This tutorial shows you how to set a firmware password on your Mac to further increase the security of your computer.
If your Mac is used by others, you should upgrade your security to prevent it from starting up from storage devices other than a designated startup disk.
Thankfully, you can easily do this by setting a firmware password on your computer. This will ensure that no one can boot your Mac using a bootable external drive, CD/DVD or USB thumb drive with a usable copy of the operating system on it.
As a nice bonus, no one will be able to mess with your Mac using macOS’ built-in recovery tools without knowing the firmware password.
Before we get to it, keep in mind that you cannot reset a forgotten firmware password.
Therefore, write down your firmware password and keep it in safe place. If you forget it, you will need to schedule a service appointment with an Apple Retail Store or Apple Authorized Service Provider to unlock your computer. They will ask for proof of purchase like the original receipt or invoice to ensure the computer is actually yours and not stolen!
Supported Macs
You can set a firmware password on the following models of Mac with an Intel processor:
- MacBook Air (Late 2010 and later)
- MacBook Pro (Early 2011 and later)
- MacBook Pro with Retina display (all models)
- MacBook (Retina, 12-inch, Early 2015)
- iMac (Mid 2011 and later)
- Mac mini (Mid 2011 and later)
- Mac Pro (Late 2013 and later)
If your Mac isn’t listed, protect yourself by creating a user account password to prevent others from logging in and enable full disk encryption with FileVault.
Do your have a Mac with Apple silicon?
You do not need to follow the steps mentioned below on your Mac with an M1, M2, M3, or other Apple silicon chip. All you need to do is enable FileVault to get equivalent protection on Apple silicon Macs. To do that:
- Go to System Settings and select Privacy & Security.
- Scroll down, click FileVault, and turn it on.
- You can then choose to allow your iCloud account to unlock the disk or create a recovery key which you will have to keep safe.
How to set a Mac firmware password
1) Click the Apple icon  and choose Restart, or power on your Mac.
2) As your computer restarts, hold down the Command + R combination right after hearing the startup chime and hold the keys until the Apple logo appears.
Tip: If you own a Mac notebook, press the built-in keys because a wireless keyboard may not register keystrokes at boot time.
3) The macOS Utilities window should appear after a few minutes. Don’t click any options in the window and instead choose Startup Security Utility or Firmware Password Utility from the Utilities menu.
4) You should now see the Firmware Utility window. Click the Turn On Firmware Password option to proceed.
5) Type in a desired firmware password, and re-enter it in the Verify field.
6) Confirm your choice by clicking the Set Password button.
7) Click Quit Firmware Utility to close the window.
8) Click the Apple icon and choose Restart.
Now when you Mac starts up, your firmware password will be active.
Turning off or changing firmware password
To turn off your Mac firmware password or change it, just boot into macOS’ Recovery Mode by following the instructions above. Then, choose Startup Security Utility or Firmware Password Utility from the Utilities menu and click Turn Off Firmware Password to disable it or Change Password to change your Mac’s firmware password.
Starting up the Mac protected with a firmware password
Your Mac will start up normally from its startup disk and you will be presented with the usual login window where you enter your user account password. As mentioned, a firmware password gives you another layer of security, preventing anyone from booting the computer from any other disk other than your designated startup disk.
If you attempt to boot your computer from a USB thumb drive or an external disk, your Mac will display a lock icon with a field to enter the firmware password.
Click the password field, enter the firmware password and press Return to unlock your Mac and continue starting up the computer from a non-startup disk.
Firmware-based passcode lock and Find My Mac
Also worth mentioning, enabling the Find My Mac feature in System Settings > Apple ID > iCloud > Show More Apps > Find My Mac or System Preferences > iCloud > Find My Mac and then locking your Mac remotely in the free Find My iPhone app will basically set a firmware-based passcode, which will work to your advantage by preventing unauthorized people from starting up the computer.
To unlock your Mac that has been locked from the Find My Mac app, enter the four or six-digit lock passcode you created. Make sure to write down the Find My Mac lock passcode. Locking the computer through the Find My Mac app sets a firmware-based password, so forgetting it will require you to schedule a service appointment with Apple.
Troubleshooting your Mac in Recovery Mode
Recovery Mode and Internet Recovery give you access to macOS’ built-in recovery tools which permit you to perform these maintenance and troubleshooting tasks: