What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use your operating system’s built-in encryption whenever it is available: BitLocker or Device Encryption on Windows, FileVault on macOS, and LUKS during Linux installation. Encryption protects files when a computer or drive is lost, stolen, or connected to another computer—but it can also lock you out permanently if you lose the recovery key. Save and verify that key before changing firmware, boot settings, or hardware.
What hard-drive encryption protects
Full-volume encryption converts data on a drive into ciphertext that cannot be read without the required unlock credential. It is designed to protect stored data when a device is powered off, lost, stolen, or when its drive is removed and attached to another computer.
Encryption does not protect files that are already open in a running session, data exposed in memory, or an account that an attacker can use after you unlock the computer. Sleep can also leave some systems exposed to direct-memory-access attacks, so shut down when handling a high-risk device.
Before you turn encryption on
- Back up important files before changing partitions or encryption settings.
- Keep the computer connected to power while initial encryption runs.
- Save the recovery key somewhere independent of the encrypted drive. Use more than one controlled copy when appropriate.
- Confirm that the key is visible or retrievable in the relevant account before changing firmware, TPM settings, boot configuration, or hardware.
- After setup, shut down and test the normal unlock process and the recovery path.
Choose the right method
| Platform or tool | Built in? | Best use | Recovery and hardware protection | Important limitation |
|---|---|---|---|---|
| Windows Device Encryption | Yes, on supported devices | Simple protection with minimal setup | Recovery key is associated with a Microsoft or work/school account; supported systems commonly use TPM-backed protection | Availability depends on device and edition |
| Windows BitLocker | Yes on supported Windows editions | Advanced control over internal volumes | Recovery-key workflow plus TPM options | Administrative edition and hardware requirements vary |
| macOS FileVault | Yes | Encrypting a Mac startup disk | Apple-silicon and T2 Macs handle FileVault keys in the Secure Enclave | Losing both account recovery and the FileVault key can permanently prevent access |
| Linux LUKS | Often offered by installers | Linux full-disk encryption | Recovery depends on the passphrase or key material you configure; hardware support varies | Exact steps depend on distribution, release, boot layout, and dual-boot design |
| VeraCrypt | No; third-party | Cross-platform containers or Windows system encryption where built-in support is unavailable | System encryption uses a pre-boot password; rescue media and backups are essential | More manual administration and recovery responsibility |
Encrypt a Windows drive
Check Device Encryption first
- Open Settings > Privacy & security > Device encryption.
- If the option is available, review the recovery-key account shown by Windows and make sure you can retrieve the key.
- Turn on Device Encryption and leave the device connected to power until Windows finishes.
Windows may enable Device Encryption automatically on supported hardware. A Microsoft account or a work/school account can hold the recovery key, depending on how the device is managed.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Use BitLocker for advanced controls
- Open File Explorer, right-click the drive, and choose Turn On BitLocker. You can also open the BitLocker management page from Windows search or Control Panel.
- Choose where to save the recovery key and verify that the saved copy is accessible.
- Select the encryption scope. Choose Encrypt entire drive when the disk has previously contained data that was deleted or reformatted.
- Start encryption and keep the computer powered until the process completes.
BitLocker’s used-space-only mode is faster on a new or empty disk, but deleted-file space is not encrypted in that mode. Full-drive encryption is the safer choice for a previously used disk.
When Windows asks for the recovery key
Recovery can be triggered by firmware, boot-configuration, TPM, or hardware changes—not only by a forgotten password. Retrieve the key before making those changes. If no valid key exists, encrypted data may be unrecoverable.
Rank #2
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Encrypt a Mac with FileVault
- Open System Settings > Privacy & Security > FileVault. The wording and location can vary slightly by macOS release.
- Choose Turn On FileVault and select the offered recovery method.
- Record the recovery key somewhere other than the encrypted startup disk. If you use an account-based reset option, make sure that account remains accessible.
- Keep the Mac connected to power while encryption completes.
On Apple-silicon and T2 Macs, Apple says FileVault key handling occurs in the Secure Enclave and the encryption keys are not directly exposed to the CPU. If you lose both your login-password recovery route and the FileVault recovery key, Apple warns that you will not be able to log in and your files and settings can be lost permanently.
Encrypt a Linux installation with LUKS
During installation
Many Linux distributions offer LUKS-based full-disk encryption in the installer. Select the encryption option, create a strong passphrase, and store any displayed recovery material away from the computer. The installer may create separate unencrypted boot partitions as required by the distribution; follow its boot-layout guidance.
Recommended Free Tools
Rank #3
- World’s First 6TB 2.5” Portable Hard Drive
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
Dual-boot systems
Dual-boot arrangements need special care. Ubuntu documentation notes that users may need to retain separate Ubuntu and Windows recovery keys. Record each key with a clear label before changing either operating system’s boot or firmware configuration.
Existing installations
Encrypting an already installed Linux system is distribution- and layout-dependent. Back up first and follow the current documentation for that distribution rather than applying a generic command to a live system. Confirm how boot, swap, hibernation, and hardware-backed unlocking are handled.
Rank #4
- Hardware encrypted drive
- Simple to use pin access. RPM-5400
- Administrator password feature
- Bus powered
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
Use VeraCrypt when built-in tools do not fit
VeraCrypt can create encrypted containers and can encrypt a Windows system partition or entire boot drive. System encryption uses pre-boot authentication, so the password is required before Windows starts.
- Install VeraCrypt from its official distribution channel and read the current system-encryption documentation.
- Back up the drive and create the required rescue media before starting.
- Choose system encryption or an encrypted container according to whether you need the whole Windows boot drive protected or only selected files.
- Test the password, rescue media, and backup before relying on the encrypted system.
VeraCrypt is useful when Windows edition support is unavailable or when you need a portable encrypted container, but you are responsible for its password, rescue procedures, and backups.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Best Value
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Can you encrypt an external hard drive?
Yes. BitLocker To Go can encrypt supported removable Windows volumes, VeraCrypt can create encrypted containers on removable disks, and Linux can use LUKS for drives that will be unlocked on compatible Linux systems. macOS can encrypt removable media with its disk tools, but compatibility with Windows or Linux depends on the format and software used.
- Choose a method supported by every computer that must access the drive.
- Keep the recovery key or passphrase separate from the drive itself.
- Test unlocking the drive on the intended operating systems before storing the only copy of important data on it.
- Expect encryption to protect data at rest, not files while the external volume is mounted and unlocked.
Recovery-key and troubleshooting checklist
The key is missing
Stop changing hardware or boot settings. Check the Microsoft account or organization account used during Windows setup, the location where you exported or printed the key, and any managed-device records. For FileVault, check the recovery method selected when encryption was enabled. Without a valid key or password, there may be no technical bypass.
Encryption appears stuck
Keep the device on AC power and allow the process to finish. Check the operating system’s encryption status rather than interrupting it. Maintain a current backup before retrying or changing partitions.
The computer requests recovery after an update
Use the saved recovery key, then review recent firmware, TPM, boot-order, or hardware changes. Do not disable encryption simply to avoid the prompt; confirm that the recovery key is stored and that normal startup works after the change.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsQuick Recap
Best-practice sequence
- Back up the data.
- Choose the operating system’s built-in encryption unless you have a specific reason to use VeraCrypt or another method.
- Save and verify the recovery key before encryption begins.
- Use full-drive encryption for disks that have previously held sensitive data.
- Complete encryption on external power.
- Shut down, unlock normally, and test recovery before deploying the device.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
