How to Encrypt an External Hard Drive: 6 Ways (Windows, Mac, Linux)

Updated September 2026. We rewrote this guide with current, step-by-step instructions for Windows (BitLocker To Go), macOS, Linux and cross-platform drives (VeraCrypt), plus what to look for in a hardware-encrypted drive now that FIPS 140-2 certificates have moved to NIST’s historical list. Old 2019–2021 statistics were removed.

If an unencrypted external drive or USB stick is lost or stolen, anyone who plugs it in can read it. Encryption scrambles the data so it’s useless without your password or recovery key. It takes a few minutes to set up and, on most computers, costs nothing.

Quick answer: the best way to encrypt an external drive

Before you start: back up anything important on the drive. Some methods erase the drive, and if you forget the password and lose the recovery key, the data can’t be recovered by anyone.

Method 1: Windows with BitLocker To Go

BitLocker To Go encrypts removable drives on Windows 11 Pro, Enterprise and Education. Windows Home can unlock and use a BitLocker To Go drive with its password, but can’t encrypt one (Microsoft).

1. Plug in the drive and open File Explorer.
2. Right-click the drive and choose Turn on BitLocker. On Windows 11 you may need to click Show more options first. You can also use Control Panel > BitLocker Drive Encryption.
3. Select Use a password to unlock the drive and enter a long passphrase.
4. Save the recovery key to your Microsoft account, a file on another drive, or print it. Don’t store it on the drive you’re encrypting.
5. Choose Encrypt used disk space only for a new, empty drive (faster) or Encrypt entire drive for one that already had data on it.
6. Choose Compatible mode if you’ll use the drive on older versions of Windows, then click Start encrypting. Don’t unplug the drive until it finishes.

Next time you plug the drive in, Windows asks for the password. In a business, IT can require BitLocker on all removable drives and back up recovery keys centrally with Intune or Group Policy.

Method 2: macOS with Finder or Disk Utility

Keep existing data (Finder): Control-click the drive in the Finder sidebar and choose Encrypt “drive name”. Set a password and a hint, and the Mac encrypts the drive in the background (Apple). If you don’t see the option, the drive’s format may not support it; use Disk Utility instead.

Start fresh (Disk Utility): this erases the drive.

1. Open Disk Utility and choose View > Show All Devices.
2. Select the drive, click Erase, and choose GUID Partition Map as the scheme.
3. Choose APFS (Encrypted) as the format, enter a password and click Erase (Apple).

Mac-encrypted drives can’t be read on Windows. If you need both, use VeraCrypt.

Method 3: Linux with LUKS

LUKS is the standard disk encryption format on Linux. In GNOME Disks, select the drive, click the gear icon, choose Format Partition, and pick the option to password-protect the volume (LUKS). Advanced users can use cryptsetup luksFormat from the command line. Both erase the partition, so back up first.

Method 4: VeraCrypt for Windows, Mac and Linux

VeraCrypt is free, open-source encryption software and the usual choice when a drive has to work across operating systems or on Windows Home. The current version is 1.26.29, released in June 2026, which added the memory-hard Argon2id key derivation option and fixed two security issues (VeraCrypt releases).

1. Download VeraCrypt only from the official project and verify the download. On macOS it also needs macFUSE or FUSE-T.
2. Open VeraCrypt, click Create Volume and choose Encrypt a non-system partition/drive.
3. Select the external drive. Choose Create encrypted volume and format it for an empty drive, or Encrypt partition in place to keep existing data (slower).
4. Keep the default AES encryption, set a long password, and choose exFAT as the file system so both Windows and macOS can use it.
5. To use the drive, open VeraCrypt, select the device, click Mount and enter your password.

VeraCrypt has no recovery key backdoor. If you forget the password, the data is gone, so store it in a password manager.

Method 5: Hardware-encrypted drives

Hardware-encrypted drives do the encryption on a chip inside the drive, often unlocked with a PIN keypad on the drive itself. They work with any computer, need no software and are a good fit for sharing data with people outside your organization.

• Look for FIPS 140-3 validation and check the certificate on NIST’s Cryptographic Module Validation Program list. Remaining FIPS 140-2 certificates moved to NIST’s historical list after September 21, 2026, so they shouldn’t be used for new federal purchases (NIST).
• Choose models that wipe themselves after repeated wrong PINs and use AES-256 encryption.
• Be cautious with cheap drives that claim “hardware encryption” with no validation. Security researchers have found flaws in some self-encrypting drives in the past.

Method 6: Encrypt individual files

If you only need to protect a few files, create an encrypted archive. 7-Zip can create 7z or ZIP archives with AES-256 encryption; tick Encrypt file names in 7z format so the file list is hidden too. Microsoft Office can also protect individual documents with File > Info > Protect Document > Encrypt with Password. File encryption is useful for sending data, but whole-drive encryption is easier to use consistently.

Why encrypting external drives matters

• Lost and stolen drives are common. Small drives are easy to leave behind, and backup drives often hold years of data.
• Breaches are expensive. IBM’s 2026 Cost of a Data Breach Report puts the global average cost of a breach at a record $4.99 million, and $11.5 million in the U.S. (IBM).
• Encryption can spare you breach notifications. Under HIPAA, health data encrypted in line with HHS guidance is not “unsecured,” so losing it isn’t a reportable breach (HHS). GDPR likewise doesn’t require notifying individuals if the lost data was unintelligible, for example because it was encrypted (GDPR Art. 34).
• Regulators penalize unencrypted devices. Fresenius Medical Care North America paid $3.5 million in a 2018 HIPAA settlement that involved stolen unencrypted devices, including a USB drive (HHS).

Encryption only protects data that’s on the drive, so pair it with good habits: a strong, unique password (see our password best practices), a separate backup, and not leaving drives plugged in and unlocked. To learn how AES and other algorithms work, read our guide to common encryption methods, and see our cryptography tools roundup for more software. For the other half of data protection, see how to encrypt your internet connection. For short updates on new threats and fixes, sign up for the CyberExperts Daily Brief.

Frequently asked questions

Sources

• Microsoft Support, BitLocker Drive Encryption: support.microsoft.com
• Apple, Protect your Mac information with encryption: support.apple.com
• Apple, Encrypt and protect a storage device with a password in Disk Utility: support.apple.com
• VeraCrypt releases (1.26.29, June 2026): github.com
• NIST, FIPS 140-3 Transition Effort: csrc.nist.gov
• NIST, Cryptographic Module Validation Program: csrc.nist.gov
• IBM and Ponemon Institute, Cost of a Data Breach Report 2026: ibm.com
• HHS, Breach Notification Guidance (rendering PHI unusable, unreadable or indecipherable): hhs.gov
• HHS, Fresenius Medical Care North America settlement (2018): hhs.gov
• GDPR Article 34, Communication of a personal data breach to the data subject: gdpr-info.eu
• 7-Zip: 7-zip.org

George Mutune

I am a cyber security professional with a passion for delivering proactive strategies for day to day operational challenges. I am excited to be working with leading cyber security teams and professionals on projects that involve machine learning & AI solutions to solve the cyberspace menace and cut through inefficiency that plague today's business environments.