>

Rotate the FileVault Personal Recovery Key with fdesetup

fdesetup changerecovery -personal generates a new personal recovery key and invalidates the old one, without decrypting the disk.

macOSrecoveryfdesetupfilevaultMedium risk
Run `sudo fdesetup changerecovery -personal` and copy the new key immediately — the old key stops working.

01Command

Command
$ sudo fdesetup changerecovery -personal

02What it does

A personal recovery key is the fallback that unlocks an encrypted volume when no authorized user password works, so rotating it is the right move if it was ever exposed in a screenshot, ticket, or spreadsheet. The command prompts for credentials of an enabled FileVault user, prints the new 24-character key once, and never shows it again — store it before closing the terminal. Encryption itself is untouched, so the operation takes seconds.

03Risk

RiskMedium risk
Requirementssudo (admin account); an authorized FileVault user must authenticate
!Warning: The new key is displayed exactly once — losing it means only enabled user passwords can unlock the volume.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • fdesetup(8) — macOS man page
    Xcode Man Pages (mirror) · technical · 2026-09-17
    Evidence: Documents `fdesetup changerecovery -personal` to replace the personal recovery key and related -key options.

Last verified: 2026-09-17 · Category: Security & Privacy

06Related solutions

Read and Clear NVRAM Firmware Variables
macOSnvramrecoveryboot

Inspect boot-args and other firmware settings stored in non-volatile RAM from the Terminal.

Low risk ✓ 2026-09-17