File encryption makes the contents of selected files unreadable to people who do not have the required key or authentication. It does not necessarily hide that a file exists, protect every copy, stop malware from reading an unlocked file, or guarantee that you can restore lost data. Its value depends on what you encrypt, how you manage the keys, and whether you maintain usable backups.
What is file encryption?
File encryption is a way to protect the contents of individual files stored on a device. A cryptographic system transforms readable content into ciphertext. Someone—or software—with the required key and authentication can decrypt it and recover the readable file. NIST describes file encryption as applying encryption to individual files on storage, with access available after proper authentication (NIST SP 800-111).
As an Amazon Associate I earn from qualifying purchases.
In practical terms, a file may still be present on the drive, but its protected contents should not be readable to someone who lacks the means to decrypt it. The exact protection depends on the implementation and the strength and handling of its keys. CISA notes that some common office applications include file-encryption features; archive tools can also encrypt a collection of files in a container. These are different ways to apply the concept, not endorsements of particular products (CISA: How to Protect the Data that is Stored on Your Devices).
How is file encryption different from whole-device encryption?
File encryption protects the selected files or folders covered by the solution. Whole-device encryption is intended to protect a broader scope: CISA describes system encryption as protecting an entire hard drive, including the operating system, until the device is unlocked with the required credential (CISA).
#1 Best Overall
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Rugged Double-Layer Waterproof* Design - Protects the crypto drive against knocks, drops, break-in and submerging in water. The electronics are shielded by a hardended inner case. The rubberised silicone outer casing provides a final layer of protection
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
| Approach | Typical scope | Key consideration |
|---|---|---|
| Individual-file encryption | One or more selected files | Other files and copies may be outside the protected scope. |
| Archive or container encryption | A collection placed in an encrypted archive or container | Files must be put in the container, and its password or key must remain available. |
| Removable-drive encryption | Data stored on a selected USB drive or other removable storage | It protects the covered drive contents, not copies stored elsewhere. |
| Whole-device encryption | The device’s storage, according to the system’s design | It is broader than encrypting a document, but does not protect readable data from malware once the system is unlocked. |
These are scope distinctions, not a universal ranking. Choose according to whether you need to protect a few documents, a portable collection, removable media, or a device, and whether you can reliably manage the credentials and recovery process.
What does file encryption protect—and what can remain exposed?
It protects the contents within its scope
The purpose is to prevent someone who lacks proper authentication from reading the protected contents. That benefit applies only to the files and copies the chosen method actually covers. Encrypting one document does not automatically encrypt another copy in a downloads folder, an email attachment, or a backup.
It may not hide file details
Encryption should not be treated as a way to conceal every trace of a document. CISA warns that details such as the author and the date and time a file was created may remain visible even when its contents are protected (CISA). Depending on the method, filenames or other metadata may also remain exposed; check the particular implementation rather than assuming it hides them.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Temporary and out-of-scope data may remain
File and folder encryption does not necessarily cover temporary system artifacts. NIST SP 800-111 notes that swap and hibernation files may fall outside file/folder encryption’s protected scope in relevant configurations (NIST SP 800-111). A document can also be copied or exported into an unencrypted location. The key question is not simply “Did I encrypt the original?” but “Which versions and related data does this method cover?”
Encryption is not automatically proof of integrity or authorship
Confidentiality—keeping content from unauthorized readers—is different from integrity—detecting unauthorized changes—and source authentication—establishing who or what produced data. Do not assume that an “encrypted” label guarantees the latter two. NIST’s SP 800-38E Rev. 1 initial public draft, published September 3, 2026, states specifically that XTS-AES does not authenticate data or its source. That statement concerns XTS-AES; it should not be generalized to every encryption product or mode.
Rank #2
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
- SuperSpeed USB 3.0 - Transfer all your confidential files and folders faster than ever before. Works on both PC & Mac
Can malware read an encrypted file?
Encryption is not a substitute for keeping a device secure. When a user or application unlocks a file so it can be read, malware that can access the device or the user’s files may also be able to read, edit, or steal accessible data. CISA warns that malware on a device may access stored information (CISA).
Ransomware creates a separate risk: it may encrypt files the attacker can access, and attackers may also steal data. Protecting stored contents from an offline reader does not prevent those actions or undo them afterward. CISA recommends offline encrypted backups and regular testing of their availability and integrity in its #StopRansomware Guide.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →How should you set up file encryption safely?
- Back up the files first. CISA advises making a backup before starting encryption. Keep a copy you can restore if something goes wrong during the process (CISA).
- Identify the scope. Decide whether you need to encrypt a single file, a group in a container, removable storage, or the whole device. Check whether the method covers the copies and locations you care about; do not assume temporary artifacts are included.
- Understand the unlock and recovery process. Before encrypting, establish which password, key, or other authentication will be required and how recovery works for that specific method. Do not assume a vendor can recover a key unless its documented design says so.
- Encrypt using the chosen method’s documented steps. Common office applications may provide file-level controls, while archive utilities may encrypt a collection. Follow the relevant product’s current instructions; the general guidance here does not establish exact menus for a particular application.
- Secure the recovery material separately. Protect passwords and recovery keys, and make sure an authorized person can access them when needed. NIST identifies key protection, backup, recovery, and management as central key-management concerns in SP 800-57 Part 1 Rev. 5, published May 2020. CISA warns that losing required recovery information can lead to permanent data loss (CISA).
- Test access and restoration. Confirm that the intended recipient can open the protected file with the required credentials. Separately test that backups can be restored; a backup’s existence alone does not prove it is usable.
How do encrypted backups help?
Encryption and backup isolation solve different problems. Encrypting a backup protects its confidentiality if the backup is exposed. Keeping backup copies offline or otherwise isolated can make them harder for ransomware on the main device to reach, while multiple copies and restoration tests improve the chance of recovery. CISA recommends offline encrypted backups and regular testing (#StopRansomware Guide).
Neither measure alone covers every risk: an encrypted backup still depends on its recovery key, and an isolated backup still needs to be checked for availability and integrity. A practical plan accounts for both who can decrypt the backup and whether its contents can actually be restored.
How do you choose the right encryption approach?
- For a few sensitive documents: individual-file encryption may fit, provided you account for copies and retain recovery credentials.
- For a group of files to share or store together: an encrypted archive or container can simplify handling, but every intended file must be placed inside it and the recipient needs a secure way to obtain the credentials.
- For portable storage: removable-drive encryption can protect the covered drive if it is lost, but it does not encrypt other copies of the same files.
- For broader protection of a computer at rest: whole-device encryption covers a wider scope than selected-file encryption, while leaving unlocked-device access as a separate security concern.
- For recovery from device failure or ransomware: maintain isolated backups and test restoration; encryption alone is not a recovery plan.
Whichever approach you use, evaluate its scope, recovery design, metadata exposure, behavior after unlock, and whether it provides any integrity or source-authentication features you specifically need. Do not infer those features from the word “encryption.”
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
