everyday mac tools

Sending a Mac for repair without handing over your private files

· 6 min read

A technician needs to test your Mac, not read it. Before it goes in, make a backup you have actually checked, decide whether to share your login password or give the technician an account of their own, and lock away the folders nobody else should open. FileVault protects the disk while the Mac is off; everything below is about the moment someone has to log in.

Back up first, because a repair can mean an empty Mac

On most recent Macs the storage is part of the main logic board rather than a separate drive. If the repair turns into a board replacement, the Mac can come back working and completely empty.

  1. Connect your Time Machine drive and choose Back Up Now from the Time Machine menu, or wait for a scheduled backup to finish.
  2. Open the backup in Finder and check that a few recent files are really there. A backup you have never looked at is a hope.
  3. Keep the drive at home. It holds everything, and it is only encrypted if you chose that during setup.

If you do not use Time Machine, copy at least your Documents and Desktop folders, plus anything that is not already in iCloud, to an external drive. Private files and Time Machine covers what a backup keeps that you might not expect.

The login password question

Repair forms often ask for your login password so the technician can check that the Mac starts, logs in and works after the fix. Handing it over is a bigger step than it looks. Your login password opens your account, and your account is signed in to Mail, Messages, Photos and your browser. It also opens the Passwords app, which asks for the Mac’s login password or Touch ID before showing anything. In practice, sharing the login password shares your saved passwords too.

You have three honest options:

  • Share it, then change it. Simple, and reasonable with a repairer you trust. Change the password the day the Mac comes back, in System Settings, Users & Groups.
  • Do not share it. Many hardware checks run without anyone logging in. The repair may take longer, or come back with a note that it could not be fully tested. With FileVault on, a Mac nobody can log in to keeps its disk encrypted. FileVault: what it protects you from and what it does not explains why that matters.
  • Give the technician their own account. Usually the best middle ground.

A separate account for the technician

  1. Open System Settings, Users & Groups, and click Add User.
  2. Give it a plain name such as Service and a password you are happy to write on a form. A standard account is enough to test most hardware; make it an administrator only if the repairer says they need one.
  3. Log in to it once yourself to confirm it works, then log out.
  4. Put that account name and password on the repair form instead of yours.

Your mail, messages, photos, browser and saved passwords are not signed in on that account, so a technician using it simply does not see them. It is not a vault, though: an administrator account can reach other users’ files with enough intent, which is one more reason to keep it standard. Standard, admin and guest accounts goes through the differences.

When the Mac is back, delete the account from Users & Groups, including its home folder.

Lock the folders nobody should open

Some files matter more than the rest: tax returns, passport and ID scans, contracts, medical letters, a client’s documents. For those, whoever logs in should find something that needs a separate password.

The built-in way is an encrypted disk image. Open Disk Utility, choose File, New Image, Image from Folder, pick the folder, set Encryption to 256-bit AES and Image Format to read/write, then choose a password that is not your login password. Open the image once to test it, then delete the original folder and empty the Trash. The catch is that an image stays open until you eject it, so check it is ejected before the Mac leaves the house.

Hushbox does the same kind of encryption in place, which suits this job because there is nothing to remember. Right-click a folder in Finder and choose Lock with Hushbox. It becomes an AES-256 encrypted disk image in the same spot, and the original is deleted only after the locked copy has been checked byte for byte. It opens with Touch ID or a Hushbox password that is separate from your login password, and it locks again by itself when the Mac sleeps or the screen locks. A technician logged in as you sees the locked item and cannot open it. Hushbox costs $9 once for 2 Macs after a free 24-hour trial, and unlocking stays free even if you never buy.

Two honest limits apply to either method. The name of a locked item still shows in Finder, so a folder called Divorce papers announces itself; rename it before you lock it if the name is private. And copies made before locking, such as older Time Machine backups, are not changed.

Find My, and when erasing is the better answer

Some repairs need Find My turned off, because Activation Lock ties the Mac to your Apple Account and can get in the way of testing replaced parts. Turn it off only if the repairer asks, from System Settings, your name at the top, then iCloud, where Find My Mac is listed. Turn it back on the day the Mac returns.

If the Mac holds work you are not allowed to expose, or you want certainty rather than precautions, erase it after the backup. On a Mac with Apple silicon or an Intel Mac with the T2 chip, System Settings, General, Transfer or Reset, Erase All Content and Settings wipes it cleanly. The technician gets a blank Mac, and you restore from the backup when it comes home. It is the most private route and the slowest, and it only works if the Mac still starts. Erasing a Mac properly walks through it.

If the Mac will not turn on at all, there is little to prepare. FileVault is what protects you then: without your password, the disk stays encrypted.

When the Mac comes back

  • Change your login password if you shared it.
  • Delete the Service account and its home folder.
  • Turn Find My back on if you turned it off.
  • Open a handful of recent files and confirm nothing is missing.

Questions

Does a repair shop need my Mac password? Not always. Many repairs can be tested without logging in, but the technician may not be able to confirm everything works. A separate account gives them a way in without giving them your data.

Is FileVault enough on its own? It protects the disk while the Mac is off or before anyone logs in. Once someone logs in with a valid password, the disk is unlocked for that session, which is why a separate account and locked folders matter.

Should I sign out of my Apple Account before the repair? Only if you are erasing the Mac or the repairer asks. A separate technician account already keeps your iCloud data out of view.