I want to use a very long (20+ char), strong password for my FileVault 2 full disk encryption (as well as encrypted Time Machine backups stored on a network drive), which should protect against brute force attacks on the disk should it fall into the wrong hands. I'm not concerned about cold boot attacks or attempts to physically freeze the ram and directly access its contents etc.

However, I don't want to have to enter the very long password every time I unlock the screen saver or sudo in the terminal - a moderately strong (and much shorter) password will suffice.

How can I somehow configure things so that while the Mac is running I can use the short password but for unlocking it at boot time only the long password will work?

  • 1
    Possible workaround: Don't allow your account to boot the Mac, only another account, and switch accounts once the computer is on. See step 2 here, you might need to disable FileVault and re-enable it to make this work. – Daniel Beck Mar 15 '13 at 15:41
  • Regarding the Time Machine volume, that password to the volume should be stored in your keychain. Create a new keychain in Keychain Access with a more complex password, move the stored password over there, in the future you'll need to enter the keychain password to unlock it. Since I don't have a networked TM, I might be wrong here. – Daniel Beck Mar 15 '13 at 15:48
  • @DanielBeck thanks. regarding Time Machine it seems that the OS already prompts for a separate password, so this is solved (I don't need it in a separate keychain since my assumption is that the computer won't be compromised while unlocked, not to mention that the user password won't be compromised) – GJ. Mar 15 '13 at 18:54

If you want a strong password for disk encryption and a weaker one for your account:

  • copy your disk to an external disk (i.e. with carbon copy cloner)
  • boot from the external disk
  • open disk utility and encrypt your internal disk
  • mount the internal disk
  • clone the external to the internal disk

now you don't need a secondary account.


The key to the solution is described here (also, thanks @Daniel Beck for the direction): http://www.tuaw.com/2011/12/12/prevent-certain-accounts-from-unlocking-filevault-2/

In short:

  1. create a secondary account with the strong password
  2. remove the main account's password via the terminal passwd
  3. re-add the main account's password without enabling it for unlocking the disk
  4. boot with the secondary account and then logout and log back in with the primary account

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.