The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Volume encryption protects an entire NAS volume; shared-folder encryption protects only the shared folders you select. On a Synology system, an encrypted volume can include shared folders, LUNs, installed-package data, files, folders and metadata. Shared-folder encryption creates separate encrypted containers for chosen shares instead.
That difference determines what remains protected if drives are removed, how many services are affected when you lock or unlock data, which filenames and protocols work, and where recovery keys must be kept. Choose volume encryption when you need consistent coverage for everything in a volume. Choose shared-folder encryption when only specific data needs isolation or when your NAS cannot use suitable volume encryption.
As an Amazon Associate I earn from qualifying purchases.
What the two encryption scopes actually cover
Volume encryption secures the volume as a whole
A NAS volume is the storage area on which shared folders, application data and, on some platforms, logical unit numbers (LUNs) are created. Volume encryption applies at that storage layer. Synology describes the protected target as “Volumes (Shared Folders, package data, and LUNs).” Its volume-encryption white paper says that all data and metadata within an encrypted volume—including files, folders, shared folders, LUNs and installed packages—are stored in encrypted form.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteThis broad scope reduces the chance that an administrator creates a new share or installs a service and accidentally leaves its data unencrypted. It also means the encryption boundary is larger: one volume key and one unlock state can govern many users, shares and applications.
#1 Best Overall
- Your Personal Streaming Server - Build your own Netflix-style media library and stream 4K movies, shows and photos to any device without monthly fees
- Create Your Own Cloud - Store your entire photo, video and music collection; access from anywhere with fast 282 MB/s transfer speeds
- Creator-Grade Backup Solution - Protect your irreplaceable content with automated backups to cloud services, external drives and remote NAS
- Multi-Layered Data Protection - Combine RAID redundancy, automated backups and snapshot technology to prevent data loss from any cause
- Smart Home Surveillance - Support up to 30 IP cameras with AI detection, instant alerts and secure remote monitoring
Shared-folder encryption secures selected shares
Shared-folder encryption applies to an individual shared folder rather than to every object on a volume. You can leave ordinary media or scratch data unencrypted while placing payroll, legal, client or research data in encrypted shares. Separate folders can have separate keys or unlock schedules, depending on the NAS operating system.
Selective scope is useful when only a department needs isolation, but it creates an inventory responsibility. Every sensitive folder must be identified, and a later folder created outside the encrypted set is not protected by default. Package data, indexes, temporary files and LUNs outside the encrypted folders remain outside that protection boundary.
| Question | Volume encryption | Shared-folder encryption |
|---|---|---|
| Protected target | Entire volume, including the shared folders and other supported data stored there | Only the selected shared folders |
| Typical key boundary | Volume-level unlock; one event can make many services available | Folder-level unlock; different folders can have separate boundaries |
| Risk of overlooking a new share | Lower, because new data on the encrypted volume inherits the volume boundary | Higher, because each sensitive share must be created or moved into the encrypted set |
| Effect of locking | Potentially affects every service and share using that volume | Affects the locked folder and any application that depends on it |
What encryption protects—and what it does not
Theft and offline access are the primary threat
Both methods are mainly controls for data at rest. If an attacker steals the NAS, removes its disks, or obtains a disk outside the running NAS, the encrypted blocks should be unreadable without the key. This is the reason to encrypt a NAS that stores personal records, business documents, backups or regulated information in a location that could be physically accessed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Encryption does not make an online NAS invisible or automatically safe. A user who has permission to a folder can normally read its contents after the NAS has unlocked it. Network access controls, strong administrator authentication, least-privilege accounts, current firmware, segmentation and monitoring remain necessary.
Backups need their own encryption decision
Encrypting the source NAS does not automatically encrypt a backup disk, USB device, cloud target or second NAS. QNAP explicitly states that source-NAS encryption “does not automatically encrypt the backup media.” If an unencrypted backup is stolen, the source volume’s encryption offers no protection for that copy.
For every backup destination, confirm whether encryption is enabled, where its key is held, and whether the backup software preserves encrypted-folder data and permissions. A restore test should include the case in which the original NAS and its keys are unavailable.
Rank #2
- Supports drives on the model's official compatibility list
- Up to 522/565 MB/s sequential read/write throughput supports stable data transfers.
- Dual 2.5GbE ports provide fast network transfer speeds and increased redundancy.
- Leverage built-in file and photo management, data protection, virtualization, and surveillance solutions.
- Backed by Synology's 3-year limited hardware warranty.
Comparison by the decisions that matter
| Decision factor | Volume encryption | Shared-folder encryption |
|---|---|---|
| Coverage | Broad protection for supported data on the volume, including shares, LUNs and package data on implementations such as Synology’s | Protection limited to designated shared folders |
| Deployment | May require a supported NAS model, compatible firmware and, on some platforms, creation of a new encrypted volume | Usually added per folder, but availability still depends on the NAS model, firmware and storage type |
| Filename and path compatibility | Can have fewer restrictions; Synology documents a 255-character maximum filename length for volume encryption | Can impose tighter limits; Synology documents 143 characters for shared-folder encryption |
| Protocol compatibility | Depends on the services supported by the encrypted volume | Some services can have folder-specific restrictions; QNAP documentation says some encrypted folders cannot be accessed through NFS |
| Path changes | Managed at the volume and share layers supported by the platform | QNAP states that encrypted-folder paths cannot be changed |
| Application behavior | Applications whose data resides on the volume are covered, but they may be unavailable until the volume is unlocked | Applications that use a locked folder may fail, show missing data or require a restart after unlock |
| Key handling | Protect the volume key and plan for a broad unlock event | Protect each folder key and track which people or services need each one |
| Performance evidence | No comparable cross-vendor benchmark figure is established in the cited vendor material. Results depend on the NAS CPU and encryption acceleration, filesystem, disk layout, workload and implementation. | |
Vendor-specific requirements and limits
Synology
Synology’s volume-encryption feature requires DSM 7.2 or later and a supported model. Compatibility is therefore a model-and-firmware question, not a guarantee for every DiskStation or RackStation. Check the support matrix for the exact NAS before planning a migration.
Synology lists a 255-character maximum filename length for volume encryption and 143 characters for shared-folder encryption. If a business uses deeply nested project folders, long legal-document names or software that generates long paths, audit those paths before choosing the narrower boundary.
DSM 7.3 specifications list support for up to 218 encrypted shared folders. That is a stated platform capacity, not a recommendation to create that many keys or an assurance that every application performs equally well at the limit.
Because a volume can contain package data and LUNs as well as shares, volume encryption can provide a more uniform protection boundary. It can also make a volume-wide unlock or recovery event more consequential for services that start automatically.
QNAP
QNAP documents shared-folder encryption using 256-bit AES in QTS 5.2.x documentation. Actual behavior varies with QTS or QuTS hero version, NAS model and storage type, so verify the feature for the exact combination you operate.
QNAP’s folder-encryption instructions state that encrypted-folder paths cannot be changed. The same documentation warns that some encrypted folders cannot be accessed through NFS. Applications, containers, virtualization, indexing and backup jobs that expect a fixed path or NFS access should be tested before production use.
Rank #3
- Secure private cloud - Enjoy 100% data ownership and multi-platform access from anywhere
- Easy sharing and syncing - Safely access and share files and media from anywhere, and keep clients, colleagues and collaborators on the same page
- Automated Backup Protection - Set-and-forget backups for Macs, PCs and mobile devices to multiple destinations including cloud and external drives
- Home Security System - Record and monitor your property 24/7 with support for multiple IP cameras and remote viewing
- 2-Year Warranty - Reliable hardware backed by Synology's expert customer support team and ongoing software updates
QNAP also describes an auto-unlock option: saving the key can allow an encrypted shared folder to unlock automatically after a restart. If that option is disabled, an administrator must unlock the folder manually. Auto-unlock improves availability after a reboot, but anyone who gains control of the running NAS may obtain access without a separate manual key-entry step.
When volume encryption is the better choice
- You need a default-deny storage boundary. If nearly everything on a volume is sensitive, encrypting the volume avoids maintaining a list of protected shares.
- Services store data in more than one place. Shared folders, LUNs and package data can be covered together when the platform supports them inside the encrypted volume.
- You can tolerate a wider unlock event. A reboot, maintenance operation or recovery may require the volume to be unlocked before many applications become usable.
- The NAS and firmware are supported. Confirm model support and whether the platform requires a newly created encrypted volume. Plan migration time if existing data cannot simply be converted in place.
Volume encryption is not automatically superior. Its broad boundary can increase the impact of a lost key, a failed unlock or a maintenance window. It can also force you to address compatibility for every application and protocol using that volume.
When shared-folder encryption is the better choice
- Only a subset of data is sensitive. A media library or public project area can remain ordinary while confidential folders receive separate protection.
- Departments need separate control. Independent folder keys and lock states can limit who can unlock a particular department’s data.
- The platform lacks suitable volume encryption. Folder encryption may be the available at-rest option on a model or firmware branch that cannot create encrypted volumes.
- You need a smaller failure boundary. Locking one project folder need not make unrelated shares unavailable, provided no application depends on that folder.
Selective encryption demands better administration. Maintain a current inventory of sensitive folders, check every application’s data path, and review new-share procedures so that confidential data is not placed in an unencrypted location by mistake.
Recommended Free Tools
Plan the keys before turning encryption on
Export a recovery key and keep it separate
The key is the difference between encrypted data and recoverable encrypted data. QNAP strongly recommends exporting and saving the encryption key. Do not keep the only copy on the same NAS, in an unencrypted share or in the same equipment rack. A thief, fire, power event or ransomware incident could otherwise remove both the data and its only recovery path.
Store an exported key offline or in a separately protected key-management system. An offline USB device can be appropriate if it is encrypted or physically secured, labeled without revealing sensitive details, and included in an access-controlled custody process. Keep at least one recovery copy in a different physical location from the NAS.
Decide whether automatic unlocking is acceptable
Automatic unlocking is a continuity feature, not a stronger security mode. It lets services resume after a restart without an administrator entering a key, but the key must be available to the NAS. Manual unlocking preserves a stronger separation between booting the system and releasing protected data, at the cost of a human intervention during outages.
Rank #4
- One Place for All Your Data - Consolidate scattered files from multiple computers, phones and external drives into one accessible hub with 100% ownership
- Professional File Collaboration - Share projects with clients, sync documents across teams and maintain version control without Dropbox fees
- Automated Backup Protection - Set-and-forget backups for Macs, PCs and mobile devices to multiple destinations including cloud and external drives
- DIY Surveillance System - Transform IP cameras into a professional monitoring solution with motion alerts, recording schedules and remote viewing
- 2-Year Warranty - Reliable hardware backed by Synology's expert customer support team and ongoing software updates
Base the choice on the site’s physical security, recovery-time objective and staffing. Document who may unlock each volume or folder and how that person is authenticated. For high-sensitivity data, consider leaving auto-unlock disabled and accepting the recovery step.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Deployment checklist
Before enabling volume encryption
- Record the NAS model, firmware or DSM/QTS/QuTS hero version, filesystem and storage layout.
- Confirm that the exact model supports volume encryption and note any requirement to create a new volume.
- List every shared folder, LUN, package, container, virtual machine and backup job that uses the volume.
- Measure filename and path lengths, and identify protocols such as NFS that applications require.
- Make a separate, restorable backup. Verify that the backup destination has its own encryption setting.
- Create the encrypted volume through the NAS storage-management wizard, generate the key and export it before moving production data.
- Move or restore a representative data set, start each dependent service, and test access from every required protocol.
- Reboot during a maintenance window to test the documented unlock or auto-unlock behavior.
- Record the key’s custody location and perform a recovery test on a schedule.
Before enabling shared-folder encryption
- Classify data by sensitivity and identify the exact folders that require encryption.
- Check filename limits, fixed-path requirements, snapshots, replication, backup software, indexing, containers and application compatibility.
- Confirm whether required clients use SMB, NFS or another protocol; on QNAP, test any NFS dependency because some encrypted folders cannot use it.
- Create the encrypted folder, set its key or passphrase, and export the recovery key immediately.
- Test reading and writing while the folder is unlocked, then lock and unlock it to observe application and permission behavior.
- Decide whether the folder should auto-unlock after restart. Document the decision and the authorized unlock operators.
- Update onboarding and data-placement procedures so sensitive files cannot be redirected to an ordinary share.
Common failure modes and practical fixes
“The NAS rebooted, but the application says its data is missing.”
The encrypted volume or folder is probably still locked. Unlock it with the approved key, then restart the dependent service if it does not detect the path automatically. If auto-unlock was expected, check whether the key was saved, whether the setting was disabled, or whether a firmware change cleared it.
“A file copied from a workstation will not open or the path is too long.”
Compare the path and filename with the platform’s encrypted-storage limits. On Synology, the documented maximum differs between volume encryption (255 characters) and shared-folder encryption (143 characters). Shorten the path, reorganize directories or select a storage boundary whose documented limit accommodates the application.
“An NFS client cannot mount the encrypted folder.”
Check the NAS documentation for the exact model and encryption mode. QNAP notes that some encrypted folders cannot be accessed through NFS. Use a supported protocol for that data, place the workload on a compatible encrypted location, or redesign the application’s storage path.
“The backup completed, but the backup disk is readable without a key.”
Source encryption did not transfer to the destination. Enable encryption on the backup target or backup job, export and protect its separate key, and run a restore test. Treat every copy as an independent data-at-rest boundary.
“The key file is lost.”
Do not delete, reinitialize or repeatedly guess at credentials. Locate the separately stored recovery copy and follow the NAS vendor’s recovery procedure. If no valid key or usable backup exists, encrypted data may be irretrievable; this is why key export and restore testing belong in the initial deployment, not after an incident.
Best Value
- Professional Video Editing Hub - Edit 4K and 8K footage directly over network with blistering 1,181 MB/s speeds; support multiple editors working simultaneously
- Massive Media Library - Start with 100TB, expand to 300TB using DX525 units as your video projects, RAW photos and audio libraries grow
- 10GbE Network Ready - Upgrade to 10-Gigabit networking for post-production teams working on shared high-resolution projects
- Advanced Media Management - Stream content to clients organize thousands of assets with AI tagging and maintain project version control
- 3-Year Warranty & Enterprise Support - Dedicated technical account management is available for business-critical production environments
Performance and availability expectations
Encryption adds cryptographic work, but there is no single speed penalty that applies to every NAS. CPU generation and hardware acceleration, disk or SSD speed, RAID layout, filesystem, protocol, compression, deduplication and workload all matter. Sequential transfers may behave differently from many small files, database I/O or virtual-machine storage.
Run a representative test on the exact model and firmware: copy the largest files and the smallest-file workload you use, exercise the required protocol, and measure application latency during backup and indexing. Compare encrypted and unencrypted test volumes only if the test data and workload are equivalent. Do not use a result from another vendor or model as a promise for yours.
Examples of sensible choices
Small office with uniformly confidential data
If documents, accounting files, project shares and application data all belong to the same confidentiality class, an encrypted volume is usually easier to govern. New shares created on that volume inherit the intended boundary, while the administrator still needs to protect the key and encrypt the backup destination.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Research team sharing one sensitive project
If most of the NAS holds ordinary datasets but one project contains restricted material, an encrypted shared folder can limit the protected area and permit separate access control. Confirm that the team’s applications, snapshots, backup jobs and file protocols support the encrypted folder before committing the workflow.
NAS in an unattended branch office
Physical theft is a realistic concern, so either encryption scope can be appropriate. The key should not be stored in the same rack. Decide whether staff can safely perform a manual unlock after a power failure; if not, auto-unlock may meet availability needs, but it reduces separation between system startup and data release.
A decision rule you can apply
- Start with the threat: if the concern is stolen drives or a stolen NAS, use at-rest encryption; if the concern is an unauthorized logged-in user, strengthen identity and permissions as well.
- Define the boundary: choose a volume when all supported data in that volume should be protected, or folders when only named datasets need encryption.
- Validate compatibility: check model and firmware support, filename limits, path rules, protocols, snapshots and applications.
- Design recovery: export keys, store them away from the NAS and rack, and test a restore before production use.
- Protect every copy: configure encryption independently on backup media and verify that a restore can be completed without the original NAS.
The most secure design is the one whose scope, key custody and recovery procedure your team can operate consistently. Broad volume encryption minimizes omissions; selective shared-folder encryption minimizes the number of services affected and can provide separate departmental boundaries. Neither replaces access control, patching or encrypted backups.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
