FileVault encrypts your Mac's drive. It will sometimes ask for the 24-character recovery key after a major change — sometimes that is normal, sometimes it is a sign of tampering.
Normal reasons for the prompt
- You replaced the logic board or SSD
- A macOS upgrade required re-authentication
- You restored from a Time Machine backup
- You forgot your login password and chose Reset using your Recovery Key
Suspicious reasons
- Someone else had physical access to your Mac and tried unlock attempts
- An unauthorised user added themselves to FileVault, then locked you out
- Your Mac was stolen and you are seeing the prompt at recovery
Important
If you suspect tampering, do not enter the recovery key from the original Mac. First check Find My Mac to see whether the device is in an unexpected location.
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers