A laptop is stolen from a car. It has a login password, which feels like protection.
Without disk encryption, it is not. The drive can be removed and connected to another computer, or the machine booted from external media, and every file read without ever encountering the login screen. A login password protects the operating system's session; it does nothing about the storage underneath.
Full-disk encryption changes that. The data is unreadable without the key, so a thief gets hardware.
What changed in 2026
- Default-on encryption became near-universal. Modern phones and laptops ship encrypted, frequently without the user knowing.
- Hardware-backed key storage spread. Dedicated security chips made encryption both stronger and more transparent.
- Recovery key handling stayed the weak point. Lost keys remained the most common way people lose data to their own encryption.
- External media stayed largely unencrypted. Backup drives and portable storage remained the common gap.
What it protects
| Scenario |
Encryption helps? |
| Device stolen while powered off |
Yes — data unreadable |
| Device stolen while locked |
Generally yes |
| Device stolen while logged in and unlocked |
No — everything is accessible |
| Drive removed and read elsewhere |
Yes |
| Device sold or disposed of |
Yes, if the key is destroyed |
| Remote compromise while you use it |
No — the data is decrypted for you |
| Someone with your passcode |
No |
The distinction that matters: encryption protects data at rest. Once you have authenticated and are using the device, the data is decrypted and available — to you, and to anything running on the device.
So encryption addresses theft and disposal. It does nothing about malware, phishing, or someone watching over your shoulder. It is one layer, not a general answer.
The recovery key
The part that causes actual data loss.
Encryption is only meaningful if the data is genuinely unrecoverable without the key. Which means if you forget your passcode and lose the recovery key, your data is gone — not difficult to recover, gone.
Where the recovery key lives depends on the platform: linked to a cloud account, stored in an organisation's directory, or printed and given to you at setup. Knowing which applies to your device, and where yours actually is, is worth five minutes now rather than during an emergency.
Two practical notes. Storing the recovery key only on the encrypted device is circular and useless. And if the key is tied to a cloud account, losing access to that account can mean losing access to the device — which makes that account's security and recovery path more consequential than it appears, per account recovery planning.
The gaps
External drives. The backup drive holding a copy of everything is frequently unencrypted, sitting next to the encrypted laptop it backs up. Encrypting external media is straightforward on modern systems and routinely skipped.
Old devices. A laptop from before default encryption may never have had it enabled. Checking rather than assuming is worth doing for anything still in use.
Disposal. Selling or discarding a device without securely erasing it can leave data recoverable. On an encrypted device, destroying the key is generally sufficient and much faster than overwriting — see secure deletion explained.
Sleep versus shutdown. A sleeping device may hold keys in memory, so it is closer to unlocked than to powered off. For genuinely sensitive situations — crossing a border, leaving a device unattended — shutting down fully is meaningfully different from closing the lid.
Common mistakes
- Assuming a login password protects the drive. It does not.
- Not confirming encryption is enabled. Defaults vary, especially on older devices.
- Losing the recovery key. Permanent data loss.
- Storing the recovery key on the encrypted device. Circular.
- Unencrypted external backups. The common gap.
- Sleeping rather than shutting down when it matters. Keys may be in memory.
- Selling a device without destroying the key. Data may be recoverable.
FAQ
How do I check whether my device is encrypted?
There is a setting in system security preferences on every major platform showing encryption status. Worth checking on every device you own, including older ones.
Does encryption slow the device?
On modern hardware with dedicated support, the effect is negligible. This was a genuine concern a decade ago and is not now.
What about phones?
Modern phones are encrypted by default and tied to the passcode. This is why a strong passcode matters more than it appears — it is the encryption key in practice.
Does this protect against a compelled unlock?
That depends on jurisdiction and circumstance, and is a legal question rather than a technical one. Encryption protects against someone reading the drive; it does not protect against being required to unlock it.
Where to go next
For securely disposing of a device, read secure deletion explained. For the account that may hold your recovery key, account recovery planning, and for protecting devices while travelling, travel device security.