Use FileVault to encrypt the startup disk on your Mac

Use FileVault to encrypt the startup disk on your Mac
If you choose to use Apple’s FileVault (I do!), it’s critical that you record your Recovery Key. The FileVault Recovery Key has two options. You can store it yourself (the most secure way), or you can store it with Apple using your Apple ID.
When Apple’s FileVault feature (included in the MacOS) is activated, and your computer is lost or stolen, there is NO way that someone other than you (with your Recovery Key) can access the data.
I just had to inform a customer that their data was no longer available because they changed their password and then promptly forgot it. When you are required (or decide) it’s time to change a password, we advise that you pick the password you want to use in advance and write it down.
Apple laptops are popular targets for thieves, so protect yourself by enabling FileVault and activating Find my Mac. That way if the unit ever connects to the InterNet after you lose it, you have the option of locating it and erasing it.
https://support.apple.com/en-us/HT204837