Set a firmware password on your Mac
When you set a firmware password, users who don't have the password can't start up from macOS Recovery or any disk other than the designated startup disk.
This feature requires a Mac with an Intel processor. For the equivalent level of security on a Mac with Apple silicon, simply turn on FileVault. If the Mac is managed by MDM (mobile device management), the MDM administrator can also remotely lock the Mac.
How to turn on a firmware password
Start up from macOS Recovery. Then return to this article and continue to the next step.
From the menu bar at the top of the screen in Recovery, choose Utilities > Startup Security Utility (or Firmware Password Utility).
Enter your administrator password when prompted. This is the password you use to log in to your Mac.
Click Turn On Firmware Password, then enter a firmware password. Remember this password!
Quit the utility, then choose Apple menu > Restart.
When using a firmware password, your Mac requires the firmware password in these circumstances:
When attempting to start up from a storage device other than the one selected in Startup Disk settings.
When attempting to start up from macOS Recovery.
When attempting to use the Erase All Content and Settings feature (Mac with Apple T2 Security Chip).
Enter the firmware password when you see the lock and password field at startup:
How to turn off a firmware password
Follow the steps to start up from macOS Recovery. Before your Mac can finish starting up from Recovery, it will show the lock screen pictured above. Enter the firmware password. Forgot the password?
After your Mac finishes starting up from Recovery, choose Utilities > Startup Security Utility (or Firmware Password Utility) from the menu bar at the top of the screen.
Click Turn Off Firmware Password, then enter the firmware password again.
Quit the utility, then choose Apple menu > Restart.
If you forgot the firmware password
If you can't remember your firmware password, schedule an in-person service appointment with an Apple Store or Apple Authorized Service Provider. Bring your Mac and its original receipt or invoice as proof of purchase.
