vBoxx
    Back to help center
    Security, firewalls and encryption

    Should I enable FileVault on my hosted Mac?

    Why FileVault usually causes more downtime than security on a remote Mac, and when it can still make sense.

    5 min read

    Short answer

    Don't enable FileVault on a vBoxx Mac unless you are running an Apple silicon Mac on macOS Tahoe (26) or later with SSH already working. In every other case, an encrypted disk image is the better tool.

    What FileVault actually does to a server

    FileVault adds a password prompt at boot. Until that password is typed in, macOS doesn't start. On a Mac sitting in a rack with no monitor, that means:

    • macOS Sequoia (15) and earlier: no SSH, no VNC, no ARD at the FileVault screen. The Mac is fully unreachable until somebody walks up to it physically. Recovering means giving us your password and waiting for a hands-on visit in Amsterdam, Naaldwijk or Frankfurt.
    • macOS Tahoe (26), Apple silicon: Apple finally ships SSH at the pre-boot screen, so you can unlock from a laptop. Better, but the Mac still does not boot on its own. After every kernel panic, power blip or planned reboot, it sits idle until a human reconnects.

    How to unlock FileVault over SSH (Tahoe + Apple silicon)

    Treat this as experimental. Only do it if you can tolerate longer recovery windows after unexpected reboots.

    Requirements:

    • Apple silicon (M4)
    • macOS Tahoe 26.0+
    • SSH (Remote Login) already enabled and reachable on a public IP
    • A FileVault recovery key or admin password you control

    Workflow after a reboot:

    ssh -p 22 youruser@your.server.ip   # connects to the FileVault unlock shell
fdesetup authrestart                # unlock and continue boot

    If you skip this for any reason, the Mac stays at the FileVault prompt forever. Set up monitoring so you actually notice.

    What we recommend instead

    For almost every hosting workload, an encrypted sparse bundle mounted at login gives you data-at-rest protection while the server is running, without breaking unattended reboots. See Encrypting data on your hosted Mac.