I have a new MacBook Air 2020 running Catalina 10.15.6 and I'm asking about the encryption on the internal SSD. When I run diskutil apfs list it shows that both the "Macintosh HD" and "Macintosh HD - Data" volumes have the following:

FileVault: No (Encrypted at rest)

What does this mean? If these drives are already encrypted at rest, should I, or do I need to, turn on Filevault to protect the data on them in case my MacBook is stolen?

1 Answer 1


It means that the SSD is encrypted by the built-in T2 chip. On newer Macs encryption is always enabled and handled by the T2 chip.

This means that the disk is encrypted when at rest, essentially meaning when the computer is powered off and/or the disk drive is removed from the computer. However as soon as someone turns on the computer, the T2 will supply the necessary key and make the drive contents available.

You will most probably want to enable FileVault. This ensures that your drive cannot be decrypted simply by powering on the computer, but will require your secret password.

  • If all you have to do to decrypt a volume is to power it on then what's the point of encrypting it? I must be missing something here.
    – Red Ochre
    Aug 19, 2020 at 10:43
  • There are several advantages actually. For consumers the most obvious is that they can enable encryption with their own password almost instantly when they want to - they do not need to wait for the drive to be encrypted first. Another advantage is that if you drive is seperated from the computer (for example at a repair shop), you cannot read the contents of the drive. A third advantage is that it makes it possible to securely erase the contents of the drive by deleting/forgetting the key. If you have a non-encrypted SSD, it is usually very hard to otherwise securely delete data in general.
    – jksoegaard
    Aug 19, 2020 at 11:16
  • I think I understand reason 1. Reason 2: do you mean that the drive will only decrypt if it is in the original MacBook and if it is installed in another Mac, it will not decrypt when powered on? Reason 3 looks good too. Thanks
    – Red Ochre
    Aug 21, 2020 at 0:22
  • Reason 2: Yes, exactly - if installed in another computer and powered on, it will not decrypt.
    – jksoegaard
    Aug 21, 2020 at 5:13
  • As a researcher and/or developer, I need these volumes decrypted on my T2 Mac. And I also see that not all volumes are encrypted this way: Some special (hidden) vols such as "Preboot" and "Recovery" are not encrypted at all, i.e. reading their blocks with "dd" show the decrypted data. Dec 12, 2020 at 16:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .