Overview

When FileVault is enabled on macOS, the password used at the FileVault pre-boot login screen must stay synchronized with the user’s macOS account password.

In some environments, especially those using:

Active Directory (AD)
Platform SSO
Cloud identity providers
Administrator-initiated password resets

The FileVault password and macOS login password can become out of sync.

This article explains:

How password synchronization normally works
How to resynchronize passwords when they become mismatched
Advanced recovery steps when automatic synchronization fails

Understanding FileVault Password Synchronization

FileVault uses a pre-boot authentication system to unlock the encrypted disk before macOS loads.

Because of this:

FileVault stores its own unlock credentials
macOS user authentication occurs afterward

Normally, changing a password while logged into macOS automatically updates both:

The macOS account password
The FileVault unlock password

However, password changes performed externally may not synchronize automatically.

Common causes include:

Password resets from Active Directory
Password changes from another device
Identity provider password resets
Account migrations or token issues

Method 1: Change Password While Logged In (Recommended)

This is the recommended approach for FileVault-enabled Macs.

If your organization manages macOS devices with Swif, users should change their password:

Directly within the logged-in macOS session
Or through password workflows initiated by Swif

Changing the password while logged into macOS allows the system to automatically synchronize:

The macOS account password
The FileVault pre-boot unlock password

This helps prevent FileVault password desynchronization issues.

This method is most effective when:

The user knows their current password
The account is properly synchronized
The device has a valid Secure Token

Steps

Log into the Mac using the current credentials.
Open:
- System Settings → Users & Groups
On older macOS versions:
- System Preferences → Users & Groups
Click Change Password.
If prompted:
- Click the padlock icon
- Enter administrator credentials
Enter:
- Current password
- New password
- Confirm new password
Click Change Password.
Restart the Mac.
Verify the new password works at the FileVault pre-boot login screen.

Why This Works

When the password is changed from within the active macOS session, including through Swif-managed password workflows:

macOS updates the local account credentials
FileVault synchronization occurs automatically
Secure Token associations remain intact

This is the preferred workflow for managed enterprise environments.

Method 2: Resynchronize an Out-of-Sync Password

If the password was changed externally, FileVault may still require the old password at startup.

In this scenario:

The old password unlocks FileVault
The new password logs into macOS

This is temporary and can often be corrected automatically.

Steps

1. Unlock FileVault Using the Old Password

After rebooting:

Enter the old password at the FileVault login screen

This unlocks the encrypted disk.

2. Wait for macOS Login

After the progress bar completes:

The standard macOS login window will appear

3. Log Into macOS Using the New Password

At the macOS login screen:

Enter the new password

4. Lock and Unlock the Mac

Immediately:

Open the Apple menu
Click Lock Screen
Unlock the Mac using the new password

This often triggers password synchronization.

5. Restart and Test

Restart the Mac again.

You should now be able to:

Use only the new password at the FileVault login screen
Avoid the dual-password workflow

Notes

This issue is common in Active Directory and federated identity environments.
The old password is only required because FileVault has not yet synchronized its unlock credentials.
Synchronization may occur automatically after login or unlock events.

Method 3: Manual FileVault Password Resynchronization (Advanced)

In rare cases, automatic synchronization may fail.

This method manually updates the FileVault unlock credentials using Terminal commands.

Administrator access is required.

Step 1: Open Terminal

Open Terminal from:

/Applications/Utilities

Step 2: Verify Secure Token Status

Run:

sysadminctl -secureTokenStatus username

Replace:

username

with the affected user’s short username.

Expected output:

Secure token is ENABLED for user username

Step 3: Enable Secure Token (If Needed)

If Secure Token is not enabled:

sysadminctl -secureTokenOn username -password password

The user will be prompted to enter credentials.

Step 4: Retrieve the User UUID

Run:

sudo fdesetup list | grep username

Example output:

USER,27E97FDA-252E-1D28-97E2-E11278DB2D21

Copy the UUID value.

Step 5: Identify the Encrypted APFS Volume

Run:

diskutil list | grep Data

Example output:

5: APFS Volume Data 306.4 GB disk3s5

Copy the volume identifier:

disk3s5

Step 6: Resynchronize the FileVault Password

Run:

sudo diskutil apfs changePassphrase IDENTIFIER -user UUID

Replace:

IDENTIFIER with the APFS volume identifier
UUID with the user UUID

Example:

sudo diskutil apfs changePassphrase disk3s5 -user 27E97FDA-252E-1D28-97E2-E11278DB2D21

The user will be prompted for:

The old password
The new password
Confirmation of the new password

Step 7: Reboot and Verify

Restart the Mac and confirm:

Only the new password is required
FileVault unlock and macOS login are synchronized

Troubleshooting

User Does Not Appear at FileVault Login

Check:

Secure Token status
FileVault authorization
Local account availability

Secure Token Is Missing

Without Secure Token:

The user cannot unlock FileVault
Password synchronization may fail

Verify using:

sysadminctl -secureTokenStatus username

User Must Enter Two Passwords Repeatedly

If the issue persists:

Repeat Method 2
Or perform Method 3 manual synchronization

Security & Compliance Impact

Maintaining synchronized FileVault credentials helps:

Prevent login failures after password changes
Ensure encrypted devices remain accessible to authorized users
Reduce support overhead in enterprise environments
Maintain compliance with encryption requirements for frameworks such as:
- SOC 2
- ISO 27001
- HIPAA
- NIST