Set a firmware password on your Mac

When you set a firmware password, users who don't have the password can't start up from any disk other than the designated startup disk.

This feature requires a Mac with an Intel processor. For the equivalent level of security on a Mac with Apple silicon, simply turn on FileVault. If the Mac is managed by MDM (mobile device management), MDM administrators can also remotely lock the Mac.

How to turn on a firmware password

  1. Turn on your Mac, then press and hold Command-R to start up from macOS Recovery. (Learn what to do if you can’t start up from macOS Recovery.)

  2. When the utilities window appears, click Utilities in the menu bar, then choose Startup Security Utility (or Firmware Password Utility).

  3. Enter your administrator password when prompted. This is the password you use to log in to your Mac.

  4. Click Turn On Firmware Password. Remember this password!

  5. Quit the utility, then choose Apple menu  > Restart.

Your Mac asks for the firmware password only when attempting to start up from a storage device other than the one selected in Startup Disk settings, or when starting up from macOS Recovery. Enter the firmware password when you see the lock and password field at startup:

Firmware password screen

How to turn off a firmware password

  1. Turn on your Mac, then press and hold Command-R to start up from macOS Recovery. (Learn what to do if you can’t start up from macOS Recovery.)

  2. When the utilities window appears, click Utilities in the menu bar, then choose Startup Security Utility (or Firmware Password Utility).

  3. Enter your administrator password when prompted. This is the password you use to log in to your Mac.

  4. Click Turn Off Firmware Password.

  5. Enter the firmware password again, if prompted.

  6. Quit the utility, then choose Apple menu  > Restart.

If you forgot your firmware password

If you can't remember your firmware password, schedule an in-person service appointment with an Apple Store or Apple Authorized Service Provider. Bring your Mac to the appointment, and bring your original receipt or invoice as proof of purchase.

Published Date: