Activation Lock vs FileVault vs Firmware Password: what the difference is#

Four Mac security features get confused at the same preboot or Setup Assistant moment, and only the first is fatal to a sale. Activation Lock protects hardware reuse and lives on Apple's activation servers. FileVault protects data at rest via XTS-AES-128 full-disk encryption bound to user credentials. The Intel firmware password is obsolete on Apple silicon, replaced by Recovery Lock on macOS Monterey 12. Each has a distinct purpose, a distinct location for its state, and a distinct path to clear.

Mixing them up costs sellers and buyers money. This post is the disambiguation reference.

The compact comparison#

Activation Lock#

Activation Lock protects hardware reuse. It prevents reactivation after an erase or macOS reinstall without the Apple Account that originally enabled Find My Mac on the device. State lives on Apple's activation servers, keyed to the device's hardware identity (serial number and ECID), with a corresponding LocalPolicy stored in the Secure Storage Component on Apple silicon Macs. (Apple Platform Security)

The lock arms automatically the moment Find My Mac is turned on while signed into iCloud, on a T2 (2018-2020 Intel) or Apple silicon Mac running macOS Catalina 10.15 or later. There is no separate Activation Lock control to flip. Find My is the master switch.

The "Activate Mac" screen appears in Setup Assistant after an erase or macOS reinstall when Apple's servers still record the Mac as bound to an account with Find My on. Only credentials that work past it: the original Apple Account password, the local user's previously used device password, or an MDM-escrowed bypass code entered via Recovery Assistant → "Activate with MDM key...".

Legitimate clears: turn off Find My Mac with the Apple Account password; use Remove from Account at iCloud.com/find from another device signed into the same account; for organizational devices, ABM/ASM removal by the owning org; as a last resort, an Apple proof-of-purchase support request at al-support.apple.com with an original Apple or Authorized Reseller receipt.

What does not clear it: erasing the SSD, reinstalling macOS, DFU restore via Apple Configurator, logic-board swap. The lock is server-enforced and hardware-bound.

FileVault#

FileVault is Apple's full-disk encryption. The cipher is XTS-AES-128 with a 256-bit key. State is bound to user credentials, specifically an admin password and/or a FileVault recovery key generated when the feature was enabled. (Apple Platform Security: Volume encryption with FileVault)

On T2 and Apple silicon Macs, the internal storage is always hardware-encrypted regardless of FileVault state. The hardware encryption is keyed to the Secure Enclave's device key and protects against physical attacks like pulling NAND chips off the logic board. Turning FileVault on additionally binds the decryption to user credentials, so the Mac will not auto-unlock at boot without the user's password.

The FileVault preboot unlock screen appears before macOS loads on a Mac with FileVault on and user accounts present. It is not Activation Lock and not the regular macOS login screen; those are different layers of the boot stack. The FileVault prompt demands a FileVault-enabled user's password or the recovery key.

Cleared in System Settings → Privacy and Security → FileVault → Turn Off by an admin. Decryption can take from a few minutes to a few hours depending on disk size and contents. There is no "FileVault override": if you do not have the user password or the recovery key, the data is unrecoverable, and that is the design.

FileVault has nothing to do with the Activation Lock screen. A Mac with FileVault on but Activation Lock cleared will show the FileVault prompt at preboot (because the user accounts and their encrypted home directories still exist), and a Mac with Activation Lock on but no FileVault will show the "Activate Mac" screen in Setup Assistant. They live at different layers and clear with different credentials.

Intel firmware password#

The Intel firmware password (sometimes called the EFI password or Open Firmware password on older Macs) gates startup modifiers on Intel Macs. State is stored in EFI NVRAM.

What it gates:

• Holding Option at startup to choose a boot disk.
• T at startup for Target Disk Mode.
• Command-R for Recovery.
• Single-user mode and verbose mode.
• Holding N for NetBoot.

Without the firmware password, the modifiers are ignored and the Mac boots normally from the default startup disk. The OS login screen still appears as usual; the firmware password is one layer earlier than the macOS user authentication.

Set in Recovery → Utilities → Startup Security Utility (or Firmware Password Utility on older Intel) by an admin. Cleared by entering the password in the same utility or, on pre-T2 Intel Macs, by Apple Service. On T2 Intel Macs, a DFU restore via Apple Configurator removes the firmware password.

Apple silicon has no EFI and no firmware password. The Recovery Lock fills the same role.

Recovery Lock (Apple silicon)#

Recovery Lock arrived on macOS Monterey 12 in October 2021 as the Apple silicon equivalent of the Intel firmware password. State is held in the Apple silicon boot architecture rather than EFI NVRAM, integrated into the LLB / LocalPolicy chain that also enforces Activation Lock.

Same job as the firmware password: gates access to recoveryOS and to the boot picker (the equivalent of Intel's Option-key boot menu). On an Apple silicon Mac, the boot picker comes up by holding the power button at startup; Recovery Lock requires the password before the picker shows alternative boot sources or recoveryOS.

Cleared by a DFU restore via Apple Configurator 2, or via Finder on macOS Sonoma 14 and later. A DFU restore removes Recovery Lock but does not remove Activation Lock. The two locks are independent; a Mac can have Recovery Lock without Activation Lock or vice versa.

For managed environments, MDM can deploy Recovery Lock with an escrowed password, similar to how MDM can deploy and escrow Activation Lock bypass codes on supervised devices.

How they interact#

Two relationships worth keeping straight:

1. Find My Mac is the master switch for Activation Lock, not for the others. Turning Find My off with the Apple Account password disarms Activation Lock instantly. Find My has no relationship to FileVault, the Intel firmware password, or Recovery Lock.

2. Erase All Content and Settings (EACS) turns all four off in one operation. On macOS Monterey and later, EACS signs the user out of iCloud (disarming Activation Lock), removes user accounts and their associated FileVault state, resets any firmware password or Recovery Lock to defaults, and destroys the per-device cryptographic keys. Then it restarts to a clean Hello Setup Assistant.

EACS is the seller-side handoff workflow precisely because it handles all four in one pass. Manual sign-out of iCloud handles Activation Lock but leaves FileVault, firmware password, and Recovery Lock untouched.

How they look at preboot#

A buyer or owner powering on a Mac sees one of several screens, and knowing which is which matters:

macOS Hello / multilingual greeting ("Hello", "Bonjour", "Hola" rotating). The Mac has been erased and is in fresh Setup Assistant. This is what a buyer wants to see immediately after the seller's EACS run, before any setup steps. None of the four locks is active at this moment.

Activation Lock "Activate Mac" screen. Appears during Setup Assistant when Apple's activation servers record the Mac as bound to an account with Find My on. Messaging reads roughly "This Mac is linked to an Apple ID. Enter the Apple ID and password that was previously used with this Mac" with an obfuscated account hint. Server-enforced; not bypassable locally.

Lost Mode "This Mac has been locked with Find My Mac" screen. A separate kind of Activation Lock screen, set when the owner manually flagged the Mac as lost via iCloud.com/find or the Find My app. On Intel and T2 Macs it demands a 4- or 6-digit PIN; on Apple silicon it demands the Apple ID and password directly.

FileVault preboot screen. A login-style prompt that appears before macOS loads, showing FileVault-enabled user accounts. Requires a FileVault user password or the recovery key. Will appear on any owner-controlled Mac with FileVault on, not just transferred Macs.

Firmware password prompt (Intel). A simple text prompt asking for the firmware password before allowing the requested startup modifier. Does not gate the default boot.

Recovery Lock prompt (Apple silicon Monterey 12+). Asks for the Recovery Lock password before showing the boot picker or recoveryOS.

macOS login screen with user avatars. This is not a lock in the security sense. It is just user authentication on a fully set-up Mac. A buyer who sees this is being offered a Mac that was never erased, which is its own red flag: Activation Lock is still armed on the original owner's account and will trigger on any subsequent erase.

What this means for buyers#

Only the Activation Lock and Lost Mode screens are fatal to a sale, because both are server-enforced and require the previous owner's credentials. The FileVault, firmware password, and Recovery Lock prompts indicate a Mac that was not properly prepared for handoff; the seller should run EACS, which clears all of them.

If a seller-prepared Mac reaches a clean Hello screen with no Activation Lock prompt and no Remote Management screen on a live Wi-Fi connection, all four locks are in the cleared state and the Mac is genuinely transferable. That is the pre-purchase verification the buyer is paying for.

The most expensive failure mode is buying a Mac at a boot login screen on the assumption that "the seller gave me the password, so I'm fine." The seller's local password is not Activation Lock. The first time you erase that Mac, the Activation Lock screen appears in Setup Assistant and you have no path past it. Five minutes of EACS in front of you at the kitchen table prevents this entirely.