How to Encrypt Files on Windows: Which Tool to Use

File encryption converts readable file contents into scrambled ciphertext that can only be read with the correct key. Windows offers four different built-in or commonly-used options and each solves a different problem — using the wrong one is the most common mistake. We go deeper on the whole subject in our Complete Guide to Security and Privacy.

Quick decision guide: protect entire drive against theft → BitLocker. Protect specific files from other users on shared computer → EFS. Create encrypted container for highly sensitive files or USB drives → VeraCrypt. Send a single file securely via email → 7-Zip with password.

The detailed comparison below explains why each tool fits its specific situation, the trade-offs you should know about (BitLocker recovery key risks, EFS limitations, VeraCrypt’s complexity), and the practical setup for each. Don’t try to use BitLocker for sending an encrypted file — it’s not designed for that — and don’t rely on 7-Zip passwords for actually sensitive data.

BitLocker — full-disk encryption for laptop protection

BitLocker is Microsoft’s full-disk encryption built into Windows 11 Pro, Enterprise, and Education. When enabled on the system drive, everything on the drive — Windows itself, applications, and all data — is encrypted. A stolen laptop’s drive can be removed and connected to another machine and the attacker still cannot read any data without the BitLocker recovery key.

Enabling BitLocker: File Explorer → right-click the C: drive → “Turn on BitLocker.” Windows asks where to save the recovery key (a 48-digit code needed if you’re ever locked out):

• Save to Microsoft account — the most practical option. Stored at account.microsoft.com, accessible from any device if needed.
• Save to a USB drive — physical backup
• Print it — store the paper in a physically secure location

When prompted for what to encrypt: select “Encrypt entire drive” rather than “Encrypt used disk space only.” Used-space-only encryption leaves deleted file remnants unencrypted and recoverable by forensic tools. The full-drive option takes longer initially (several hours for a large drive, running in the background while the computer remains usable) but provides complete protection.

BitLocker may already be active. Settings → Privacy & security → Device encryption. “Device encryption is on” means basic automatic encryption is active (all modern Windows 11 machines with TPM 2.0 enable this by default). “BitLocker” means full enterprise-grade encryption is enabled. If neither shows, the device either lacks TPM 2.0 or is running Windows 11 Home — in both cases, VeraCrypt is the alternative.

Performance impact on modern hardware with AES-NI support (any CPU from the last decade): effectively zero — below 1% overhead on SSDs. Older CPUs without hardware acceleration see 5–10% reduction, but this is imperceptible during normal use. The one scenario where it’s slightly noticeable is sustained sequential I/O at the edge of the drive’s rated speed — video editing from an encrypted drive — but for web browsing, office work, and email, there’s no perceptible change.

EFS — file-level encryption for shared machines

The Encrypting File System (EFS) is Windows 11’s built-in file-level encryption for Pro and Enterprise editions. It encrypts individual files and folders rather than the entire drive, using a certificate tied to your Windows user account. Files encrypted with EFS are transparent to you when logged in — you access them normally — but appear as unreadable ciphertext to any other user account or to an attacker who removes the drive.

Enabling EFS: right-click the file or folder → Properties → General tab → Advanced button → check “Encrypt contents to secure data” → OK → Apply → choose whether to apply to the folder only or to the folder, subfolders, and files.

The most important step after enabling EFS: back up your encryption certificate. After enabling EFS on the first file, Windows displays a notification: “Back up your file encryption certificate and key.” Click it → back up the certificate to a USB drive or another secure location. Without this backup, you cannot recover EFS-encrypted files if Windows needs to be reinstalled or the account becomes corrupted. Store this certificate backup alongside your BitLocker recovery key and password manager backup codes.

Encrypted files show a small padlock icon on their thumbnail in File Explorer, confirming EFS is applied.

EFS’s significant limitation: it only protects files from other user accounts and from offline access. If an attacker gains access to your Windows user session — through malware, remote access, or a session you left unlocked — EFS provides no protection because Windows transparently decrypts files for the authenticated user. It’s a complement to good session security, not a standalone protection against malware.

VeraCrypt — encrypted containers that work anywhere

VeraCrypt is the open-source, independently audited encryption tool that creates encrypted vault files (containers) working on Windows 11 Home as well as Pro. The container mounts as a virtual drive when unlocked; files placed inside are encrypted; the container appears as a single opaque file when locked. To an observer, there’s no visible indication of what it contains or even that it’s an encrypted container.

Creating a VeraCrypt container:

1. Download VeraCrypt from veracrypt.fr → install → open VeraCrypt
2. Create Volume → “Create an encrypted file container” → Standard VeraCrypt volume
3. Choose a file location and name (looks like any regular file)
4. Choose encryption algorithm — AES is correct for most users
5. Set the container size
6. Create a strong password
7. Move the mouse randomly in the window to generate entropy → Format

To access the container: double-click it in VeraCrypt or select it and click Mount → enter the password → work with the mounted drive normally. Unmount when done — the container is inaccessible without the password.

The VeraCrypt hidden volume feature provides plausible deniability: a second encrypted space inside the outer container with a different password. If compelled to reveal your password, you provide the outer container’s password (which shows innocuous decoy files) while the hidden volume with sensitive files remains protected by the second password. The hidden volume is cryptographically indistinguishable from random data — there’s no way to prove it exists without the second password.

Encrypting files before cloud storage — Cryptomator

Files in OneDrive, Google Drive, or Dropbox are encrypted in transit and at rest by the provider — but the provider holds the encryption keys. This means the provider can access your files, and a government order or provider breach could expose them.

Cryptomator (cryptomator.org) solves this with client-side encryption. It creates an encrypted vault folder that syncs to your cloud storage provider. Files placed in the vault are encrypted before leaving the device — the cloud provider receives only ciphertext and cannot decrypt the contents. On any other device where Cryptomator is installed with the same password, files decrypt transparently. Cross-platform: Windows, macOS, iOS, and Android.

File names are also encrypted with Cryptomator — not even the file names are visible to the cloud provider. The trade-off: search within the encrypted vault requires local decryption; cloud providers can’t index encrypted content. For users whose primary concern is contents rather than metadata, a VeraCrypt container within the cloud storage folder is an alternative — the container syncs as a single encrypted file, but the entire container must sync on any change, which is inefficient for large containers with frequent modifications.

Our guide on backing up your data covers encryption-aware backup strategies, and our guide on Windows 11 BitLocker covers the enterprise BitLocker management features beyond initial setup. For VeraCrypt’s hidden volume implementation details, VeraCrypt’s official documentation covers the cryptographic properties and correct usage of plausible deniability.

Choosing the right method for your situation

BitLocker at the drive level is the baseline for all laptops — enable it and forget about it. It requires no ongoing user interaction after the initial setup and provides comprehensive protection against the most common threat (physical device loss) without any workflow disruption. Cryptomator on top of cloud storage covers the separate concern of provider-side exposure. VeraCrypt addresses the scenarios BitLocker doesn’t: Windows 11 Home machines, portable encrypted containers on USB drives, and situations requiring plausible deniability about what’s encrypted.

Encrypting files for transmission to another person

The methods above address at-rest encryption on your own devices. Sending encrypted files securely to a specific other person — a business partner, legal team, or trusted family member — requires asymmetric encryption. GPG (GNU Privacy Guard) implements this: the recipient shares their public key → you encrypt the file using their public key → the encrypted file can be sent through any channel, even email → the recipient decrypts it using their private key that never leaves their device.

Kleopatra, included in the Gpg4win package (gpg4win.org), provides a Windows-friendly interface for GPG operations without requiring command-line work. The one time-investment is the initial key exchange with the recipient — after that, encrypting files for that specific person is a right-click operation in File Explorer once Gpg4win is installed and configured.

Backup behaviour for encrypted files is worth noting: BitLocker-encrypted drives back up as encrypted data through Windows Backup — the backup destination also contains encrypted content, which is the intended behaviour. EFS-encrypted files backed up to cloud storage or a different machine are decrypted during the backup process and stored unencrypted at the destination, because the encryption is tied to the Windows user account certificate. For backups that maintain encryption, use Cryptomator on the backup destination or a Windows Server Backup solution that supports EFS-aware backup.

Common EFS and BitLocker mistakes

These are the errors that cause data loss or defeat the purpose of encryption:

• Not backing up the BitLocker recovery key: if the TPM chip fails or Windows encounters a problem requiring BitLocker verification, you need the 48-digit recovery key to access your data. Without it, the drive contents are permanently inaccessible — even to Microsoft. Verify your recovery key is stored at account.microsoft.com before you need it.
• Not backing up the EFS certificate: reinstalling Windows without first exporting the EFS certificate makes any EFS-encrypted files permanently unrecoverable. The certificate backup prompt from Windows is not optional ceremony — it’s a mandatory step if you want to be able to recover the files later.
• Encrypting only some files and thinking you’re fully protected: EFS only protects the specific files you encrypt. Temporary files, browser cache, and application data created while working with sensitive content may exist in unencrypted locations on the drive. For comprehensive protection, BitLocker (full-disk) is the correct approach — EFS only addresses the specific files you explicitly mark.
• Forgetting the VeraCrypt password: there is no recovery mechanism for a VeraCrypt container. The password is the only key. Use a strong passphrase stored in your password manager rather than a memorised password you might forget. Losing the VeraCrypt password means losing all access to the container’s contents permanently.

BitLocker on shared or domain-joined computers

On domain-joined corporate machines, BitLocker may already be deployed and managed by IT through Active Directory or Azure AD. In managed environments, the recovery key is typically escrowed with IT rather than stored in a personal Microsoft account. Before enabling BitLocker manually on a work machine, confirm with IT whether it’s already managed — enabling BitLocker manually on a machine that IT expects to manage through policy can create conflicts with existing key management infrastructure.

For shared family computers where multiple user accounts exist: BitLocker encrypts the drive, but all users with valid Windows login credentials can access the decrypted drive once they log in. BitLocker protects against external attackers, not between user accounts on the same machine. EFS handles intra-machine protection between user accounts, but only on Pro and Enterprise editions. For Home edition machines shared between family members: separate Windows user accounts with strong passwords is the practical access control available — encryption is less relevant in this scenario because any user who logs in has full access to their own files, and the main risk (physical theft) is addressed by BitLocker/Device Encryption regardless of which user account is logged in.

Encrypting files on Windows 11 is one of those configurations that takes an afternoon to understand and implement, then runs silently in the background forever. The setup investment for BitLocker is under 30 minutes including waiting for the initial encryption to complete. The payoff is that a stolen laptop becomes useless to an attacker rather than a complete data breach. For anyone carrying a laptop with financial records, work documents, passwords, or personal photos: that trade-off is straightforward.