Canonical Technical Definition

Apple's native full-disk volume encryption system for macOS, securing all user data on storage media using hardware-accelerated XTS-AES-128 encryption.

FileVault is Apple’s built-in whole-volume encryption system for macOS. Originally introduced in Mac OS X 10.3 Panther as a sparse-image user folder encryptor and completely rewritten as FileVault 2 in Mac OS X 10.7 Lion, FileVault protects every bit of data on your Mac’s internal storage volume using industrial-grade cryptography.

On modern Apple Silicon Macs (M1, M2, M3, M4), FileVault is tightly integrated into the Apple File System (APFS) and the hardware Secure Enclave, providing transparent, impenetrable protection against physical theft or unauthorized hardware access.

The cryptographic mechanics of FileVault on Apple Silicon

On modern Mac hardware, FileVault operates with extreme sophistication:

  1. Dedicated AES hardware engines: Every Apple Silicon chip includes dedicated inline cryptographic accelerators integrated into the NVMe storage controller. Read and write operations are encrypted and decrypted on the fly at multi-gigabyte-per-second line speeds without burdening the CPU.
  2. XTS-AES-128 cipher mode: Data is encrypted using 128-bit keys in XTS mode (IEEE 1619 standard), the gold standard for block storage volume protection.
  3. Secure Enclave key protection: The volume encryption keys are cryptographically wrapped by keys stored in the hardware Secure Enclave. The volume keys cannot be extracted or decrypted without supplying the user’s legitimate passcode or biometric Touch ID signature.
[User Login Passcode / Touch ID]
                ↓
    [Hardware Secure Enclave]
                ↓
[Volume Encryption Key (VEK) Unwrapped]
                ↓
[Inline AES Hardware Storage Controller]
                ↓
[APFS Storage Volume Decrypted into System RAM]

Physical security boundaries

When FileVault is active:

  • Mac Powered Off: Every sector on your SSD is cryptographically sealed ciphertext. Even if an attacker physically removes the flash memory chips and solders them to an analyzer, they cannot read a single file.
  • Mac in Sleep Mode: Memory protection protocols prevent DMA cold-boot attacks against system RAM.
  • Mac Unlocked: Authorized applications running within the user’s session access files through standard POSIX filesystem calls at full NVMe speeds.

FileVault and Oyma

Because Oyma operates as a native local-first Mac application:

  • Your notes, meeting records, audio clips, and SQLite FTS5 indexes inherit FileVault’s full cryptographic protection automatically.
  • There are no custom vault passwords to forget or corrupt.
  • Your intellectual property enjoys hardware-level security while retaining the speed and open interoperability of standard plain-text files.

Frequently asked questions about Apple FileVault Encryption

How do I check if FileVault is enabled on my Mac?

Open System Settings > Privacy & Security > FileVault. It will display whether FileVault is turned on for your primary APFS startup disk.

Does FileVault slow down Mac performance or SSD speeds?

No. On Apple Silicon Macs (M1 through M4), FileVault encryption is executed via dedicated hardware AES cryptographic engines on the processor die with zero measurable performance penalty.

How does FileVault protect my notes in Oyma?

Because Oyma stores notes in your Mac's user directory, every file, transcript, and audio recording is automatically protected by FileVault's hardware encryption whenever your Mac is locked or shut down.