iCloud account, the key was not retrievable. (If you could still log in to your Mac, you could disable FileVault and re-enable it to generate a new key you stored locally.)
• If someone gained access to your Apple Account credentials, they could unlock a Mac you own that they have access to by using the FileVault recovery process.
• A government agency, rightly or wrongly, could have forced Apple legally or extrajudicially to provide this key for a device they had seized or otherwise obtained. To my knowledge, this has never occurred, but it’s possible Apple would have been constrained from revealing it in any country in which it occurred; that seems unlikely given the company’s stance on encryption and privacy.

Apple’s operating system and cloud security teams must have had thoughts like this when they revamped Recovery Key access in Tahoe.

macOS has many privacy and security settings that can be turned off or tuned, reflecting in part how you interact with a computer versus a mobile device. Let’s start with System Settings > Privacy & Security, which collects several controls and options. I also mention settings in Users & Groups, and Lock Screen, and in the Keychain Access utility, that deserve a quick look.

There is more on FileVault separately.

Unlock the pane or setting

Apple requires you to prove your identity when accessing more sensitive elements of System Settings. First, click a setting, like changing “Allow applications from” to App Store. Now:

• Touch ID: If you have Touch ID, you’re prompted for biometric authentication. You can also click Use Password to enter your account password, then click Unlock.
• No Touch ID: You’re prompted to type in the administrator password. Enter it and click Unlock.

Some settings, such as Users & Groups, prompt for your administrator password even when Touch ID is enabled.

With an Apple Watch, you can also unlock many settings by using a side button double-press. Go to System Settings > Touch ID & Password and enable your Apple Watch under “Use Apple Watch to unlock your applications and your Mac.”

That option also lets your Apple Watch unlock your Mac’s screen, as described below.

Require an unlock for all preferences

You can force yourself or users of the Mac to have to unlock all preferences before using them. Click the Advanced button in Privacy & Security, and then select or enable “Require an administrator password to access system-wide preferences.” Items like Sharing settings can otherwise be used without an administrator password.

Settings > Touch ID & Password and System Settings > Lock Screen offer two additional password-related features worth examining.

Adjust password preferences

In Touch ID & Password, the top of the setting says “A login password has been set for this user” if you set one. Click Change to update it.

You should always have a password set for your Mac, even if you’re the only person in your house, because a password to access your computer is a fundamental building block of security. If someone accesses your computer without your permission or steals your computer, you want at minimum this level of protection.

Once you change your password, you can’t use the old one again. While that might seem obvious, Apple added a grace period starting in iOS 17/iPadOS 17: change the passcode on an iPhone or iPad and you can still use the old one for 72 hours. Apple never added this to macOS, possibly for unknown security reasons.

In Settings > Lock Screen, select Immediately from the “Require password after screen saver begins or display is turned off” to, you know, do what it says on the label: force your Mac to lock when it goes to sleep, or when the screen saver activates and a period of time passes. You can also set it to wait for durations from 5 seconds to 8 hours.

How to sleep or lock your Mac

Apple offers lots of ways to let or force your Mac to go to sleep or initiate its screen saver. Here are several:

• Turn display off on…when inactive: In Settings > Lock Screen, you can set “Turn display off on [battery, power adapter] when inactive” to durations from 1 minute to 3 hours or Never. “Battery” and “power adapter” appear separately on laptops; only “power adapter” appears on desktops.
• Screen saver: Go to System Settings > Wallpaper, click Screen Saver, and use the “Start Screen Saver” pop-up menu. Choose a duration greater than Never for how long your Mac must be idle before the screen saver activates.
• Lock screen menu: Choose Apple menu > Lock Screen, and either the lock screen appears or the screen saver, depending on your settings. You can also press ⌘-Control-Q.
• Hot corner: Assign Lock Screen or Start Screen Saver to an action in System Settings > Desktop & Dock > Hot Corners. Each corner may have a different action assigned from a diverse list.

When you return, you can enter the password; or, on Macs with built-in or keyboard-based Touch ID enabled, unlock with Touch ID. See how to set up Touch ID and Face ID.

Touch ID may be disabled in certain circumstances for added security. See when biometric lockout happens.

You can choose Never, but I’d suggest…never doing this. Nearly everyone should pick Immediately or a short time duration—otherwise, every time you walk away from an active Mac, anyone with physical access can jiggle the mouse or touch the trackpad and access your stuff.

You can crank that up a notch if you’re at higher risk of physical access or theft: click the Advanced button in Privacy & Security, select “Log out automatically after inactivity,” and enter a duration in minutes. The Mac logs you out of your account after that period passes, raising the bar for a physical break-in. While the lock screen should be sufficient, background apps and other settings are in effect that could make your machine slightly more at risk than if it’s in a logged-out state.

If you have an Apple Watch, an iPhone, and a Mac signed in to the same iCloud account, you will have an additional option in System Settings > Touch ID & Password: “Use your Apple Watch to unlock your applications and your Mac.” Any Apple Watch that meets the preceding criteria appears in a list, each with its own switch. Enable one (or more) if you want your Mac to be automatically unlocked when it’s locked, you’re close by, and you’re wearing your watch. This setting also lets you unlock apps that require Touch ID via your Apple Watch, including the Apple Passwords app, and some system features.

Just tap the keyboard, keypad, or mouse as if you were jostling it to get it to show you a password dialog or a Touch ID prompt, and the Apple Watch and Mac have a conversation. Bluetooth and Wi-Fi must be enabled on the Mac for it to work.

Conversely, you might find unlocking your Mac with an Apple Watch is a security risk if you are subject to targeted attacks by a government or individuals.

Optionally, you can have a message appear on a lock screen. In Settings > Lock Screen, enable “Show message when locked,” click the Set button, enter a message, and click OK. This message can be useful if other people use the same Mac and you want to alert them as to why it’s idle.

I have my Mac in a day-lit basement office. Sometimes, I’ll be walking across our main floor, and my Apple Watch lights up that the Mac was unlocked a floor below!

Control what can be plugged in

Apple has options that can prevent peripherals, computers, and other accessories from connecting over built-in ports, like USB (Type-A and USB-C), Lightning, and SD Card, depending on your device. You can prevent peripherals from connecting via Lightning, Thunderbolt/USB, or the Smart Connector (for an iPad Smart Keyboard), or allowing a card to mount via the SD Card slot without permission.

Go to Settings/System Settings > Privacy & Security > Wired Accessories (iPhone/iPad)/Accessories (Mac). Modify the Allow Accessories to Connect setting. You have four options:

• Always ask
• Ask for new accessories
• Automatically allow when unlocked
• Always allow

In any case in which you have to grant permission, you must enter your administrator permission—Touch ID or Face ID, even when available, isn’t considered a high-enough bar.

Starting in macOS 26 Tahoe, you can also choose a security policy for accessories at startup. You can use this to prevent peripherals other than drives from interacting with the system before a macOS session has started.

First, restart into recovery mode; see how macOS protects its own system files. Next, choose Utilities > Startup Security Utility. Now, choose an option as above from the “Allow accessories to connect” menu.

With all that in mind, you might wonder: what should I open for use and what’s safe? The answer depends on whether your Mac has a public IP address. I advise always turning on only the services you need. A few are worthwhile, and how you configure them depends on your circumstances.

But you should have different considerations under these sets of circumstances:

• Privately addressed Mac on a network in which all users are trusted: If you’re by yourself or you trust your roommate and family to not attempt to access things they shouldn’t, you can enable what you like and just configure for general safety.
• Privately addressed Mac on a network in which not all users are trusted: If you share a network with other people—which could include kids or parents who may not be as safe or honest with you as you might like—consider locking things down further and using the fewest possible services.
• Publicly addressed Mac: You need to take more care to set passwords and configure limitations, and to consider whether to leave services active all the time or only when you know you or someone you trust needs them.
• High-risk individual or group: People who believe themselves at elevated risk shouldn’t operate any services on public addresses, and should think strongly about not running them even on privately addressed networks. It’s very easy for so-called Internet of Things (IoT) or “embedded devices” to be compromised. That can include DVRs, routers, smart home gear, and more. A subverted device on your local network can have the same access as anyone else on the network.

With that in mind, here are the items in System Settings > General > Sharing worth enabling or disabling. Configuration options appear when you click the info button next to a service.

Don’t allow all users

Several services let you selectively enable them. Apple offers a choice of “Allow access for” either “All users” or “Only these users” for most services. File Sharing has more fiddly options. I recommend setting access for Screen Sharing and any service starting with Remote to Administrators (often prefilled), or, better, selecting users or groups you’ve created. This limits exposure in the case of an intrusion that doesn’t gain direct access to your macOS account.

Screen Sharing

If you have a “headless” Mac (one without a monitor) that you use for various services, or machines in different parts of a house or office that you want to access remotely, screen sharing is handy.

I recommend deselecting two options in the Computer Settings dialog:

• Anyone may request permission to control screen: There’s no reason to allow this except momentarily if you want to allow someone to request access.
• VNC viewers may control screen with password: VNC is an outdated protocol that Apple’s screen-sharing technology extends with more security and features. There’s no good reason to keep this option turned on, particularly because VNC passwords are notoriously easy to crack.

File Sharing

The File Sharing service on a Mac offers fine-grained controls to choose which folders and volumes are accessible to which people, including the type of access: read/write, read-only, or write-only (to drop items into without seeing the shared item’s contents).

In configuring File Sharing, I recommend the following:

• Disable Full Disk Access if multiple people have accounts with administrator access to the Mac, unless you explicitly want them all to have remote access to all files on the volume.
• In the Shared Folders list, select items you don’t need shared and click the minus button.
• In the Users list for each shared folder in turn, click the pop-up menu and choose No Access for users and groups that can’t be removed, then select the user or group and click the minus button to remove those that can.

What you’re left with is a limited, tightly controlled set of folders and volumes that only people you have approved can interact with.

I often create a sharing account that I set up for limited access. You can use the Guest account for this purpose, but I’d rather control it more directly by name. See also how to set up safe user accounts on a shared Mac.

Remote Login, Management and Apple Events

Apple offers powerful but somewhat obscure ways to access, manage, and use a Mac remotely:

• Remote Login lets you connect via the SSH (secure shell) protocol, commonly used in Unix/Linux, as well as access file sharing with SFTP (Secure File Transfer Protocol), which is really “FTP using SSH.” It’s rarely needed except for particular purposes, such as if you need remote command-line access. If you do enable it, keep “Allow full disk access for remote users” turned off.
• Remote Management connects with Apple Remote Desktop (ARD), a corporate and academic tool. If you’re not using ARD, don’t enable this service.
• Remote Apple Events or Remote Application Scripting is a tweaky thing that lets an AppleScript running on one Mac send control events to another. It’s rare you need this, and you will know if so.

Reaching your Mac from outside

If you want to have access to Macs and other devices that are behind NATs or other network protections, I highly recommend Tailscale. The company’s core product lets you create an account, install software on nearly any device, and then have those devices create VPN tunnels to a pooled central network space. This is a profoundly straightforward way to use File Sharing and Screen Sharing when away from your home network. You can install Tailscale on an Apple TV and then set it up to provide access to the entire network it’s on, too!

Tailscale offers a non-commercial account that fits most people’s personal needs.