How to manage FileVault recovery keys

In an age where data breaches and digital espionage make headlines daily, encrypting your device is no longer optional—it’s essential. On macOS, FileVault stands as a guardian of user data, encrypting entire disks to prevent unauthorized access. But with great encryption comes a great responsibility: recovery key management.
This blog explores what FileVault is, why recovery keys matter, and how to manage those keys effectively—particularly at scale with Hexnode.

What is file encryption?

File encryption is the process of converting data into a code to prevent unauthorized access. When a file is encrypted, its original content becomes unreadable gibberish unless decrypted using a key or password.

On macOS, FileVault is Apple’s native full-disk encryption tool. It uses XTS-AES-128 encryption with a 256-bit key to protect data stored on a Mac’s startup disk. The goal? Ensure that if a Mac falls into the wrong hands, its data remains indecipherable.

But encryption is a double-edged sword. If the password or decryption key is forgotten, even authorized users are locked out. To counter that, Apple provides the option to generate a recovery key—a kind of master password that can unlock the device if the user password is lost.

Understanding FileVault and the recovery key

What exactly does FileVault do?

When FileVault is enabled, it encrypts the entire content of your disk. This means that the operating system, your documents, your applications—everything—is protected. The encryption kicks in the moment your Mac is turned off or restarted. When you log in, macOS uses your credentials to decrypt the disk on the fly, giving you seamless access.

In unmanaged devices, users can enable FileVault via System Settings > Privacy & Security > FileVault, but in organizations where hundreds or thousands of Macs are deployed, this needs to be automated—and that’s where MDM platforms like Hexnode come into play.

So, what is a FileVault Recovery Key?

A FileVault Recovery Key (FRK) is a unique alphanumeric string created during the encryption process. It acts as a fallback method in case the main user password is forgotten. Think of it as a lifeboat for your data. Without it (or the password), your encrypted disk is practically unrecoverable.

Recovery keys are especially critical in enterprise environments where devices are shared or managed centrally. That’s why they must be properly created, securely stored, and—most importantly—easily accessible to authorized IT personnel if disaster strikes.

Why is managing the recovery key so important?

If you lose both your login credentials and the recovery key, there’s no way to access your encrypted data. That’s not just a personal inconvenience—it can be a business disaster.

From lost productivity and IT costs to regulatory penalties for data inaccessibility, the stakes are high. Properly managing recovery keys ensures business continuity, data recovery, and security compliance. And when recovery keys are involved, central management is the gold standard.

Featured resource

Download A Complete Guide to Mac Device Management

Hexnode UEM simplifies Mac management for growing businesses (SMBs/enterprises), securing devices for BYOD and remote work against unauthorized access.

Download the White paper

Types of FileVault recovery keys

FileVault offers three models of recovery key strategies:

1. Institutional Recovery Key (IRK)
2. Personal Recovery Key (PRK)
3. A hybrid of both IRK and PRK

Let’s break them down one by one.

Institutional Recovery Key (IRK)

Institutional Recovery Keys (IRKs) are typically used by organizations that prefer a centralized decryption method across all managed Macs. If a user forgets their login password, the IRK serves as a backup unlock method. To maintain security, the IRK certificate must be password-protected and securely managed. One key benefit of this approach is that if the original key becomes inaccessible or damaged, a new certificate-based key can be downloaded again from the MDM portal, ensuring continued access without compromising control.

Data encryption: A beginner’s guide

How it works

The Institutional Recovery Key approach is designed for organizations that require a common key to decrypt all their devices. In this model:

• A certificate with a public key is generated by IT.
• This certificate is uploaded to the MDM (like Hexnode) and applied to all managed devices.
• During FileVault setup, the Mac encrypts the recovery key using the certificate’s public key.

This ensures that only someone with the matching private key can decrypt and access the recovery key.

Decrypting with an Institutional Recovery Key

When recovery is needed (e.g., an employee forgets their password), the IT admin:

1. Downloads the encrypted recovery key from the MDM portal.
2. Uses the private key stored in their certificate management system.
3. Decrypts the key locally and uses it to unlock the Mac.

Benefits and best use cases

• Centralized control: One key to manage multiple devices.
• No user interaction needed: Silent and scalable.
• Perfect for large-scale deployments.

But be warned—if the private key is lost or compromised, all dependent recovery keys are useless or at risk.

Personal Recovery Key (PRK)

Personal Recovery Keys (PRKs) are unique alphanumeric codes generated during the FileVault encryption process. Each PRK is specific to the individual Mac it’s created for and is displayed to the user before encryption begins. Since it isn’t automatically stored by macOS, it’s crucial for users to record it safely. However, with solutions like Hexnode, you can securely escrow the PRK during deployment—allowing IT administrators to retrieve it later in case the key is lost, ensuring recoverability.

How it works

The Personal Recovery Key is a unique key created per device. Unlike the IRK, this is:

• Tied to the specific Mac.
• Not shared across devices.
• Randomly generated and user-visible during FileVault activation.

Hexnode can escrow this key automatically, storing it in a secure location where admins can retrieve it later.

Decrypting with a Personal Recovery Key

If a user forgets their login credentials:

• They can enter the PRK at the FileVault login screen.
• IT can retrieve the PRK from Hexnode and share it with the user (after proper identity verification, of course).

Benefits and best use cases

• Higher security granularity: Each Mac has its own key.
• Ideal for BYOD: Since the PRK is user-visible, it’s suitable for personal devices.
• Minimizes risk of mass key compromise.

However, users might fail to store their PRK securely, so MDM-based key escrow becomes essential.

What is device encryption and why do you need it?

Institutional and Personal Recovery Key (Hybrid)

How it works

Why choose one when you can have both?
This is the recommended method. In this method, an institutional recovery key as well as a personal recovery key will be generated for the user. The advantage of this method is that, in the event of your personal recovery key being lost, you can still use the institutional recovery to decrypt your device.

In this hybrid model:

• The organization applies an IRK to each device.
• Simultaneously, a PRK is generated per device and escrowed.

This gives IT admins two lifelines:

• Use the PRK if the user forgets their password.
• Use the IRK if the PRK is lost or user unavailable.

Decrypting with both

• First line of recovery: PRK (retrieved from Hexnode).
• Backup option: Decrypt PRK using IRK’s private key.

Benefits and best use cases

• Redundancy and resilience.
• Perfect for high-security environments (e.g., finance, defense, R&D).
• Ensures continuity even in worst-case scenarios.

This method reflects the highest standard of data protection—especially when paired with strong key lifecycle management.

Android Device Encryption vs iOS Device Encryption: A Comprehensive Comparison

Escrowing Personal Recovery Keys

Escrowing refers to the secure storage of personal recovery keys in a trusted location. This is critical in organizations because:

• Users may forget or misplace their PRK.
• IT must be able to recover data during emergencies.
• Manual tracking is prone to failure.

How Hexnode handles PRK escrow

When FileVault is enabled via Hexnode’s policy, the PRK is generated silently during encryption and Hexnode automatically captures the PRK and stores it securely within the portal.

Conclusion

FileVault is one of the most powerful tools in Apple’s security arsenal—but only when paired with robust recovery key management. Whether you’re overseeing ten devices or ten thousand, losing access to a single encrypted Mac can mean losing critical data, incurring costly downtime, or worse—facing compliance violations.

MDM solutions like Hexnode are essential for this reason. With Hexnode, you can:

• Automate FileVault deployment across your organization.
• Choose between Institutional, Personal, or Hybrid recovery key models.
• Automatically escrow PRKs and manage IRKs with ease.
• Rotate certificates, retrieve keys, and recover devices—all from a unified portal.

In short, Hexnode makes the complexity of FileVault recovery key management not just manageable—but effortless.

So lock your digital vaults tight—but never lose the key.