FileVault on your hosted Mac Servers

FileVault is Apple's full disk encryption for macOS. When enabled, the Mac requires a password at boot before macOS loads. Without that password, the startup volume stays locked.This article explains if you can use FileVault and when, the trade-offs and more important information.

Should I enable FileVault on my hosted Mac?

Short answer

Do not enable FileVault unless you have an Apple Silicon Mac running macOS Tahoe (26) or later with SSH enabled. Even then, consider if you actually need it. An encrypted disk image may serve you better. See our article Encrypting Data on your Hosted Mac for more details.

What happens when FileVault is enabled

FileVault adds a password prompt at boot. The Mac will not start macOS until someone enters this password. On a server in our data center, that creates a problem: every time your Mac reboots, it sits at the password screen doing nothing until the password is provided.

On macOS Sequoia (15) and earlier: no network services run at the password screen. No SSH, no VNC, no ARD. The Mac is completely unreachable. The only option is for our team to physically connect a keyboard in the data center and enter your password. This takes time to arrange and means extended downtime. Also it means you have to provide us with your password, which takes away the point of encrypting data.

On macOS Tahoe (26), Apple Silicon only: Apple added SSH at the pre-boot screen. You can SSH in and type your password remotely. This is a big improvement, but your Mac still does not boot automatically. After every reboot, it waits for you to connect and unlock it. If a reboot happens due to a kernel panic or unexpected power event, your server stays down until you notice and act. There is no way around this.

How to unlock FileVault via SSH (macOS Tahoe 26, Apple Silicon)

This is a rather new feature, and we consider it still experimental. Only use this if you can live with your server being offline for longer times.

Requirements:

  • Apple Silicon Mac (M1 or later)

  • macOS Tahoe (26) or later

  • SSH (Remote Login) enabled before the reboot

Steps:

  1. SSH into your Mac: ssh username@your-mac-ip

  2. The session tells you the Mac is locked and asks for your password

  3. Enter the password. The Mac unlocks, the SSH session closes, boot continues.

  4. Wait a moment, then SSH in again for normal access.

Things to know:

  • The pre-boot SSH host key may differ from the normal one. A host key warning is expected.

  • If SSH was not enabled before the reboot, this will not work. Physical access is then required.

  • This does not work on Intel Macs, even running macOS Tahoe.

Does FileVault actually protect your data on a running server?

No. Once the Mac has booted and the password has been entered, the volume is unlocked. On a 24/7 server, that means the disk is unlocked virtually all of the time. FileVault only protects data when the Mac is powered off or sitting at the boot screen.

Your Mac's SSD is already hardware-encrypted by the Secure Enclave (Apple Silicon) or T2 chip (Intel, 2018+).

If you want encryption that you can lock and unlock on demand while the server is running, see our article Encrypting Data on your Hosted Mac.

Summary

Scenario

Can you use FileVault?

Should you?

macOS Sequoia (15) or earlier, any Mac

Technically yes, but no remote unlock. Every reboot requires physical access.

No

Intel Mac, any macOS version

No remote unlock available.

No

Apple Silicon, macOS Tahoe (26)+, SSH enabled

Yes, remote unlock via SSH.

Only if you accept manual unlock after every reboot. Consider alternatives.

Already locked out?

Contact support. We will need to schedule physical access to your Mac.