Encrypting your drive is not an advanced IT task anymore — it takes five minutes on any modern OS, runs transparently in the background, and makes a stolen laptop or lost USB drive worthless to the thief. If your device is not encrypted in 2026, you are one lost bag away from a data breach. Here is how to do it right.
What changed in 2026
- BitLocker is now in Windows 11 Home. Microsoft finally enabled device encryption (a subset of BitLocker) by default on new Windows 11 Home installs on qualifying hardware — but it silently backs the recovery key to your Microsoft account, which not everyone wants.
- Apple Silicon Macs encrypt by default. Every M-series Mac has hardware-level encryption tied to the Secure Enclave; FileVault just adds a software layer requiring your password at boot.
- NVMe speeds make overhead zero. AES-NI hardware acceleration means you will not measure any performance difference with encryption enabled on modern SSDs.
- VeraCrypt 2.x improved usability significantly with a redesigned wizard and better default cipher selection.
Which tool to use
| Platform |
Built-in option |
Third-party alternative |
| Windows 11 Pro/Enterprise |
BitLocker |
VeraCrypt |
| Windows 11 Home |
Device Encryption (limited) |
VeraCrypt |
| macOS (Apple Silicon) |
FileVault (verify it's on) |
VeraCrypt |
| Linux |
LUKS (via cryptsetup) |
VeraCrypt |
| External / USB drive (any OS) |
BitLocker To Go |
VeraCrypt |
How to enable BitLocker (Windows)
- Search for "Manage BitLocker" in the Start menu and open it.
- Click Turn on BitLocker next to your system drive (C:).
- Choose how to unlock at startup: TPM only (transparent, recommended for most users) or TPM + PIN (stronger).
- Save your recovery key — print it or save to a USB drive that stays separate from the laptop. Do not save only to your Microsoft account if you value privacy.
- Choose Encrypt used disk space only for a new drive; encrypt entire drive for an existing drive with real data.
- Run the compatibility check and restart. Encryption runs in the background — typically done within an hour for a 500 GB SSD.
To verify: open File Explorer. An unlocked padlock icon on the C: drive means BitLocker is active.
How to enable FileVault (macOS)
- System Settings → Privacy & Security → FileVault.
- Click Turn On FileVault.
- Choose: store recovery key with Apple (requires Apple ID) or store it locally. For high privacy, choose local and write down the key.
- Restart. FileVault encrypts in the background; the Mac is usable throughout.
On Apple Silicon, check System Settings → General → About — if FileVault shows "On," you are protected.
How to encrypt with VeraCrypt
VeraCrypt is best for portable drives, cross-platform containers, or when you want open-source auditability.
- Download VeraCrypt from veracrypt.fr — verify the signature.
- Choose: Encrypt a non-system partition/drive (for external drives) or Create an encrypted file container (portable, works on any drive).
- Select AES + SHA-512 — the default and well-tested combination.
- Set a strong passphrase (20+ characters, or a long random phrase).
- Format and write the volume. Mount it in VeraCrypt to use it.
For full-system encryption on Windows, VeraCrypt also supports encrypting the system partition with pre-boot authentication.
How to pick
- Daily driver laptop → BitLocker or FileVault. Transparent, no performance hit, integrates with OS recovery.
- External drive you share between OSes → VeraCrypt. Works on Windows, Mac, and Linux.
- High-security needs with deniability → VeraCrypt hidden volume. Creates a plausibly deniable outer/inner volume.
- NAS or Linux server → LUKS. Native, well-supported, scriptable.
Common mistakes
Storing the recovery key only on the encrypted drive. If you forget the password, the data is gone. Keep the key on paper, a USB in a safe, or a password manager.
Encrypting only some folders. Partial encryption leaves temp files, swap, and hibernation files unencrypted — those can contain sensitive data. Full-disk encryption is the only safe option.
Forgetting external drives. Your laptop may be encrypted, but your backup USB drive is not. Encrypt everything.
Using "password protection" in Office or ZIP as encryption. These are not full encryption. A forensic tool cracks them in seconds.
Skipping BitLocker on work laptops. Corporate compliance almost always requires it; IT will thank you and so will insurance.
What to skip
- "Folder Lock" style apps that claim to encrypt but just hide files.
- BitLocker with no recovery key saved — Microsoft account lockouts happen, and you will lose everything.
- Very old algorithms like 3DES or Blowfish — VeraCrypt offers them but AES-256 is the correct choice.
FAQ
Does encryption slow down my SSD?
Not in any measurable way on hardware made after 2020 that supports AES-NI. Benchmarks show under 1% overhead.
What happens if I lose my BitLocker recovery key?
The drive is permanently inaccessible. There is no backdoor. Back up the key before enabling.
Can the police decrypt BitLocker?
Not without the key or a significant vulnerability. BitLocker with a strong PIN and no Microsoft account backup is effectively inaccessible without the key.
Should I encrypt even if I have "nothing to hide"?
Yes — your tax returns, passwords, medical records, and banking session cookies are on that drive. Encryption is just basic hygiene.
Where to go next
See How to secure your router in 2026, How to remove malware in 2026, and How to set up two-factor authentication in 2026.