Newer Macs come with a T2 Security Chip with its own Secure Enclave, a tamper-resistent bit of silicon that allows high levels of security just like on an iPhone and iPad. It’s used to enable Touch ID and allow Apple Pay on laptops, but it also handles a number of other tasks, including full-disk encryption. (The T2 chip began appearing in Macs with the iMac Pro in very late 2017; see this list to check if you’re not sure if yours is one of them.)
On pre-T2 models, macOS uses a combination of software and hardware-accelerated encryption to encrypt all the data on your disk using FileVault, which can be turned on and off via the Security & Privacy preference pane’s FileVault tab. It can take an extremely long time for FileVault to encrypt a drive completely the first time on these older Macs and bog down a system while it is underway. Afterwards, Macs generally handle live reading and writing at almost the same speed as if the data weren’t encrypted.
