Disk & file encryption

• Lost or stolen devices. The most common case. With full-disk encryption and a strong passphrase, a powered-off laptop or phone reveals next to nothing.
• Seizure and searches. Police or border agents can copy an unencrypted drive in minutes. Encryption means they have to ask you for the key, and then the law of the country you are in decides what happens next (see Hidden volumes and compelled decryption).
• Evil maid attacks. Someone with brief, unobserved access tampers with the unencrypted boot code or the hardware so that it captures your passphrase the next time you type it. Secure Boot, a pre-boot PIN and keeping devices with you reduce the risk.
• Memory attacks. While a computer is on or asleep, the disk key sits in memory, where an attacker with physical access and the right tools may be able to extract it. Shut down or hibernate before leaving a device unattended.
• Cloud providers. Files you sync are readable by the provider unless you encrypt them on your device first (see Files, folders and cloud storage).

Full-disk or file encryption?

Full-disk encryption covers a whole drive, including the operating system, temporary files, swap and hibernation files. You unlock it once at startup, and everything is protected when the device is off. File or container encryption protects chosen files or folders, for example before uploading them to cloud storage, sending them to someone or copying them to a USB stick. It does not protect the traces your system leaves elsewhere (thumbnails, temporary files, recent-file lists) unless the system drive is encrypted too. Most people should use both: full-disk encryption on every device, plus file encryption for data that leaves it.

Both tools encrypt a whole partition or drive and ask for your passphrase before the operating system starts, or before a data drive is mounted. Neither needs an account or sends keys anywhere.

FileVault and BitLocker are convenient and far better than no encryption at all. Their code is closed, so outside experts cannot check how keys are handled, and both can tie disk recovery to the vendor's account system: BitLocker does so by default on personal PCs, FileVault as an option. That is why they rate below the open-source tools here.

These tools encrypt individual files, folders or archives. Use them for files you upload to cloud storage, send to someone or carry on a USB stick, and on top of full-disk encryption for your most sensitive data. For cloud services that encrypt end to end themselves, see Cloud storage.

iPhones and Android phones encrypt their storage once you set a screen lock; there is nothing to install. Android has required file-based encryption on all devices launched with Android 10 or later. How much an attacker can get depends mostly on your passcode and on what state the phone is in.

Before and after first unlock

After a restart, most data stays encrypted until you enter your passcode for the first time. This state is called BFU (before first unlock). Once you have unlocked the phone, many keys stay in memory even after the screen locks again, so apps can keep working in the background. This is AFU (after first unlock). On iPhone, data from third-party apps is protected only until first unlock by default, and Android's credential-encrypted storage likewise opens at the first unlock. A phone in AFU state gives forensic tools far more to work with; see Digital forensics.

• Use a long passcode. Phones limit guessing in hardware, but a longer passcode still helps if those limits are ever bypassed. An alphanumeric passcode is stronger than a short PIN.
• Restart or power off the phone when it may be taken from you, for example before a border crossing or a protest. GrapheneOS can restart a locked phone automatically; the timer is 18 hours by default and can be shortened.
• Turn off fingerprint and face unlock in risky situations. EFF notes that fingerprints are less protected than passwords, both legally and technically.
• Encrypt files before they go to cloud backups you do not control, for example with Cryptomator.

Encryption does not help if you can be made to hand over the password. Some countries make refusal a crime: in the UK, knowingly failing to comply with a decryption notice under section 49 of the Regulation of Investigatory Powers Act carries up to two years in prison, or five in national security and child indecency cases. In the US, courts are split on whether the Fifth Amendment protects you from being forced to reveal a password. Laws differ widely, so check the rules where you live and where you travel.

How VeraCrypt hidden volumes work

An encrypted VeraCrypt volume looks like random data. A hidden volume sits inside the free space of an ordinary (outer) volume and has its own password. The outer password opens decoy files; the hidden password opens the real ones, and it should not be possible to prove that the hidden volume exists. VeraCrypt can also hide a whole Windows installation behind a decoy system. See VeraCrypt's plausible deniability documentation.

You rarely need to change the defaults. Every tool in this guide uses well-studied ciphers; in practice, data is lost through weak passphrases, badly stored keys and bugs in the software around the cipher, not through broken algorithms.

What about quantum computers?

Quantum computers threaten public-key cryptography, not well-sized symmetric ciphers. The UK's NCSC says symmetric algorithms with at least 128-bit keys, such as AES, can continue to be used, and AES-256 adds margin. Disk encryption unlocked with a passphrase is therefore fine. Files encrypted to someone's public key are different: data recorded today could be decrypted later if large quantum computers arrive. Both age (since v1.3.0) and GnuPG (2.5 series) now offer hybrid post-quantum encryption.

• Encrypt before you store sensitive data. Deleting files from an SSD or flash drive does not reliably erase them, because the drive moves data around internally. Starting with an encrypted drive avoids the problem.
• Use a passphrase of six or more random words for disk encryption, generated with dice or a password manager rather than invented. See Passwords.
• Add a pre-boot PIN or passphrase. TPM-only unlocking, the BitLocker default and common on Linux setups that unlock automatically, boots the computer without you, and has repeatedly been shown to be bypassable with physical access.
• Shut down or hibernate before leaving a device. Sleep keeps the disk key in memory. Microsoft itself advises hibernating or shutting down before a device leaves your control.
• Store recovery keys offline, printed or on a USB drive kept somewhere safe, and not in the cloud account of the company that makes the encryption.
• Keep encrypted backups in more than one place, and test that you can restore them. A failed drive or a forgotten passphrase means the data is gone for good. For LUKS, also back up the header with cryptsetup luksHeaderBackup.
• Encrypt external drives and USB sticks too. They are the easiest to lose, and Windows device encryption does not cover them.
• Do not rely on a drive's built-in hardware encryption alone. In 2018, researchers found that many self-encrypting SSDs could be read without the password. Use software encryption on top.
• Keep encryption software updated. VeraCrypt 1.26.29 added support for Microsoft's 2023 Secure Boot certificates, and 1.26.30 asks you to recreate the Rescue Disk after bootloader certificate changes. Windows system-encryption users should update before major Windows feature updates.

• Assuming a locked screen means encrypted data. While the computer is on, the disk is unlocked.
• Not knowing where your recovery key is. On many Windows PCs it was uploaded to a Microsoft account during setup; on local-account PCs, automatic encryption may never have protected the key at all.
• Keeping a large VeraCrypt container in a sync folder. Sync services may re-upload the whole file after every change, and older versions kept by the service can undermine hidden-volume deniability. Use Cryptomator for cloud folders.
• Using ZIP encryption with default settings. Classic ZipCrypto is weak, and standard ZIP encryption does not hide file names.
• Forgetting the copies. Thumbnails, temporary files and cloud backups can survive outside an encrypted container. Full-disk encryption covers the local ones; cloud copies need their own protection.
• Relying on hidden volumes without reading their requirements. See Hidden volumes and compelled decryption.
• Keeping only one copy of the key or passphrase. Strong encryption has no reset button.

• VeraCrypt documentationveracrypt.ioBeginner's tutorial, system encryption and plausible deniability.
• EFF Surveillance Self-Defense: Keeping Your Data Safessd.eff.orgDevice encryption for phones and computers, for non-experts.
• EFF: Digital Privacy at the U.S. Bordereff.orgCompelled decryption, powering off devices and what border agents can do.
• Apple Platform Security: Data Protection classessupport.apple.comWhich iPhone data stays encrypted when the phone is locked or restarted.
• Android: File-based encryptionsource.android.comCredential-encrypted and device-encrypted storage, and Direct Boot.
• Microsoft: BitLocker countermeasureslearn.microsoft.comMicrosoft's own account of attacks on TPM-only unlocking and how a PIN helps.