Looking to improve your security by encrypting your files or even your hard drives in Windows? We will walk you through every step so you can keep all of your sensitive data safe.
Updated: November 13, 2023
If you encrypt files and folders in Windows, your data will become unreadable to unauthorized parties. Only someone with the correct password, or decryption key, can make the data readable again. This article will explain several methods you can use to encrypt your data in Windows 11, 10, 8 or 7.
Encryption options
To encrypt files and folders in Windows, you can use the following:
Tip: Alternatively, if all you are concerned about is avoiding somebody snooping at home, you can encrypt or password-protect individual MS Word or MS Excel files quickly from within documents. ComputerHope shows you how.
Research by Flashpoint found that 6.2 billion data records were stolen between January and September 2023. However, earlier research from Gemalto has shown that less than five percent of breaches involved encrypted data.
According to our own research into encryption statistics, some 60% of surveyed organizations transfer sensitive files to the cloud regardless of whether they are encrypted or otherwise made unreadable.
Keep the following information in mind before you encrypt your data in Windows:
Encrypted files are not 100 percent secure. Hackers can (albeit with difficulty) bypass encryption. You’re at risk if you store cryptographic keys and passwords in an unencrypted file or if a hacker has planted a keylogger on your system.
Keyloggers can be installed by malware on your computer. If you encrypt a single file with EFS, your computer will store an unencrypted version of that file in its temporary memory, so a hacker may still be able to access it. If your data is really valuable, consider a paid, expert, cloud encryption solution.
Always make unencrypted backups of your files in case you lose your passwords. Store them in a safe physical location. This will ensure you can easily retrieve them should your entire system become compromised.
Decide exactly what you want/need to encrypt. This will determine what encryption method you use. Scroll down to the “To encrypt or not to encrypt files and folders in Windows?” section for more on this.
An EFS encrypted file loses its encryption if you move it to a Fat 32 or exFAT drive, or transmit it via a network or email. EFS also does not protect files from being deleted unless you have used Windows permissions to protect it. You cannot encrypt a compressed file or folder with EFS; you need to extract the contents first.
BitLocker encrypts an entire volume on your hard drive (or a removable device), no matter who is logged in. To unlock a drive that is protected with BitLocker, anyone wanting access must enter a password or use a USB drive that unlocks the PC when it is inserted.
BitLocker uses trusted platform module (TPM) hardware. A TPM chip enables your device to support advanced security features. For instance, when encryption is only at the software level, access may be vulnerable to dictionary attacks.
Because TPM is at the hardware level, it can protect against guessing or automated dictionary attacks. You can use BitLocker without a TPM chip by using software-based encryption, but it requires some extra steps for additional authentication.
To check if your device has a TPM chip:
BitLocker is available on:
Note: BitLocker is not available for Windows Home editions.
EFS is the Windows built-in encryption tool used to encrypt files and folders on NTFS drives. Any individual or app that does not have the key cannot open encrypted files and folders.
Rather than encrypting your entire drive, EFS allows you manually to encrypt individual files and directories. It works by making encrypted files available only if the user who encrypted the files is logged in. Windows creates the encryption key, which is itself encrypted and saved locally. The encryption process is easy but not very secure (it is possible, although difficult, for an attacker to hack the key.) It is also advisable to use a strong login password that other users of your PC cannot guess.
Some experts advise to just use BitLocker as it is more secure. However, it does depend on your personal circumstances. For home users, EFS may well be sufficient protection from nosy family members.
Let’s take a look at how to encrypt files and folders in Windows 10, 8, or 7 step-by-step. Windows Home editions do not ship with EFS or BitLocker. You will have to upgrade or use a third-party app to encrypt your data. For other editors of Windows, the basic process is the same; it is just the look-and-feel of the interface that is a bit different.
Note: To encrypt your files and folders, you need to be comfortable navigating your OS, e.g. know how to access the Control Panel. You’ll also need to be using either the Professional, Enterprise or Education editions of Windows.
To encrypt a file or folder:
To decrypt a file or folder:
You can choose to unlock your drive during startup by inserting a USB flash drive or entering a password. The process to encrypt an entire hard drive is time-consuming. Depending on the amount of data you have stored, it can take a long time, so make sure your computer is connected to an uninterrupted power supply for the duration. You will need to reboot for changes to take effect but you can work while the drive is being encrypted.
To set up BitLocker:
To disable or suspend BitLocker:
See the section on 5 free encryption apps for Windows you can use with Home editions below.
The most common problem with some Windows editions is that sometimes when attempting EFS encryption, the Encrypt contents to secure data option is grayed out. This is typically because you’re using a Home edition of Windows. You’ll need to upgrade to the Pro or Enterprise edition to use the Encrypting File System. Alternatively, you can use third-party software to encrypt your files.
Here are some suggestions you can try to solve the problem in other versions:
Note: Ensure you back up your files and registry before attempting these fixes.
AxCrypt Free 2.1 for Windows is, as it’s name suggests, free. The software changes the file extension to a .AXX suffix, and the file can only be opened with AxCrypt if you provide the password used to encrypt it. The software is very intuitive to use and is invoked from its own sub-menu in Windows Explorer.
Free file archiver with a high compression ratio and strong AES-256 encryption in 7z and ZIP formats.
Note: In Windows 7 and Windows Vista you must run 7-Zip File Manager in administrator mode. To do this, right-click the 7-Zip File Manager icon and then click Run as administrator .
Cannot encrypt single files but it can protect partitions or entire drives. Veracrypt is a fork of its popular predecessor, TrueCrypt which is no longer maintained but still widely used.
GnuPG is a complete and free implementation of the OpenPGP standard that allows you to encrypt and sign your data.
If you do not want to use third-party software, an interesting alternative from Laptop Mag is to create a FolderLocker to password-protect Windows 10 folders. It is rather a drawn-out process initially but once you have set up a FolderLocker, you can easily drag and drop files into it. The writer warns, “…yes, the FolderLocker file can be reverse engineered by someone who understands the process, but this isn’t meant to keep tech-savvy folks out, just nosy family members who you don’t trust.”
If you have files and/or folders on your computer that contain sensitive information, it is a good idea to use encryption to keep this information from prying eyes. Encryption will also make it difficult, if not impossible, for hackers to access this data if it falls into the wrong hands.
No encryption is 100 percent un-crackable, but trying to do so is often just not worth the effort or within the means of criminals. However, if you use your computer for work or other people have their own accounts on your machine, your data is vulnerable. Good security and encryption practices can help safeguard it.
Encrypt files and folders in Windows that include the following data:
If you do not want certain information to appear on the internet or would shred it if it were a hard copy, chances are those files or folders should be encrypted.
Be warned: The FBI and NSA can require U.S. companies to hand over data or encryption keys with a court order. If you have encrypted files that may contain illegal data or provide information to help law enforcement agencies to investigate a crime, the law can legally compel you to decrypt them yourself. Whether you do so, of course, is up to you. In 2020, a m an was released by the US Court of Appeals having spent the previous five years in custody for refusing to decrypt two of his hard drives.