To encrypt files on Windows, match the method to the scope: BitLocker (or Device Encryption on Home) for a whole drive, the Encrypting File System for a folder, a VeraCrypt container for a movable set of files, or 7-Zip with AES-256 for a single archive. All four use the AES cipher to turn data into ciphertext that only the right key or password can read, so a lost or stolen drive reveals nothing. Each method depends on a key or password, which means backing it up is not optional: lose the BitLocker recovery key, the EFS certificate, or a container password and the data is gone for good. On a clean install of Windows 11 24H2, Device Encryption is now switched on by default when you sign in with a Microsoft account, so your system drive may already be encrypted.
Which Encryption Method Should You Use?
Windows gives you four practical ways to encrypt, and the right one depends on whether you are protecting a whole drive, one folder, a movable set of files, or a single archive to share. The mechanics of turning readable data into ciphertext are covered in how encryption works; this guide is about which Windows tool to reach for and how to use it.
The split that matters most is full-disk versus per-file. Full-disk encryption (BitLocker or Device Encryption) protects everything on the drive, but only while the PC is off or locked, because once you sign in the drive is unlocked for any program. Per-file methods (EFS, VeraCrypt, 7-Zip) protect a chosen set of files even while you are signed in, but they leave the rest of the disk readable. Many people use both: full-disk for the lost-laptop case, and a container or archive for the handful of files that must stay sealed.
Is My Windows 11 Drive Already Encrypted?
On Windows 11 version 24H2, a clean install where you sign in with a Microsoft account turns Device Encryption on automatically, so your system drive may already be protected before you do anything.
- Clean installs are encrypted by default. On 24H2, a fresh setup of Home or Pro enables Device Encryption during the out-of-box experience when a Microsoft account signs in, and the recovery key uploads to that account.
- In-place upgrades are not. Upgrading an existing PC to 24H2 does not switch encryption on by itself, so an older install stays unencrypted until you enable it.
- Check the status. Open Settings, then Privacy and security, then Device encryption, or run
manage-bde -statusin an elevated Command Prompt to see whether protection is on.
If encryption is already on, the most important task is to confirm the recovery key is saved where you can reach it. Sign in at the Microsoft account device page and verify the 48-digit key is listed, because that key is what you will need if the PC ever fails to unlock.
How Do You Turn On BitLocker for a Whole Drive?
Turning on BitLocker encrypts an entire drive and protects every file on it behind a startup unlock, with a 48-digit recovery key as the fallback. These steps enable it on Windows Pro and save that key first.
- Open BitLocker. Go to Control Panel, then System and Security, then BitLocker Drive Encryption.
- Turn it on for the drive. Select Turn on BitLocker next to the drive you want to protect.
- Save the recovery key first. Choose where to store the 48-digit key: a Microsoft account, a file on a different drive, or a printout. Never save it on the drive you are encrypting.
- Choose how much to encrypt. Pick used space only for a new drive, or the entire drive for one that has held data before.
- Keep the new encryption mode. Accept XTS-AES for a fixed internal drive, then click Start encrypting.
- Let it finish. Encryption runs in the background while you keep using the PC, and the drive is protected once it reaches 100 percent.
BitLocker defaults to the XTS-AES-128 cipher; on recent PCs with NVMe drives and a capable processor it can use hardware-accelerated XTS-AES-256. Either is strong. What decides your safety is not the cipher but whether the recovery key is backed up somewhere off the drive, because the TPM can change after a firmware update or hardware swap and force a recovery prompt.
How Do You Encrypt a Single Folder?
To encrypt one folder rather than the whole drive, use the Encrypting File System on Pro, or a VeraCrypt container on any edition. EFS is the fastest if you only need to hide a folder from other accounts on the same PC.
- Open the folder properties. Right-click the folder, choose Properties, and click Advanced on the General tab.
- Turn on encryption. Check Encrypt contents to secure data, click OK, and apply it to the folder and everything inside when prompted.
- Back up the EFS certificate. When Windows offers to back up the encryption certificate and key, do it. That certificate is the key to the files; without it the folder is unreadable even to you after a reinstall.
- Confirm it worked. The folder name shows in a different color, which marks it as EFS-encrypted.
EFS works only on NTFS drives and cannot encrypt system files, and it stays tied to your Windows account, so the files do not open on another PC. For a folder you want to carry between machines, a VeraCrypt container is the better fit: install VeraCrypt, click Create Volume, choose an encrypted file container, set a size and a strong password, move the mouse to generate randomness, then mount the container with its password to use it as a drive letter. Dismounting it locks the files again.
How Do You Password-Protect Files to Share?
To send or store a small set of files securely, pack them into a 7-Zip archive encrypted with AES-256. This works on any edition and produces a single file anyone can decrypt with the password.
- Install 7-Zip. Download it from the official 7-zip.org site and install it.
- Add the files to an archive. Select the files or folder, right-click, choose 7-Zip, then Add to archive.
- Pick the format. Set the archive format to zip for wide compatibility or 7z for stronger options.
- Set a strong password. Enter and confirm a password in the Encryption section, following the method in creating a strong password.
- Choose AES-256. Set the encryption method to AES-256, the strong default.
- Encrypt the file names. For the 7z format, check Encrypt file names so the contents are hidden too, then click OK.
AES-256 in 7-Zip protects the file contents, and for the 7z format the file names as well. The archive is only as strong as its password, and there is no recovery: forget the password and the contents cannot be opened. Because the recipient needs the password to extract the files, send it through a separate channel, never in the same message as the archive.
How Do You Back Up the Recovery Key?
Every method here depends on a key or password, and a backup of it is the difference between protected data and lost data. Save the right secret for each method before you trust real files to it.
A password manager secure note is a sound home for these keys, since it is itself an encrypted vault you unlock with one master password. Keeping the recovery key off the encrypted device matters most for full-disk encryption, which is also why a current backup of your computer belongs alongside encryption: encryption stops the wrong people reading your data, and a backup is what saves you when a drive or a key fails.
What Mistakes Should You Avoid?
Most encryption disasters come from a handful of avoidable errors, almost all of them about the key rather than the cipher.
- Saving the recovery key on the encrypted drive. A locked drive hides its own key, leaving no way in. Keep the key somewhere else.
- Skipping the EFS certificate backup. Without that certificate, EFS files are unreadable even to the same account after a reinstall.
- Using a weak container or archive password. AES-256 is unbreakable in practice, but a guessable password is not, so the password is the real lock.
- Treating EFS as portable. EFS files are tied to one account on one PC and will not open elsewhere; use VeraCrypt or 7-Zip for files that travel.
- Assuming Home has full BitLocker. Windows Home offers only Device Encryption, not the full BitLocker control panel.
Last Thoughts on Encrypting Files on Windows
Encrypting files on Windows is a matter of matching the tool to the scope. BitLocker, or Device Encryption on Home, seals a whole drive against a lost or stolen laptop. The Encrypting File System hides a folder from other accounts on the same PC. A VeraCrypt container gives you a portable vault, and a 7-Zip AES-256 archive secures a small set of files to send or store. On a new Windows 11 24H2 install, the system drive may already be encrypted, so the first step is often to check and to confirm the recovery key is saved.
Whichever method you choose, the cipher is the easy part and the key is the hard part: back up the BitLocker recovery key, the EFS certificate, and every container and archive password, because a lost key makes the data unrecoverable. Encryption is one layer of a wider routine that also includes strong passwords and regular backups, all collected in the PC tutorials hub.
Key Takeaways:
- Match the method to the scope: BitLocker or Device Encryption for a whole drive, EFS for a folder, VeraCrypt for portable files, 7-Zip for a sharable archive.
- Full-disk encryption protects a lost or stolen drive; per-file encryption protects chosen files even while you are signed in.
- On a clean Windows 11 24H2 install with a Microsoft account, Device Encryption is on by default on both Home and Pro.
- BitLocker needs Pro and a TPM for the smoothest setup; Windows Home gets the lighter Device Encryption.
- VeraCrypt and 7-Zip run on any edition and use AES-256, so no Pro license or TPM is required.
- Back up every key or password off the encrypted device, because a lost key makes the data permanently unrecoverable.
Frequently Asked Questions (FAQs)
How do I encrypt files on Windows?
Choose by scope. Encrypt a whole drive with BitLocker on Pro or Device Encryption on Home, a folder with the Encrypting File System, a set of files in a VeraCrypt container, or an archive with 7-Zip using AES-256. Save the recovery key or password for whichever method you pick.
Is my Windows 11 drive already encrypted?
It may be. On a clean install of Windows 11 24H2 where you signed in with a Microsoft account, Device Encryption is turned on automatically on both Home and Pro, with the recovery key saved to that account. An in-place upgrade does not switch it on. Check under Settings, Privacy and security, Device encryption, or run manage-bde -status.
Does BitLocker require Windows Pro?
The full BitLocker control panel requires Windows Pro, Enterprise, or Education. Windows Home includes only Device Encryption, which uses the same BitLocker engine and AES cipher but exposes fewer controls. Both work best with a Trusted Platform Module storing the key.
What is the difference between BitLocker and EFS?
BitLocker encrypts an entire drive and unlocks it at startup, protecting against a lost or stolen disk. The Encrypting File System encrypts individual files or folders on an NTFS drive and ties them to one Windows account, so the files stay readable only to that account on that system.
Can I encrypt files on Windows Home?
Yes. Windows Home lacks the full BitLocker control panel but offers Device Encryption on supported hardware for the system drive. VeraCrypt and 7-Zip also run on any edition, so an encrypted container or an AES-256 archive protects selected files on Home regardless of hardware.
What happens if I lose my BitLocker recovery key?
Without the recovery key and the normal password or TPM unlock, the drive stays locked and its data cannot be recovered. The encryption that protects the data from a thief also blocks you. Save the 48-digit key to a Microsoft account, a printout, or separate storage before you rely on encryption.
