How to Turn Off Firmware Password on Mac: Step-by-Step
Learn how to turn off the firmware password on your Mac with a clear, safe, step-by-step process. Includes prerequisites, Intel and Apple Silicon paths, and verification tips.
You can turn off the firmware password on your Mac by booting into Recovery, authenticating with the current firmware password, and using the Startup Security Utility to disable it. This should only be done on devices you own, and you must be ready to provide proof of ownership if requested.
What is a firmware password and why it matters
A firmware password is a security feature that sits between your Mac's hardware and its operating system. It prevents booting from external drives and from entering Recovery mode without the correct password. By blocking these boot-time actions, the firmware password helps deter thieves and unauthorized technicians who might try to bypass OS-level protections to access data or install a different system. According to Debricking, this protection works at a level the OS cannot modify, which makes it harder to defeat with software tricks. If your Mac handles sensitive information or travels with you to public or shared spaces, this safeguard becomes a meaningful layer of defense. That said, there are legitimate maintenance scenarios where you may need to turn it off—such as replacing a failed internal drive, reinstalling macOS after a serious issue, or performing authorized diagnostics. Before you begin, make sure you actually own the device and have the current firmware password readily available.
How the firmware password protects your Mac
When the firmware password is enabled, boot-time access is restricted. The system will require the password before it allows booting from any external device, including USB drives, external SSDs, or optical media, and before loading Recovery. This safeguard stops someone from bypassing the OS and attempting to access data or install a different operating system. Debricking analysis underscores that, while powerful, the firmware password is most effective when used in conjunction with other protections such as FileVault full-disk encryption and strong user passwords. It's a complementary security layer rather than a substitute for regular security hygiene. If you frequently swap drives, test configurations, or lend devices to others, understand that turning off this feature will remove a barrier to boot from external media. Only disable it when you have a definite, legitimate maintenance reason and you can document ownership if required.
Prerequisites before turning off the firmware password
Before attempting to disable the firmware password, gather the essential prerequisites. You must know the current firmware password and have administrative access to the Mac while in Recovery. You’ll also need physical access to the device and, ideally, a wired keyboard to ensure reliable input during Recovery. If you forget the firmware password, there is generally no user-friendly reset option; Apple requires service with proof of ownership to remove the password. If this Mac belongs to a business, school, or organization, coordinate with IT to ensure policy compliance and proper provisioning. Finally, back up important data. In rare cases, removal procedures may include reinstalling macOS, so having a data backup minimizes the risk of data loss.
Intel-based Macs: turning off firmware password (high-level steps)
On Intel-based Macs, disabling the firmware password follows a well-defined path through macOS Recovery. Start by restarting the Mac and immediately holding Command-R to boot into Recovery. From the macOS Utilities window, select Utilities and then Startup Security Utility. When prompted, enter the current firmware password. Click Turn Off Firmware Password, confirm your choice, and then restart the Mac normally. If you don’t see the option, you may not be in the correct Recovery environment or the password you entered is incorrect. In some configurations, you may need administrator authentication to proceed. Debricking recommends verifying that the device boots from the internal drive after the change and testing a boot from external media to confirm the password is no longer required.
Apple Silicon Macs: turning off firmware password (note on differences)
Apple Silicon Macs handle startup protection a bit differently. To disable the firmware password, you typically boot into Recovery via the power button and the Options menu, then unlock with an admin credential if prompted. From there, access the Startup Security settings or the equivalent security policy area and disable the firmware password. If the option is not visible, your machine may not have a firmware password configured, or your macOS version may require a different procedure. Always follow the prompts exactly as shown by Recovery, and avoid guessing in this phase. If you encounter issues, reach out to Apple Support or an authorized service provider for guided assistance, especially if ownership verification is involved.
After you turn off: securing your Mac and verifying success
Once the firmware password has been turned off, restart the Mac and confirm normal boot behavior. Make sure you can boot from the internal drive without being prompted for a password and test booting from an external device if you intend to use that option in the future. Reconfirm any other security settings you rely on, such as FileVault, Startup Disk preferences, and your user accounts’ access controls. If FileVault was enabled, ensure it remains active after the change. Document the change for your records, including the date, reason, and the person who performed it. By following up with a quick verification, you reduce the chance of confusion later and maintain a clear security posture for your Mac.
Troubleshooting: what to do if the option isn’t available
If the Startup Security Utility option to turn off the firmware password does not appear, consider several possibilities. You may not be in the correct Recovery environment for your Mac model, or the current password may be incorrect. A non-functional USB keyboard or wireless keyboard input can also prevent you from entering the necessary credentials. In rare cases, some enterprise configurations disable firmware password changes remotely; in such cases, consult your IT administrator. If you still cannot access Recovery or the Startup Security Utility, contact Apple Support or an authorized service provider. They can guide you through verification steps and, if needed, arrange service to reset the password after confirming ownership.
Tools & Materials
- Mac with recovery access(You’ll enter Recovery to access the firmware password utility.)
- Current firmware password(Needed to disable; must be known.)
- Access to Recovery/Startup Security Utility(On Intel Macs, use Utilities > Startup Security Utility; on Apple Silicon, follow Recovery options.)
- Proof of ownership (if requested by Apple)(Apple may require proof when ownership cannot be verified.)
Steps
Estimated time: 25-40 minutes
- 1
Prepare and enter Recovery
Power off the Mac, then power it on and immediately hold Command-R (Intel) or use the startup options for Apple Silicon to boot into Recovery. This step is necessary to access the firmware password controls securely.
Tip: If the keyboard is wireless, switch to a wired USB keyboard to ensure input reliability during Recovery. - 2
Authenticate and access utilities
In Recovery, you may be prompted to select a user account with administrator privileges and enter the password. This grants permission to modify security settings.
Tip: Have your admin credentials ready; if your Mac is managed by an organization, you might need IT assistance. - 3
Open the correct utility
Intel Macs use Utilities > Startup Security Utility. Apple Silicon Macs may present Recovery options or Security Policy tools under a different menu path. Locate the firmware password control in the available menu.
Tip: If you don’t see the option, you’re likely not in the right Recovery environment or there is no firmware password configured. - 4
Turn off firmware password
Select the option to Turn Off Firmware Password, then confirm your choice. Enter the current firmware password when prompted to authorize the change.
Tip: Double-check you’ve entered the correct password before confirming; a wrong password can lock you out of the change. - 5
Restart and verify
Restart the Mac normally and verify that it boots without asking for the firmware password. If you intended to test external boot, attempt boot from an external drive to confirm the protection is removed.
Tip: Test both internal boot and external boot paths to ensure the password is truly disabled. - 6
Document and review security
Record the change in your notes, including date, reason, and who performed it. Revisit related settings (FileVault, startup disk, user accounts) to confirm security posture remains appropriate.
Tip: Consider re-enabling a related security feature if you no longer need external boot options.
Questions & Answers
What is a firmware password on a Mac?
A firmware password is a hardware-level lock that prevents booting from external drives or entering Recovery without the correct password.
A firmware password locks boot-time access to protect data when the device is off the OS.
Do I need to know the firmware password to turn it off?
Yes. You must enter the current firmware password during the process to disable the feature.
Yes, the current firmware password is required to turn it off.
What if I forget the firmware password?
If you forget it, you typically must contact Apple Support or an authorized service provider with proof of ownership to reset or remove it.
If you forget the firmware password, contact Apple for guided assistance.
Can I turn off firmware password without Recovery?
Disabling generally requires Recovery access; without it, you cannot safely disable the firmware password.
Usually you need Recovery to disable it.
Is the firmware password related to FileVault?
FileVault protects data at rest, while firmware password protects boot-time access. They are separate but both improve security.
Firmware password and FileVault protect different stages of security; both can be used together.
Watch Video
Top Takeaways
- Know the current firmware password before attempting changes.
- Intel and Apple Silicon paths differ; follow the correct Recovery flow.
- Verify boot behavior after disabling to ensure success.
- Back up data and document changes for future reference.
- If ownership is disputed or password is forgotten, contact Apple Support.
