SF3TECHNOLOGIES
GuidesGuides · Everyday help

Forgot your Mac password or locked out of a work Mac: how to get back in

The three ways a Mac lets you reset a forgotten password, where the FileVault recovery key lives when a company manages the Mac, what Activation Lock does, and why a managed Mac is back in minutes while an unmanaged one may have to be erased.

7 minute readUpdated

The short answer

Click the question mark next to the password field, or type a wrong password up to three times, and the login screen offers a way back in.

  1. Pick a reset option: your Apple Account, your FileVault recovery key, or "Restart and show password reset options".
  2. Company Mac? Ask your IT team first. They hold the recovery key and can usually reset the password remotely, files intact.
  3. No reset option and no recovery key: the Mac can be erased and set up again, but the files on it are gone.

Never buy a password "unlock" tool or let a stranger remote in. There is no shortcut around FileVault, and anyone who promises one wants your data or your card.

First, which password did you forget?

A Mac has up to three passwords that people mix up, and the fix is different for each.

PasswordWhere you type itWho can reset it
Login passwordThe screen with your name and photo when the Mac starts or wakesYou, with the options below, or your IT team on a managed Mac
Apple Account password (used to be Apple ID)App Store, iCloud, Find My, the Apple Account section in System SettingsYou, at iforgot.apple.com or from a trusted iPhone or iPad
Work sign-in password (Microsoft 365 or Google)Outlook, Teams, the browser, and on some company Macs the login screen itselfYour IT team, or you at the company's password reset page

If your company Mac shows a Microsoft or Google logo at the login screen, or your Mac password has always been the same as your email password, the Mac is tied to your work account. Resetting that account's password is the fix, and your IT team does it in a minute. The rest of this guide is about the login password of the Mac itself.

The question mark, then the Mac offers help

At the login screen, look for a small question mark next to the password field and click it. If there is none, type a wrong password up to three times and look again. The Mac then shows your password hint, if you set one, and one or more of these. If nothing ever appears, keep reading, the next section explains why.

  1. Reset it using your Apple Account. Offered when the account was set up to allow it. Enter the Apple Account email and password, approve the sign-in on your iPhone or with the code it sends, and choose a new login password. Your files stay where they are. Not available on most company Macs, where IT turns it off on purpose.
  2. Reset it using your recovery key. Offered when FileVault, the Mac's disk encryption, is on. The key is 24 letters and numbers in groups of four, shown once when FileVault was turned on; it never contains the letters I or S or the digits 1 or 0. You may have saved it in a password manager or printed it, and on a Mac running macOS Tahoe 26 or later it may also be in the Passwords app on your iPhone, iPad or another Mac signed in to the same Apple Account: search there for "recovery key". On a company Mac the key was sent to the management system, so IT can read it out to you. Type it, set a new password, and everything is kept.
  3. Restart and show password reset options. The Mac restarts into a recovery mode. If it asks you to select a user you know the password for, pick a second admin if there is one, or click "Forgot all passwords?". It then walks you through the Apple Account or recovery key route, may ask to temporarily deactivate the Mac (allow it) and to create a new keychain (allow that too), and finally lets you set a new password.

Two small things trip people up. Caps Lock on a Mac shows an arrow symbol inside the password field, so look for it. And if the keyboard layout changed, for example from US to German, letters like Y and Z swap, so try your password with the other layout once before giving up.

Why some Macs never offer a reset

  • No Apple Account was linked for reset. The option only appears when it was allowed in Users & Groups, or when the account was created with an Apple Account during setup. Nobody can add it after the fact without the password.
  • FileVault is off and the Mac is not managed. There is no recovery key because nothing is encrypted. The good news: the password can still be reset from macOS Recovery with the resetpassword tool, and the files are untouched, because they were never locked.
  • FileVault is on, nobody has the key, and no Apple Account is linked. This is the one dead end. The disk is encrypted with a key derived from the password, and Apple cannot open it either. The only way forward is to erase the Mac. That is exactly the situation a company should never be in, and it is why managed Macs send their key to the management system automatically.
  • The account is locked, not forgotten. After many wrong tries in a row the Mac can lock the account for a while and shows a message with the time. Wait until that time has passed, restart the Mac, then try again with the password you are fairly sure of. Guessing faster only extends the lock.

Resetting from macOS Recovery

Use this when the login screen gives you nothing but you do have the recovery key, or FileVault is off, or you are the second admin fixing a colleague's account.

  1. Start recovery. On a Mac with Apple silicon (every Mac sold since 2021), shut down, then hold the power button until you see "Loading startup options", and choose Options. On an older Intel Mac, hold Command and R while it starts.
  2. Unlock the disk if asked. Recovery asks you to select a user you know the password for. Pick an admin whose password you have, or click "Forgot all passwords?" and follow the prompts: the Apple Account previously used with the Mac or the recovery key, your startup disk (usually Macintosh HD), and a temporary deactivation of the Mac if asked. If this already lets you set a new password, restart and log in; otherwise click Exit to Recovery and continue.
  3. Open the reset tool. From the menu bar choose Utilities, then Terminal, type resetpassword as one word and press Return. The Reset Password assistant opens. Pick the user, set a new password, and restart.
  4. Expect one more prompt. After the reset, the Mac may say it cannot unlock your login keychain, the place that stores saved Wi-Fi and website passwords. Choose Create New Keychain. Saved passwords from before are lost, but the files are all there. Signing in to iCloud or your work account brings most of them back.

What is different on a company Mac

A Mac enrolled in a management system such as Mosyle, Jamf or Microsoft Intune, and registered in Apple Business Manager, is built to be recoverable. Here is what IT can do that you cannot.

SituationOn a managed MacOn an unmanaged Mac
Forgot the login passwordIT reads the FileVault recovery key from the console and you reset in two minutes, or IT resets the password remotelyOnly the Apple Account or a saved recovery key helps
Recovery key lostIt was sent to the console when FileVault turned on, and rotates after each useGone for good
Leaver's Mac, password unknownIT unlocks it or erases it remotely and hands it to the next personErase it, hoping Activation Lock is not on
Activation Lock after an eraseCleared by IT with the bypass code stored in the consoleNeeds the former user's Apple Account password
Stolen MacLocked or wiped remotelyOnly if Find My was set up and the thief connects it to the internet

Activation Lock deserves a sentence. It is the Find My feature that stops anyone from setting up an erased Mac without the Apple Account that locked it. On a personal Mac that is excellent protection. On a company Mac it becomes a problem the day an employee leaves with their personal Apple Account still signed in, which is why we make sure company Macs are registered in Apple Business Manager and let the management system hold the bypass code.

Before you erase anything

  1. Check what is already in the cloud. Desktop and Documents in iCloud Drive, files in OneDrive, Google Drive or Dropbox, mail in Microsoft 365 or Google Workspace, photos in iCloud Photos. For many people that is everything that matters.
  2. Look for a Time Machine backup. An external drive or a network drive the Mac backed up to. If one exists, the erase costs you nothing but an afternoon.
  3. Ask once more about the recovery key. Whoever set the Mac up, a former IT contractor, a family member, a reseller, may have it. It is often in a password manager under "FileVault" or the Mac's name, and on Macs running macOS Tahoe 26 or later it may sit in the Passwords app of another device on the same Apple Account.
  4. Then erase from recovery. In macOS Recovery choose Erase Mac from the Recovery Assistant menu (Disk Utility on older Macs), reinstall macOS, and set it up fresh. If an Activate Mac window asks for a previous owner's Apple Account, that is Activation Lock, and only that person or, for a company Mac, Apple Business Manager can clear it.

For the person who runs IT

Five settings turn every Mac lockout into a two-minute ticket.

WhatWhereWhy it matters
Enforce FileVault with key escrowYour MDM's FileVault or disk encryption profile, set to escrow the personal recovery keyThe key is in the console before the user ever needs it, and rotates after each use
Get every Mac into Apple Business ManagerMacs bought from Apple or an Apple Authorized Reseller are added by the seller. Any other Mac with Apple silicon or a T2 chip can be added with Apple Configurator for iPhone during setup, and the user has 30 days to remove it, so finish management in that window.With Automated Device Enrollment assigned to your MDM, the Mac enrolls itself on first start, even after an erase, and company ownership lets you clear Activation Lock
Keep a managed local admin accountYour MDM's enrollment settings, a hidden admin account with a password the MDM rotatesGives IT a way in and a way to reset the user's password without the user's help
Turn off "reset with Apple Account" on company MacsUsers & Groups settings or a restrictions profileKeeps a personal Apple Account from becoming the key to a company Mac
Tie the login to the work accountPlatform single sign-on with Microsoft Entra or Google, or your MDM's identity integrationOne password for the person, one reset for IT, and the Mac password follows the work account

And one habit: on a leaver's last day, remove their personal Apple Account from the Mac before it goes to anyone else.

FAQ

Questions people ask

Short answers to what founders and finance leads ask us most.

Ask us something else

Click the question mark next to the password field, or type a wrong password up to three times; the options appear only then. If still nothing shows, restart the Mac and try once more. If there is still nothing, no Apple Account was linked for reset and FileVault is either off or on without a key you hold. FileVault off: reset from macOS Recovery with resetpassword, files kept. FileVault on, no key: ask whoever manages the Mac, and if nobody does, the Mac has to be erased.

Your feedback

Was this guide useful?

How SF3 Technologies helps

Lockouts, lost recovery keys and leavers' Macs are everyday work for us, and our team includes an Apple Certified Mac and iOS Technician. We enroll your Macs in a management system, link your Apple Business Manager account to your reseller so new Macs arrive ready to manage, keep every FileVault key where IT can reach it, and tie the Mac login to your Microsoft 365 or Google Workspace account so one reset fixes everything. All of it runs in your own accounts, with dedicated admin access, so you stay in control.

Talk to us about your MacsMac and Apple device management

Menu names and the exact wording on the login screen change between macOS versions. The steps apply to macOS Golden Gate (27), macOS Tahoe (26) and macOS Sequoia (15); the wording was checked in October 2026 against Apple's documentation.