How to Encrypt External Hard Drives and USB Flash Drives

Encryption is one of the most effective ways to protect sensitive information from unauthorized access. Whether you’re securing a Windows 11 laptop, encrypting a USB drive, protecting confidential documents or uploading private files to cloud storage, modern encryption tools can help prevent other people from reading your data without the appropriate credentials.

However, choosing the right encryption method is important. Full-disk encryption protects a lost or stolen computer, while encrypted containers and password-protected archives provide more flexible ways to secure individual files. Cloud encryption introduces another consideration: whether your storage provider can access your information or whether only you control the encryption keys.

ExplainingComputers examines these different approaches to data security, highlighting practical solutions for Windows, macOS, Linux and mobile devices. Building on those concepts, this guide explains how to encrypt your data using established tools such as BitLocker, FileVault, VeraCrypt, 7-Zip and Cryptomator.

You’ll learn how to enable encryption on your devices, protect external storage, create encrypted containers, secure files before sharing them and manage recovery keys safely. We’ll also explain the limitations of encryption and the common mistakes that can leave information exposed or permanently inaccessible.

How to Encrypt Your Data: Key Takeaways

What Is Data Encryption and How Does It Work?

Data encryption transforms readable information, known as plaintext, into an unreadable form called ciphertext using a mathematical algorithm and an encryption key. Without the appropriate key, someone who obtains the encrypted information should be unable to recover its original contents using practical computing resources, assuming the encryption has been implemented correctly.

Modern encryption software commonly uses the Advanced Encryption Standard (AES), an established encryption algorithm used in many security products and operating systems. AES supports different key lengths, including 128-bit and 256-bit keys. Both are widely used, and properly implemented AES-128 and AES-256 provide strong protection for ordinary personal and business data.
However, the strength of an encryption algorithm is only one part of overall security. Weak passwords, compromised devices, lost recovery keys and poorly implemented software can undermine otherwise strong encryption.

Encryption at Rest vs. Encryption in Transit

There are two important categories of encryption to understand.

• Encryption at rest: Protects stored information, such as files on a laptop, USB drive, external SSD or cloud server.
• Encryption in transit: Protects information while it travels between systems, such as when a website uses HTTPS to secure communication with your browser.

Both are important, but they address different threats.
For example, encrypting your laptop’s system drive helps protect its contents if the device is stolen while powered off. HTTPS helps protect information exchanged between your browser and a website.
Neither automatically protects your data from malware running on an unlocked computer.

What Encryption Can and Cannot Protect

Encryption is particularly effective against unauthorized access to lost or stolen storage devices.
However, full-disk encryption normally unlocks the system’s data when an authorized user signs in. Applications and processes running with sufficient permissions can then access the decrypted information.
This means encryption should be combined with other security measures, including strong account authentication, automatic screen locking, software updates, malware protection and reliable backups.
Important: Encryption protects confidentiality. It does not guarantee that encrypted files cannot be deleted, corrupted, copied while unlocked or damaged by ransomware.

Which Encryption Method Should You Use?

The best encryption method depends on what you’re trying to protect.

What You Want to Protect	Recommended Approach	Suggested Tools
Windows laptop or desktop	Full-disk or device encryption	BitLocker / Device Encryption
MacBook or Mac desktop	System-volume encryption	FileVault
Linux computer	Encrypted system installation	LUKS2 / cryptsetup
USB flash drive or external SSD	Removable-drive encryption	BitLocker To Go / VeraCrypt
Private collection of files	Encrypted container	VeraCrypt
Individual documents for sharing	Encrypted archive	7-Zip
Files stored in the cloud	Client-side encryption	Cryptomator
iPhone or Android device	Built-in device encryption	Operating-system security features

For most users, the best starting point is to enable encryption on their primary computer and any portable drives containing sensitive information. Individual file encryption and cloud pre-encryption can then provide additional protection where necessary.

How to Encrypt a Windows 11 PC Using BitLocker

Windows includes built-in encryption capabilities that can protect your system drive and, depending on your Windows edition, additional storage devices.
There are two related features to understand:

• BitLocker Drive Encryption: Provides configurable drive encryption on supported Windows editions, including Windows 11 Pro, Enterprise and Education.
• Device Encryption: Provides a more streamlined encryption experience on eligible devices, including some computers running Windows 11 Home.

Both can help protect stored data, but their availability and configuration options differ.

1: Check Whether Your Windows Drive Is Already Encrypted

Before changing any settings, check whether encryption is already enabled.
Open Command Prompt as an administrator and enter:

manage-bde -status C:

Windows will display information about the system volume, including its encryption and protection status.
Look for entries such as:

• Conversion Status: Indicates whether the volume is fully encrypted, fully decrypted or undergoing conversion.
• Percentage Encrypted: Shows encryption progress.
• Protection Status: Indicates whether BitLocker protection is currently active.

A drive can be encrypted while its protection is temporarily suspended, so check both encryption and protection status.

2: Enable Device Encryption on Supported Windows 11 PCs

If your computer supports Device Encryption, the feature may already be enabled.
To check:

1. Open Settings.
2. Select Privacy & security.
3. Look for Device encryption.
4. Open the Device Encryption settings.
5. If encryption is available but disabled, follow the on-screen instructions to enable it.
6. Allow Windows to complete the encryption process.

The Device Encryption option does not appear on every computer.
Availability depends on the Windows installation, hardware capabilities, security configuration and device eligibility.
Some supported devices enable encryption automatically during setup, with recovery-key handling depending on how the computer is configured.

3: Enable BitLocker on Windows 11 Pro

If you’re using a Windows edition with full BitLocker management, you can configure encryption through Control Panel.

1. Open the Start menu.
2. Search for Manage BitLocker.
3. Open the BitLocker Drive Encryption control panel.
4. Find your operating-system drive.
5. Select Turn on BitLocker if encryption is not already enabled.
6. Follow the available authentication and recovery-key instructions.
7. Choose the encryption options appropriate for your computer.
8. Confirm the configuration and begin encryption.

The options shown depend on your Windows edition, hardware and security policies.
Many modern Windows 11 computers use a Trusted Platform Module (TPM) to help protect encryption keys and verify aspects of the boot environment.
A Microsoft account is not universally required for BitLocker, although it can be used to store recovery information on personally managed devices.
Some BitLocker configurations can also operate without a compatible TPM, subject to additional authentication requirements and policy settings.

4: Save Your BitLocker Recovery Key

This is one of the most important steps in the entire process.
A BitLocker recovery key may be required after certain firmware changes, security configuration changes or other events that affect the system’s trusted boot state.
If you cannot provide the required recovery key, you may be unable to access the encrypted drive.
For personal devices, recovery keys may be available through your Microsoft account:
View Microsoft account BitLocker recovery keys
For computers managed by an employer or educational institution, recovery information may be stored in an organization’s management systems.
Keep an additional recovery-key copy in a secure location separate from the encrypted computer, where permitted by your organization’s policies.
Do not rely on a single copy stored only on the device being encrypted.

5: Confirm BitLocker Protection Is Active

After encryption finishes, open Command Prompt as an administrator and run:

manage-bde -status C:

Confirm that the drive is fully encrypted and that protection is enabled.
You can also review the status in the BitLocker management interface.
Security tip: If you’re encrypting a laptop, configure Windows to require authentication after sleep or inactivity. For stronger protection when leaving a device unattended, shut it down completely rather than assuming that an unlocked or sleeping computer provides the same protection as a powered-off encrypted system.

How to Encrypt a Mac Using FileVault

Apple provides FileVault to protect data stored on supported Mac computers. FileVault works with macOS storage encryption and helps prevent unauthorized access to files when the Mac is locked or powered off. On Apple silicon and T2-equipped Macs, storage encryption is integrated into the hardware architecture. Enabling FileVault adds user-credential-based protection to the encryption keys.

Enable FileVault on macOS

1. Open the Apple menu.
2. Select System Settings.
3. Choose Privacy & Security.
4. Scroll to FileVault.
5. Select Turn On if FileVault is disabled.
6. Follow the instructions to configure recovery options.
7. Confirm your selections and allow macOS to complete any required encryption work.

The exact interface and recovery choices can vary by macOS version and whether the Mac is personally or organizationally managed.

Choose a FileVault Recovery Method

Depending on your Mac and configuration, you may be able to use an Apple Account-based recovery option or a personal recovery key. If you choose a personal recovery key, store it somewhere secure and separate from the Mac. Losing access to your account credentials and recovery method can make encrypted data inaccessible. Apple provides additional guidance through its official FileVault documentation.

Does FileVault Slow Down a Mac?

On modern Macs, the performance impact of storage encryption is generally small for typical workloads.
Actual performance depends on the hardware, operating system and storage activity.
For most users, the security benefits outweigh any noticeable performance difference.

How to Encrypt a Linux Computer Using LUKS

Linux users can protect their storage using the Linux Unified Key Setup (LUKS), commonly managed through the cryptsetup utility. LUKS is widely used for encrypted Linux installations and supports modern encryption configurations. Many Linux distributions provide an encryption option during installation, making this the most straightforward approach for users setting up a new system.

Enable Encryption During Linux Installation

The exact process varies between Ubuntu, Fedora, Debian and other distributions.
A typical installation workflow involves:

1. Back up any existing files on the computer.
2. Boot from the Linux installation media.
3. Begin the operating-system installation.
4. Locate the storage or disk configuration options.
5. Choose an encrypted installation option if supported.
6. Create a strong encryption passphrase.
7. Review the partitioning and data-erasure warnings carefully.
8. Complete the installation.
9. Restart and verify that the system unlocks correctly.

Many distributions use LUKS2 for modern encrypted installations, although the implementation and supported options vary.
Important: Enabling full-system encryption on an existing unencrypted Linux installation can be substantially more complicated than selecting encryption during installation. For beginners, backing up files and performing a fresh encrypted installation is often safer than attempting an advanced in-place conversion.

Check an Existing LUKS Volume

Advanced Linux users can inspect an existing encrypted volume with cryptsetup.
For example:

sudo cryptsetup luksDump /dev/DEVICE

Replace /dev/DEVICE with the correct encrypted block device. This command displays LUKS header information. It does not reveal the encryption passphrase. Do not run storage-modification commands against a device unless you have positively identified it. For additional technical information, consult the official cryptsetup project.

Are iPhones and Android Phones Already Encrypted?

Modern smartphones generally include built-in storage encryption, but the exact protection depends on the device, operating-system version and security configuration.

iPhone and iPad Encryption

Supported Apple mobile devices use hardware-backed encryption and data-protection mechanisms. Setting a strong device passcode is particularly important because it helps protect access to encryption keys and sensitive information. Face ID and Touch ID provide convenient authentication, but the device passcode remains an essential part of the security model. For better protection:

• Use a strong device passcode.
• Enable automatic locking.
• Keep iOS or iPadOS updated.
• Enable Find My where appropriate.
• Review your iCloud backup and data-protection settings.

Remember that device encryption and cloud backup encryption are separate considerations.

Android Encryption

Modern Android devices generally use file-based encryption, with protection integrated into the operating system and supported hardware. However, security capabilities vary between manufacturers, Android versions and device configurations. To strengthen protection:

• Use a strong PIN or password.
• Enable automatic screen locking.
• Install operating-system security updates.
• Review backup and account security settings.
• Avoid installing applications from untrusted sources.

Biometric authentication can improve convenience, but it should complement a strong device credential rather than replace one.

How to Encrypt a USB Drive or External SSD

USB flash drives and external storage devices are particularly vulnerable to loss or theft. A portable drive may contain financial records, customer information, private photographs, work documents or backup files. Encrypting the drive helps prevent someone from accessing those files simply by connecting it to another computer. Two practical software options are BitLocker To Go and VeraCrypt.

Option 1: Encrypt a USB Drive With BitLocker To Go

BitLocker To Go provides encryption for removable storage devices on supported Windows editions. It is particularly convenient if you primarily use Windows computers.

Step-by-Step: Enable BitLocker To Go

1. Connect the USB drive or external SSD to your computer.
2. Open File Explorer.
3. Locate the removable drive.
4. Open the drive’s context menu and select the BitLocker option, or locate it through the BitLocker management interface.
5. Choose an available unlocking method, such as a password.
6. Create a strong, unique password.
7. Save the recovery key securely.
8. Select the encryption options appropriate for the drive and how it will be used.
9. Confirm your choices and start encryption.
10. Wait for Windows to report that encryption has completed.

For a new or empty drive, encrypting used disk space only may complete more quickly. For a previously used drive that could contain recoverable deleted information, encrypting the entire drive is generally the more cautious choice. The available options and behavior depend on the Windows version and drive configuration.

Important: BitLocker To Go management is not available in every Windows edition, and compatibility with macOS and Linux is limited without additional software. If you regularly move files between different operating systems, consider a cross-platform solution instead.

Option 2: Encrypt a USB Drive Using VeraCrypt

VeraCrypt is free, open-source encryption software available for Windows, macOS and Linux. It can create encrypted file containers and encrypt supported partitions or storage devices. VeraCrypt is useful when you need more control over encryption settings or want a solution that works across multiple desktop operating systems.

Step-by-Step: Encrypt an External Drive With VeraCrypt

1. Download VeraCrypt from its official website.
2. Install the appropriate version for your operating system.
3. Back up all important files from the external drive.
4. Connect the drive to your computer.
5. Launch VeraCrypt.
6. Select Create Volume.
7. Choose the option to encrypt a non-system partition or drive.
8. Select the standard VeraCrypt volume option unless you have a specific need for advanced features.
9. Carefully identify the external drive or partition.
10. Choose the supported encryption and formatting options.
11. Create a strong password.
12. Review all warnings before confirming any operation that could erase existing data.
13. Allow VeraCrypt to complete the encryption process.
14. Test that you can mount and unlock the encrypted volume.

Warning: Some VeraCrypt volume-creation workflows format the selected storage and destroy existing files.  Never assume an encryption operation preserves data unless the selected workflow explicitly supports doing so. For beginners, backing up the drive and creating a new encrypted volume is usually safer than attempting to encrypt existing data in place.

Hardware-Encrypted USB Drives: Are They Better?

Some USB drives and external SSDs include built-in encryption hardware. These products may use integrated keypads, dedicated controllers or proprietary unlocking software. Hardware encryption can be convenient, but it is not automatically more secure than reputable software encryption.

Security depends on the device’s implementation, firmware, authentication design and update support. If you’re purchasing hardware-encrypted storage for sensitive business information, look for independently evaluated products and clearly documented security capabilities. Also check whether the drive requires proprietary software and whether it supports all the operating systems you intend to use.

How to Create an Encrypted File Container With VeraCrypt

You don’t always need to encrypt an entire drive. An encrypted container allows you to protect a collection of files inside a single encrypted file. When unlocked, the container behaves like a mounted storage volume. You can copy files into it, edit documents and organize folders. When the volume is dismounted, its contents remain encrypted. This approach is useful for storing financial records, confidential documents, private photographs or other sensitive information.

Create a VeraCrypt Encrypted Container

1. Open VeraCrypt.
2. Select Create Volume.
3. Choose Create an encrypted file container.
4. Select Standard VeraCrypt volume.
5. Choose a location and filename for the container.
6. Select the encryption settings.
7. Specify the container size.
8. Create a strong password.
9. Choose the appropriate filesystem for your needs.
10. Follow the volume-formatting instructions.
11. Complete the container creation process.

The container is stored as a regular file, but its contents remain encrypted until the volume is unlocked.

How to Open an Encrypted Container

1. Launch VeraCrypt.
2. Select an available drive letter or mount location.
3. Choose the encrypted container file.
4. Select Mount.
5. Enter the correct password.
6. Access the mounted volume through your operating system.
7. Save and close your files when finished.
8. Return to VeraCrypt and select Dismount.

Dismounting is important because files inside a mounted container are accessible to authorized applications and potentially to malicious software running with sufficient permissions.

Security tip: Close sensitive documents before dismounting. Some applications may create temporary files, previews or recovery copies outside the encrypted container.

How to Encrypt Individual Files Using 7-Zip

If you only need to protect a few documents, creating an encrypted archive can be simpler than encrypting an entire drive.
7-Zip is a free, open-source file archiving utility for Windows. It supports AES-256 encryption in the 7z archive format. This makes it useful for securing documents before transferring them through email, cloud storage or removable media.

Step-by-Step: Create an AES-256 Encrypted Archive

1. Install 7-Zip from its official website.
2. Locate the file or folder you want to protect.
3. Right-click the selected item.
4. Open the 7-Zip menu and choose Add to archive.
5. Select 7z as the archive format.
6. Locate the encryption settings.
7. Enter a strong password.
8. Confirm the password.
9. Ensure AES-256 is selected where the interface provides an encryption-method option.
10. Enable Encrypt file names if available.
11. Select OK to create the archive.

The resulting archive can be stored or shared like any other file. Anyone opening it will need the correct password to access the encrypted contents.

Why Encrypting Filenames Matters

Some encrypted archive formats protect file contents while leaving filenames visible. This can reveal information even when the actual documents remain encrypted. For example, an archive might contain files named:

• bank-statements-2026.pdf
• customer-records.xlsx
• private-medical-documents.pdf

Encrypting filenames helps prevent this information from being exposed through the archive directory. The 7z format supports filename encryption, making it a useful option when confidentiality is important.

Important: Delete or Protect the Original Files

Creating an encrypted archive does not automatically encrypt or remove the original unencrypted documents. If you leave the originals in an ordinary folder, they may still be accessible to anyone who can access your computer. After confirming that the encrypted archive works and that your backups are adequate, decide how to handle the original files. Ordinary deletion is not a guaranteed secure-erasure method, particularly on SSDs. For ongoing protection, storing sensitive files on an encrypted system drive or inside an encrypted container is often more practical than repeatedly creating and deleting unencrypted copies.

How to Encrypt Microsoft Office Documents and PDF Files

Some applications include built-in document encryption. This can be useful when you want to protect an individual file without installing a separate encryption application.

Encrypt a Microsoft Word or Excel Document

In supported desktop versions of Microsoft Office:

1. Open the document.
2. Select File.
3. Choose Info.
4. Locate the document or workbook protection options.
5. Select Encrypt with Password where available.
6. Enter a strong password.
7. Confirm the password.
8. Save the document.
9. Close and reopen it to verify that the password is required.

The exact steps depend on the Office application, platform and version.

Important: Restricting editing is not necessarily equivalent to encrypting a document against unauthorized reading.
If confidentiality is your goal, use a feature that encrypts the file contents.

Encrypt a PDF Document

Some PDF editors support password-based encryption. Look for options that require a password to open the document, rather than settings that merely restrict printing or editing. PDF security capabilities vary between applications and encryption configurations. For sensitive information, choose reputable software that supports modern encryption and verify that the resulting PDF cannot be opened without the required password. If you’re unsure whether your PDF editor provides suitable encryption, placing the document inside an AES-256 encrypted 7z archive is another option.

How to Encrypt Files Before Uploading Them to the Cloud

Cloud storage services such as OneDrive, Google Drive and iCloud generally provide encryption for data in transit and at rest.
However, encryption provided by a cloud service does not necessarily mean the service operates under a zero-knowledge or end-to-end encryption model. Depending on the provider and service configuration, the provider may retain the technical ability to access stored file contents. If you want additional control over confidentiality, you can encrypt files locally before uploading them.
This approach is commonly called client-side encryption.

Why Use Client-Side Encryption?

With client-side encryption, files are encrypted on your device before being transferred to the cloud. The cloud service receives encrypted data rather than the original readable files. This can reduce your reliance on the provider’s access controls and encryption-key management. However, it does not eliminate every risk. If malware compromises your computer while the encrypted files are unlocked, an attacker may still access their contents. Some metadata may also remain visible, depending on the encryption tool and cloud storage configuration.

How to Encrypt Cloud Storage With Cryptomator

Cryptomator is an open-source encryption application designed to protect files stored in cloud-synchronized folders.
It encrypts file contents and filenames locally before the encrypted data is synchronized. Cryptomator is available for major desktop operating systems, with mobile applications also available under platform-specific licensing arrangements.
The desktop application is free and open source.

Step-by-Step: Create an Encrypted Cryptomator Vault

1. Download Cryptomator from its official website.
2. Install the desktop application.
3. Open Cryptomator.
4. Select the option to create a new vault.
5. Choose a descriptive vault name.
6. Save the vault inside a folder synchronized by your cloud storage application.
7. Create a strong, unique password.
8. Save any recovery information offered during setup.
9. Complete the vault creation process.
10. Unlock the vault through Cryptomator.
11. Copy sensitive files into the unlocked vault.
12. Allow your cloud storage application to synchronize the encrypted vault files.

The cloud service stores the encrypted vault data, while Cryptomator presents an accessible view of the decrypted files when the vault is unlocked locally.

How to Access Your Encrypted Cloud Files

To access the vault on another computer:

1. Install Cryptomator on the second computer.
2. Ensure the encrypted vault files have synchronized.
3. Open Cryptomator.
4. Add the existing vault.
5. Enter the correct vault password.
6. Unlock the vault and access your files.

When finished, lock the vault to reduce the risk of unauthorized access.

Important Limitations of Cloud Pre-Encryption

Cryptomator protects file contents and filenames, but it does not necessarily conceal all metadata. Depending on the storage system and configuration, information such as encrypted file sizes, timestamps or aspects of directory structure may still be observable. Cloud synchronization can also introduce file conflicts or versioning issues. For this reason, encrypted cloud storage should still be backed up independently.

Security tip: Never assume that encrypting files before upload protects them from deletion. Someone who compromises your cloud account may still be able to delete encrypted files even if they cannot decrypt them.

Watch: Practical Ways to Encrypt Your Data

For a visual explanation of different encryption methods, the following video from ExplainingComputers explores how encryption can protect system drives, removable storage, individual files and cloud data. The video provides additional context for choosing an encryption approach, while the step-by-step instructions in this guide explain how to implement several of these methods.

Enhance your knowledge on encryption by exploring a selection of articles and guides on the subject.

• Apple’s September 9 Event: the Full List of 8 Devices Expected on Stage
• Meta Phoenix Quest Air VR Headset First Official Image Leaked?
• Google Knows WiFi Passwords On Android Devices
• Samsung Galaxy Watch 9 vs Galaxy Watch 8 ! Which One Should You Buy?
• Aegis NVX 256-bit AES XTS hardware encrypted USB storage
• How to encrypt email in Outlook, macOS and more
• How to encrypt your email in Microsoft 365
• Is Your Samsung Galaxy Phone Secure? Check This Setting IMMEDIATELY!
• How to manage your Google One storage
• Quantum Computers Could Break Encryption : Are We Ready for the Digital Apocalypse?

How to Choose a Strong Encryption Password

Even strong encryption can be undermined by a weak password. If an attacker obtains an encrypted file, they may attempt to guess its password using automated tools. The difficulty of this attack depends on the encryption software, its password-based key derivation method and the strength of the chosen password.

For most users, a long, unique passphrase is easier to remember and more secure than a short password containing predictable substitutions.

Best Practices for Encryption Passwords

• Use long passwords: Prefer a lengthy, unpredictable password or passphrase.
• Avoid password reuse: Never reuse an encryption password from another account or service.
• Use a password manager: A reputable password manager can generate and store strong credentials.
• Avoid personal information: Do not use birthdays, names, addresses or easily discovered details.
• Protect recovery information: Store recovery keys separately from the encrypted device.
• Plan for emergencies: Make sure you have an appropriate recovery process if your primary device becomes unavailable.

For randomly generated passwords, length and unpredictability are especially important.
For memorable passphrases, use multiple independently chosen words rather than a familiar quotation or predictable sentence.

How to Share Encrypted Files Securely

Encrypting a file before sharing it is useful, but the password must also reach the intended recipient securely. If you email an encrypted archive and include its password in the same email, anyone who gains access to that message may obtain both the encrypted data and the credential needed to unlock it. A better approach is to use a separate trusted communication channel.
For example:

1. Create an encrypted 7z archive containing the sensitive files.
2. Use a strong, unique password.
3. Send the encrypted archive through your chosen file-sharing service.
4. Communicate the password separately using an appropriately secure method.
5. Confirm that the recipient can open the archive.
6. Remove unnecessary shared copies when the transfer is complete.

For repeated collaboration, an encrypted file-sharing system with appropriate identity management and access controls may be more practical than distributing shared passwords. Remember that anyone who legitimately decrypts a file can potentially copy or redistribute its contents. Encryption protects access to the data; it does not guarantee control over what an authorized recipient does afterward.

Why Encryption Does Not Replace Backups

Encryption and backups solve different problems. Encryption helps prevent unauthorized people from reading information.
Backups help restore information that has been lost, deleted, corrupted or damaged. An encrypted laptop can still experience SSD failure. An encrypted cloud vault can still be deleted. Ransomware can still damage files that are accessible to an infected computer. For comprehensive protection, maintain separate backups of important data.

Follow the 3-2-1 Backup Principle

A commonly recommended starting point is the 3-2-1 approach:

• Three copies: Keep the original data and at least two additional copies.
• Two storage types: Store copies using more than one storage medium or independent storage system.
• One offsite copy: Keep at least one backup in a separate physical location or appropriately secured cloud service.

Where practical, also maintain an offline or otherwise isolated backup to reduce the risk of ransomware affecting every copy. Backups containing sensitive information should be encrypted, with their recovery credentials stored securely. Periodically test that your backups can actually be restored.

Common Encryption Mistakes to Avoid

Even reputable encryption software cannot protect against every configuration or operational mistake. The following errors are particularly important to avoid.

1. Losing Your Encryption Password or Recovery Key

Strong encryption is designed to resist unauthorized access. Unfortunately, that can also mean legitimate users cannot recover their files after losing the necessary credentials. Always establish a recovery plan before encrypting irreplaceable data.

2. Assuming Encryption Protects an Unlocked Computer

Full-disk encryption primarily protects stored data when the drive is locked. If malware runs on your computer while your encrypted storage is unlocked, it may be able to access files through your operating system. Keep devices updated and use strong account security.

3. Forgetting About Unencrypted Temporary Files

Some applications create temporary documents, previews, caches or recovery files outside an encrypted container. If these files contain sensitive information, they may remain accessible elsewhere on the system. Full-disk encryption can provide an additional layer of protection for these application-generated files when the device is locked.

4. Using Weak or Reused Passwords

An encrypted archive protected by a short, commonly used password may be vulnerable to password-guessing attacks. Use long, unique credentials and reputable encryption software.

5. Encrypting the Only Copy of Important Files

A software problem, hardware failure or forgotten password could make the data inaccessible. Create a verified backup before encrypting a drive or restructuring storage.

6. Downloading Encryption Software From Untrusted Websites

Malicious downloads may imitate legitimate security utilities. Obtain encryption tools from their official websites and verify downloads where the project provides suitable verification information.

7. Assuming All Password-Protected Files Are Securely Encrypted

Some applications use passwords only to restrict editing or printing. These controls are not necessarily equivalent to strong encryption of the file contents. Check the application’s documentation and encryption settings.

Does Encryption Slow Down Your Computer?

Encryption requires processing resources, but modern computers commonly include hardware acceleration for established encryption algorithms. On many contemporary systems, the performance impact of full-disk encryption is small during ordinary activities. However, performance depends on several factors:

• Processor capabilities and hardware acceleration.
• Storage speed and controller performance.
• Encryption software and configuration.
• File sizes and workload characteristics.
• Whether encryption is performed continuously or as part of an initial conversion.

Encrypting an entire drive for the first time may temporarily increase storage activity. Once encryption is complete, everyday performance may return close to its previous level. Encrypted containers and cloud encryption tools can also introduce overhead, particularly when processing many small files. For most users handling sensitive information, the security benefits outweigh modest performance costs.

Troubleshooting Common Encryption Problems

Why Can’t I Find BitLocker in Windows 11?

Full BitLocker management is not available in every Windows edition. Windows 11 Home may provide Device Encryption on eligible hardware, but it does not offer the same management interface as Windows 11 Pro. Check your Windows edition and whether Device Encryption appears in Settings. If your computer does not support the built-in feature you need, consider a reputable alternative appropriate for your use case.

What Happens If I Forget My BitLocker Recovery Key?

If Windows requests a recovery key, check the recovery locations configured for that device. These may include your Microsoft account, a saved recovery-key file, a printed copy or an organization’s device-management system. Without the required recovery information, recovering the encrypted data may not be possible. Avoid making unnecessary firmware or TPM changes while investigating a recovery prompt.

Why Can’t I Open a VeraCrypt Container?

Possible causes include:

• An incorrect password.
• Incorrect keyfiles or other authentication settings.
• A damaged or incomplete container file.
• An incompatible software version or configuration.
• A corrupted volume header.

Verify the password and authentication settings before attempting recovery. If you have a supported volume-header backup, consult VeraCrypt’s documentation for the appropriate recovery procedure. Do not overwrite the original encrypted file while troubleshooting.

Why Does an Encrypted USB Drive Not Open on Another Computer?

Encryption tools have different compatibility requirements. A BitLocker-encrypted drive may not be natively accessible on macOS or Linux. VeraCrypt volumes generally require compatible VeraCrypt software on the computer used to unlock them.
Before relying on an encrypted drive for travel or work, test it on every operating system you expect to use.

What Happens If I Forget My Cryptomator Password?

Cryptomator vault access depends on the correct credentials or an applicable recovery mechanism configured for that vault.
If you lose both the password and any usable recovery information, the encrypted files may become permanently inaccessible.
Store recovery information securely when creating the vault.

Can Ransomware Encrypt Files That Are Already Encrypted?

Yes. If an encrypted drive or container is unlocked and its files are accessible to the operating system, ransomware may be able to modify or encrypt those files again. Encryption does not replace endpoint security, access controls or independent backups.

Frequently Asked Questions About Data Encryption

What is the easiest way to encrypt data?

For most people, the easiest starting point is the encryption feature built into their operating system. On supported Windows computers, use BitLocker or Device Encryption. On macOS, use FileVault. For individual files, a password-protected 7z archive is often convenient.

What is the best free encryption software?

The best option depends on what you want to protect. VeraCrypt is a strong choice for encrypted containers and supported storage devices. Cryptomator is designed for encrypting files before cloud synchronization. 7-Zip is useful for creating encrypted archives. All three provide free, open-source desktop software.

Is AES-256 encryption secure?

AES-256 is a well-established encryption algorithm widely used to protect sensitive information. When implemented correctly and combined with strong key management, it provides a high level of security. However, weak passwords, compromised devices or software vulnerabilities can still expose encrypted information.

Should I encrypt my entire computer?

Full-disk or device encryption is strongly recommended for laptops and other computers containing sensitive information, especially devices that could be lost or stolen.
It is also useful for desktop computers because physical access to an unencrypted drive can expose stored files.
Make sure you understand the recovery process before enabling encryption.

Can I encrypt files before uploading them to Google Drive or OneDrive?

Yes. Cryptomator can encrypt files locally before they are synchronized to supported cloud storage folders.
You can also upload encrypted 7z archives or VeraCrypt containers, although these may be less convenient for frequently changing files.

Is cloud storage already encrypted?

Major cloud storage providers generally encrypt data in transit and at rest. However, this does not always mean the provider is technically unable to access your files. If you require additional confidentiality, consider client-side encryption and review the provider’s current security and key-management policies.

Is VeraCrypt better than BitLocker?

Neither is universally better. BitLocker integrates closely with supported Windows editions and is convenient for encrypting Windows system drives and removable storage. VeraCrypt offers cross-platform desktop support and flexible encrypted-container features. The best choice depends on your operating system, compatibility requirements and preferred workflow.

Can encrypted data be recovered without a password?

Recovery depends on the encryption system and whether an authorized recovery mechanism exists. BitLocker, FileVault and other tools may provide recovery keys or account-based recovery options. Without the necessary credentials or recovery information, properly encrypted data may be effectively unrecoverable.

Does encryption protect against hackers?

Encryption helps protect data against certain threats, particularly unauthorized access to locked or stolen storage.
However, it does not prevent phishing, malware infection, account compromise or attacks against an already unlocked device.
Effective security requires multiple layers of protection.

Final Thoughts: How to Keep Your Data Secure With Encryption

Encryption is one of the most practical ways to protect personal and business information, particularly when files are stored on portable devices, external drives or cloud services. For Windows users, BitLocker and Device Encryption provide convenient built-in protection. Mac users can enable FileVault, while Linux users can take advantage of LUKS encryption during installation.

For more flexible requirements, free and open-source applications offer additional options. VeraCrypt can protect external drives and encrypted containers, 7-Zip can secure individual files in encrypted archives, and Cryptomator can encrypt information before it reaches cloud storage.

However, the most effective encryption strategy involves more than installing software.
Use strong passwords, maintain secure recovery-key backups, keep your devices updated and understand the difference between protecting data at rest and securing an active computer.

Above all, maintain independent backups. Encryption can prevent unauthorized people from reading your files, but it cannot guarantee that those files will never be lost or damaged. By combining appropriate encryption tools with sound password management, device security and reliable backups, you can significantly reduce the risk of sensitive information being exposed if a computer, USB drive or cloud account is compromised.

Media Credit: ExplainingComputers

• Share
• Tweet
• Pin
• Email

Filed Under: Guides

Disclosure: Some of our articles include affiliate links. If you buy something through one of these links, Geeky Gadgets may earn an affiliate commission. Learn about our Disclosure Policy.