For years, Apple has provided multiple methods to protect the data on a Mac: separate user accounts, passwords, passkeys with Face or Touch ID, and file encryption via FileVault. Plus, it includes an optional low-level security measure that prevents starting up from storage devices other than the selected startup disk.
This last option is known as the firmware password or Extensible Firmware Interface (EFI) lock and was used on all computers before 2023 when Apple finished shifting from Intel processors to silicon chips. The password isn’t necessary with the newer Apple silicon as the firmware functionality that it restricted is now found in macOS Recovery, which requires user authentication (when FileVault is enabled).
EFI blocks users’ ability to use all startup key combinations except the NVRAM or PRAM reset combinations. However, the command ‘Option + Cmd + P + R’ can initiate these older machines from macOS Recovery instead.
The Lost Mode feature of Find My Mac will remotely lock the computer with a firmware password for one-time use. The user’s Mac receives the lock instruction from iCloud, restarts, and asks for the system lock PIN code that was previously set up. After entering this, the Mac launches from the designated startup disk and disables the passcode.
A firmware password is not the same as an administrator or login password. It’s a separate password that appears immediately after booting up and must be entered into the system’s lock screen.
Low-level passwords are quite secure, meaning it’s almost impossible to do anything if you can’t remember your password. If you have forgotten the firmware password or passcode, know that Apple doesn’t allow any workarounds.
Instead, it recommends you schedule a service appointment at an Apple Store or Apple Authorized Service Provider. The process requires the original receipt or invoice as proof of purchase, although since this process only applies to older machines, finding this after so many years may be easier said than done.
Early macOS versions required manual installation of the firmware, but in 2015, Apple began bundling EFI updates with macOS updates to deliver security patches to all users. However, as security firm Duo Labs discovered in late 2017, some Macs didn’t get the correct firmware, making those without security software in place vulnerable to hackers.
Apple recommends checking the firmware version and updating it if needed. You can do this by launching a software update via System Settings.
On Intel-based Macs shipped before 2011, the firmware password was stored in the PRAM and read by the system EFI firmware before other PRAM variables. That led to a severe security issue, allowing the firmware to be revealed in a native macOS app and weakening the enhanced security Apple had hoped to introduce with the addition of the firmware password.
In 2011, however, Apple added an important change to the system: the EFI password was moved to a separate programmable controller from Atmel. This component contains lockable flash memory to store the password. It requires special programming with identifier numbers for the Mac’s motherboard and the Atmel chip to access and reset it.
Since the controller is an independent component, the only way to bypass it is to remove it from the motherboard manually, but this requires highly precise reflow soldering tools and techniques.
This firmware hardware hack works on all Intel MacBooks (even MacBook Pro and Air) and requires users to remove and reinstall the RAM. You can check our guide on how to remove the RAM on MacBooks for further reading.
Shut down your computer and remove the battery.
Locate your RAM, remove one of the RAM modules, and put it aside.
Put the battery back in and boot your computer while holding the Cmd + Option + P + R keys to reset the parameter RAM.
Restart your Mac while holding down the Cmd + R keys to enter Recovery Mode.
When the Utilities screen appears, go to the menu and select ‘Firmware Password Utility.’
Turn off the firmware password.
If none of the above methods have worked, you can have Apple do it for you as long as you have the original receipt or invoice. Alternatively, you can buy a Mac EFI lock bypass hardware kit or even download one of the many Mac firmware password unlock tools. If you use one of these you will void your warranty, so think carefully about whether you want to risk the procedure.
Share your thoughts, ask questions, and connect with other users. Your feedback helps our community make better decisions.
©2012-2025 Best Reviews, a clovio brand –
All rights
reserved
