FileVault vs the lock screen: what actually protects an unattended Mac

The short answer

FileVault and the lock screen are not alternatives. They protect your Mac against two different threats, and you want both switched on. FileVault encrypts your startup disk, so that when the Mac is powered off nobody can read your data without your login password. The lock screen protects your live session: while the Mac is on and logged in, it puts the login window in front of your work so that someone who walks up to an unattended desk cannot use it. The common mistake is assuming FileVault keeps an unlocked, running Mac safe. It does not. Once you have logged in, your disk is unlocked and your data is readable by the running system, so the only thing standing between an unattended Mac and the person who sits down at it is the lock screen. Making that lock engage reliably, the moment you leave, is the part most people get wrong. Choosing between the three things you actually do when you leave, locking, logging out, or shutting the Mac down, is covered in the guide on whether to lock, log out or shut down your Mac.

What FileVault actually protects

FileVault is the built-in disk encryption in macOS. You turn it on in System Settings, under Privacy & Security, then FileVault. Apple describes it as a way to secure all data at rest, and that phrase is the key to understanding it. "At rest" means the data sitting on a powered-off drive. With FileVault on, your startup disk is encrypted, and the data cannot be decrypted or read without entering your login password at startup.

On a Mac with Apple silicon or a T2 chip, the internal storage is always encrypted by the hardware. What FileVault adds is the requirement that your password is part of the key. With FileVault on, the volume key is protected by a combination of your password and the chip's hardware identifier, so a thief who removes the drive or boots the Mac cannot get in without your password. With FileVault off, the same hardware encryption is in place, but the key is protected by the hardware alone, which is weaker against someone who has the machine in hand.

The scenario FileVault defends against is a lost or stolen Mac, or a drive pulled out and read on another computer. For that scenario it is excellent, and you should have it on. It pairs naturally with the ability to lock a lost or stolen Mac remotely with Find My, which handles the device while FileVault handles the data.

What the lock screen protects

The lock screen addresses a completely different moment: the Mac is on, you are logged in, and you step away. While the Mac is running and logged in, the disk is unlocked. Your files, mail, messages, browser sessions and saved passwords are all readable by the running system, because you already entered your password when you logged in. For this session, FileVault's job is done.

Locking the screen does not re-encrypt anything. It places the login window in front of a live, unlocked session, so that someone has to authenticate before they can interact with it. That is exactly the protection you want when you leave your desk for a few minutes: the work keeps running, but nobody can read it or touch it without your password. For that barrier to mean anything, you need "Require password after screen saver begins or display is turned off" set to "immediately" in System Settings, under Lock Screen. Without it, the screen can darken while the Mac stays unlocked, and a tap of any key gets straight back in. The settings that govern this, and the various ways to lock on demand, are covered in why your Mac is not locking automatically and how to lock your Mac screen.

The misconception that leaves a Mac exposed

Put the two together and the common error becomes clear. "I have FileVault on, so my Mac is secure" is true for the powered-off case and false for the unattended-desk case. They are different threats:

• A powered-off Mac is protected by FileVault. Without your login password, the disk is encrypted and unreadable.
• An unattended Mac that is on and unlocked is protected by nothing. Anyone who walks up has your full, logged-in session, regardless of whether FileVault is on, because the disk is already unlocked.

FileVault cannot help with the second case, because by the time you are working you have already supplied the password that unlocks the volume. The protection for a running session is the lock screen, and only the lock screen.

So is a locked Mac secure?

For everyday purposes, yes. A Mac that is locked, with the password requirement set to immediately, stops the casual and opportunistic access that an unattended desk actually exposes you to: a passer-by, a curious colleague, someone at the next table in a cafe. It is the right protection for stepping away to a meeting, the kitchen, or the bathroom, and it is the habit that matters most at a shared desk or open office.

What a locked screen does not do is re-encrypt the disk or defend against a determined attacker who has physical possession of the machine and time to work on it. That is a different and much rarer threat, and it is where full-disk encryption, a strong password, and keeping the Mac with you all matter. For the common case, though, the question that matters is not whether the lock is strong enough. It is whether the lock is actually on when you are not there.

Use both, and make the lock reliable

The honest summary is that FileVault and the lock screen are complementary, and you want both. FileVault for when the Mac is off, the lock screen for when it is on and you have stepped away. The weak point is rarely FileVault, which simply stays on once enabled. The weak point is the lock screen, because macOS locks on an inactivity timer rather than when you actually leave. Set the timer short and it nags you while you are still reading or on a call; set it long and your Mac sits unlocked for minutes after you have gone. That tradeoff is the subject of when a Mac locks too fast, and it is the gap presence-based locking is built to close.

This is what Peeku does when you walk away. It watches whether you are actually at your desk and locks the screen the moment you leave, using three signals that all stay on your Mac:

• Face presence from the built-in camera, analysed locally with Apple's Vision framework. No image or video leaves the Mac, and it checks whether a face is present, not who it is.
• An optional Apple Watch proximity gate over Bluetooth, so it only locks when both the camera and the Watch agree you have gone.
• Keyboard and mouse idle time, so a brief pause to read or think does not trigger a lock.

Two honest points. Peeku does not encrypt your disk; that is FileVault's job, and you should keep FileVault on. What Peeku does is make sure the lock screen, the protection for your running session, actually engages when you leave, instead of waiting on a timer or your memory. All of this runs on-device, which is the reasoning behind Peeku's privacy-first design. And the full locking app ships free outside the Mac App Store, on Gumroad and as a notarised DMG, because the App Store sandbox blocks the screen-lock calls it relies on; it also needs the same "Require password immediately" setting to make its lock secure. The two-minute setup guide covers the whole sequence.

Quick reference

• FileVault encrypts your startup disk for when the Mac is powered off or stolen. Turn it on in System Settings, Privacy & Security, FileVault.
• The lock screen protects your live, logged-in session when you step away. It does not re-encrypt the disk; it puts the login window in front of an unlocked session.
• "I have FileVault, so I am safe" is only half true. An unlocked, running Mac is exposed no matter what, because the disk is already unlocked.
• Set "Require password immediately", or a dark screen is not a locked screen.
• Use both. FileVault for the powered-off drive, the lock screen for the running session.
• Make the lock reliable. Presence-based locking engages the moment you walk away, instead of waiting on a timer.