Macaron
← Blog

How to unlock FileVault remotely after a power cut

· Macaron

You are away from home. The power flickers for two seconds. Your Mac mini restarts on its own, as you told it to, and then stops at the FileVault screen, waiting for a password nobody is there to type.

Until someone types it, nothing runs. Not your server, not your AI agent, not Tailscale, not Screen Sharing. They all live inside macOS, and macOS has not started yet.

This post explains why that happens, what your options are, and how to unlock FileVault remotely with nothing more than SSH and a VPN. Most of it works without buying anything.

Why a Mac with FileVault stops after a restart

FileVault encrypts your startup disk. When the Mac boots, the disk is locked, and macOS can’t read its own system settings, your apps or your home folder until someone gives it a password.

So the Mac shows a pre-boot unlock screen. It looks like the normal login window, but it is not: your login items, LaunchAgents and background apps are all on the encrypted disk and can’t start.

For a laptop on your desk, that is a feature. For a Mac mini that runs things while you are away, it means every power cut turns into a trip home.

Your options, honestly

1. Turn FileVault off

It works: the Mac boots straight into macOS after a cut. But a Mac mini is small, light and easy to carry out of a flat. Without FileVault, whoever takes it gets your files, your browser sessions, your saved passwords and your API keys by plugging the disk into their own machine. We don’t recommend it, especially on a Mac that holds credentials for everything it automates.

2. A KVM-over-IP box

Devices like JetKVM or PiKVM plug into the Mac’s HDMI and USB ports and give you its screen and keyboard over the network, even before macOS starts. They are reliable and they work at the FileVault screen.

The downsides: one more device to buy, power and update, a setup to learn, and you still need a way to reach that box from outside your home.

3. fdesetup authrestart (planned restarts only)

macOS has a built-in way to restart without stopping at FileVault:

sudo fdesetup supportsauthrestart   # should print "true"
sudo fdesetup authrestart

It asks for your password, stores a one-time unlock for the next boot, and restarts. The Mac comes back without the FileVault screen.

It is great for restarts you choose (after an update, after a config change). It does nothing for a power cut, because a power cut is not a restart you chose. The unlock is used once, then gone.

4. Unlock over SSH (recent macOS on Apple silicon)

This is the one that changes everything. Apple’s Platform Security guide says that on a Mac with Apple silicon running macOS 26 or later, FileVault can be unlocked over SSH after a restart, as long as Remote Login is on and the Mac has a network connection.

In practice: at the FileVault screen, the Mac answers SSH. You connect with your account name and password, and connecting with that password is the unlock. The disk opens, and macOS finishes booting.

Step by step: the DIY version

Step 1: check your Mac qualifies

You need Apple silicon (M1 or later) and macOS 26 or later.

uname -m            # arm64 means Apple silicon
sw_vers -productVersion
fdesetup status     # "FileVault is On."

Step 2: turn on Remote Login

System Settings › General › Sharing › Remote Login. Make sure your account is allowed to connect. From the Terminal:

sudo systemsetup -setremotelogin on

Step 3: make sure the Mac comes back on by itself

A Mac that stays off after the cut can’t be unlocked by anyone. Turn on System Settings › Energy › “Start up automatically after a power failure”, or:

sudo pmset -a autorestart 1
pmset -g | grep autorestart   # should show 1

Step 4: give the Mac a fixed address

Reserve its IP address in your router (DHCP reservation), so you always know where to find it. Prefer Ethernet if you can: early macOS 26 builds had trouble reaching the network over Wi-Fi at the FileVault screen, and later updates fixed it in reported tests. A cable removes the doubt.

Step 5: test it at home first

Restart the Mac, wait for the FileVault screen, and from another computer on the same network:

ssh yourname@192.168.1.50

Type your account password, not your SSH key passphrase. At that screen your home folder is still encrypted, so your authorized_keys file can’t be read and key login won’t work. The connection may close right after: that’s expected, the Mac is busy finishing its boot. Give it a minute, then connect again normally.

Step 6: a way in from outside

Here is the catch. At the FileVault screen nothing of yours runs, so Tailscale, ZeroTier or any VPN app installed on the Mac is not there yet. You need a door that lives outside the Mac.

The cleanest door is a VPN server running on your router itself. The Freebox, the FRITZ!Box (WireGuard since FRITZ!OS 7.50), UniFi gateways and a handful of others have one. Many ISP boxes don’t. You can check yours in our router list.

Set up the router’s WireGuard server, install the WireGuard app on your iPhone or laptop, import the config, and you are “at home” from anywhere. Then Step 5 works from a hotel room.

If your router has no VPN server, the fallbacks are a port forward to the Mac’s SSH port (use a strong password and an unusual external port, and know that you are exposing SSH to the internet), or another always-on device at home that runs a VPN.

Step 7: open the user session

Once the disk is unlocked, macOS may still wait at the login window. Your system services run, but anything that needs a logged-in user (LaunchAgents, menu bar apps, many homelab tools) waits for a real login. SSH in and use Screen Sharing over the VPN to log in, or design your setup so the important things run as LaunchDaemons, which start at boot without a login. Our 24/7 Mac mini checklist goes into that.

Where Macaron fits

The DIY version works. It is also four apps, two passwords and an IP address to remember at the exact moment you are stressed and on a phone.

Macaron does the same thing in one tap. The free Mac app checks Remote Login, FileVault and the power settings, turns on restart after a power failure, fixes the Mac’s address, and on a Freebox sets up the router’s WireGuard server for you. The iPhone app keeps your Mac password in the iPhone Keychain behind Face ID and talks straight to your Mac over SSH, on your home network or through your router’s VPN when you are away. Tap “Unlock”, look at your phone, and you watch it go from “disk locked” to “back online”.

It also tells you when your Mac goes down in the first place, because a dead Mac can’t warn anyone. The Mac app sends a small heartbeat, and when it stops, your iPhone gets a notification.

The short version

  • With FileVault on, a Mac that restarts waits at a locked screen and runs nothing.
  • Turning FileVault off is the wrong fix on a small, easy-to-steal machine.
  • fdesetup authrestart handles planned restarts, not power cuts.
  • On Apple silicon with macOS 26 or later, Remote Login on, SSH with your password at the FileVault screen unlocks the disk.
  • Turn on “Start up automatically after a power failure”, reserve the Mac’s IP, prefer Ethernet.
  • To reach it from outside, you need your router’s own VPN server, since nothing on the Mac runs yet.

If you’d rather do all of that with one tap and Face ID, download Macaron for Mac, it’s free. The iPhone app does the rest, and you can see everything it does on the homepage.