What happens when you forget a FileVault password
Short answer: FileVault encrypts every file on the Mac’s drive using your login password as the primary decryption key. Forgetting it is equivalent to losing the key to a physically locked vault. However, Apple provides two official bypass paths: the iCloud-based recovery key (Apple holds a copy, accessible via your Apple ID) and the local recovery key (a 24-character code shown once during setup that only you hold). If both are unavailable, the data is permanently inaccessible. No brute-force tool, no lab, no Apple escalation path can read the encrypted data without one of these two keys. Understanding which path is available to you determines your next step.
All recovery paths for a FileVault-locked Mac in India
Step 1: iCloud-based password reset via macOS Recovery
This is the most common successful path for Indian Mac users. At FileVault setup, you were asked whether to store the recovery key with Apple. If you chose “Allow my Apple ID to unlock my disk,” Apple holds an encrypted copy tied to your Apple ID. To use it: restart the Mac and hold the Power button (M-series) or Command+R (Intel) to enter macOS Recovery. You will see the Activate Mac screen. Sign in with your Apple ID and password. Apple verifies your identity and issues a temporary password reset, unlocking the FileVault volume. Crucially, this requires: (1) your Apple ID email, (2) your Apple ID password, and (3) access to a two-factor authentication (2FA) code via a trusted device or registered phone number. The 2FA SMS goes to the phone number registered with your Apple ID — ensure that number is still active before relying on this path. See our guide on iCloud account lockouts for the case where the Apple ID itself is also inaccessible.
Step 2: Using the local 24-character recovery key
If you chose “Create a recovery key and do not use my iCloud account” during FileVault setup, you received a unique 24-character key in the format XXXX-XXXX-XXXX-XXXX-XXXX-XXXX. This key is case-sensitive and unique to your Mac. In macOS Recovery, open Disk Utility, select the encrypted volume, and click Mount. The system will prompt for either the login password or the recovery key. Entering the recovery key allows the volume to be unlocked. Before concluding the key is lost, search systematically: your password manager (1Password, Bitwarden, Apple Keychain), email drafts or sent items (many users email it to themselves), printed notes near the Mac, a photo taken of the setup screen, an iCloud Note saved at setup time, or a USB drive used for secure document storage. The key was shown exactly once — the effort to find it is worth the time before concluding it is irretrievable.
Step 3: When both keys are unavailable — the last resort
If neither the iCloud Apple ID path nor the local recovery key is available, the only remaining legal and technically sound option is to erase the Mac. In macOS Recovery, choose “Erase Mac” (macOS Monterey and later) or use Disk Utility to erase the APFS volume, then reinstall macOS. This destroys the encrypted data permanently. The only data salvage path at this point is from an external backup: Time Machine (if you set up a backup drive) or iCloud (for files synced to iCloud Drive, Photos, and other iCloud services). For Indian users who did not maintain a separate backup, this is a permanent loss. We cannot overstate how much a ₹3,000–₹5,000 external drive and Time Machine setup would have prevented this outcome.
Step 4: The India angle — why this is more common here
Indian Mac users set up FileVault less consistently than Western users, partly because the default macOS setup wizard during initial Mac activation is often skipped quickly. Many users in India receive Macs as gifts or second-hand purchases and are not aware FileVault was enabled by the previous user. If you have a second-hand Mac that is locked, the situation is the same: the previous owner’s credentials are required, and their iCloud key path is inaccessible to you. The only option is to ask the previous owner to either unlock the Mac remotely or sign out of their Apple ID, which initiates an automated FileVault key refresh. Our data recovery service can diagnose whether the Mac has any hardware faults alongside the encryption lock, since sometimes what appears to be a password issue is actually a hardware fault that prevents the password prompt from appearing at all.