In macOS 26 Tahoe, Apple has updated how it manages encryption keys in FileVault, the feature that protects your Mac’s data volume by encrypting it. Users with existing choices won’t be immediately impacted, but eventually everyone will need to use the new approach—which I think is an improvement. But if you rely on Apple to hold on to your Recovery Key for you, it’s time to start considering a new strategy.
The modern version of FileVault first appeared way back in Mac OS X 10.7 Lion. (The first version of FileVault only encrypted your Home directory.) Today’s FileVault provides both boot protection and disk protection: you have to enter an account password before the operating system loads, and passing that stage unlocks an encryption key that provides access to the otherwise fully locked-down startup volume’s contents.
When you set up FileVault, macOS generates a Recovery Key for you. Normally, you decrypt the disk by logging in with your password, but if the portion of your drive containing login data becomes corrupted, the Recovery Key is the only alternate path to decrypting your data. This is a really rare failure, but if it happens, there needs to be an alternate path to recovery. That’s the Recovery Key.
