macOS has many different levels of security from the basic login password to sophisticated features like Gatekeeper and XProtect. One of the lesser-known security features is the ability to set a firmware password. In this article, we’ll tell you everything you need to know about the feature, including how to turn on and turn off firmware password on your Mac.

What is a firmware password?

A firmware password prevents anyone who doesn’t have the password from starting up the Mac on which the firmware password is set in recovery mode. In fact, the only disk that anyone without the password can boot from is the designated startup disk. It’s designed to prevent anyone who isn’t authorized to do so from making changes to your Mac, like reinstalling macOS or changing deep-level security settings. Firmware passwords can only be set on Intel-based Macs. On Macs with Apple silicon, an equivalent level of security can be achieved by turning on FileVault. We’ll show you how to do both.

Why use a firmware password?

There are a number of reasons why you might want to use a firmware password:

  • If you have a Mac that is used by several different people or run a business, you may not want them to have access to recovery mode.
  • If your Mac is stolen, having a firmware password also makes it more difficult for the thief to wipe your data and reinstall macOS.

How to turn on a firmware password

To turn on a firmware password, you first need to boot your Mac into recovery mode:

  1. Shut down the Mac.
  2. Press and hold Command-R and then press the power button.
  3. Release Command-R when you see the Apple logo.
  4. Wait for macOS Utilities to appear on the screen.

Then, follow these steps:

  1. Click the Utilities menu at the top of the screen.
  2. Choose Startup Security Utility (or Firmware Password Utility).

  3. Type in your admin password.
  4. Click Turn on Firmware Password and type in a password — make sure you remember it.

  5. Close the utility and restart your Mac normally.

Once you have restarted your Mac, the firmware password will be active, and you will need to type it in if you want to boot your Mac into recovery mode or boot it from an external disk. Follow the steps below if you want to turn it off again.

How to turn off firmware password on Mac

  1. Shut down your Mac and boot into recovery mode following the steps above.
  2. When you see the screen with a padlock on it, type in the firmware password and press Return.
  3. When macOS Utilities appears, click the Utilities menu and choose Startup Security Utility or Firmware Password Utility.
  4. Type in your admin password (not the firmware password) if you are asked to.
  5. Choose Turn Off Firmware Password and type in your firmware password.
  6. Close the utility and reboot normally.

How to turn on FileVault on Macs with Apple silicon

When you turn on FileVault, you will be asked how you want to unlock your startup disk if you ever forget your password. You can choose from two options:

  • Your iCloud account and password
  • A recovery key — a string of letters and numbers that are created for you

You will need to store the recovery key somewhere safe, preferably in a different location from your Mac. If you forget it and forget your login password while FileVault is turned on, you won’t be able to access your Mac or your files.

Here’s how to turn on FileVault:

  1. Click the Apple menu and choose System Settings > Privacy & Security.
  2. Scroll down to FileVault and select it.
  3. Click Turn On, select one of two options, and click Continue. You may need to create a recovery key at this step.
  4. Wait for the encryption to end.
  5. Quit System Settings.

How to protect your Mac and keep it running smoothly

Using a firmware password is one way to protect your Mac. However, there are lots of other steps you can take to both improve security and keep your Mac running smoothly. You should scan for malware, keep applications updated, clear out clutter and junk files, and review login and background items.

Doing all that manually is time-consuming and not much fun. And in the case of scanning for malware, you need a specialist app. There is, though, one tool that can take care of all those tasks for you, including protection against malware — CleanMyMac’s Smart Care feature.

It scans your Mac for malware, junk files, clutter, and application updates. It also recommends ways to maintain your computer. Once it’s done, which takes only a minute or two, it displays what it has found in an easy-to-read dashboard, and you can then choose what action to take.

If it has found malware, you can eliminate it in a click. Junk files? Click Review to see them or just click Run in the main window to eliminate all malware, junk, and clutter, update applications, and run maintenance tasks. It couldn’t be easier. Start your free CleanMyMac trial.

By setting a firmware password on your Mac, you can prevent anyone who doesn’t have that password from booting your Mac into recovery mode and reinstalling macOS, altering security settings, or restoring from Time Machine. It will also prevent them from booting from an external disk. But remember that important as it is, firmware is not the only security measure to be taken.