Windows already has encryption built in, so why install more? Because the built-in tools depend on your Windows edition and hardware, and none of them covers every job: a laptop’s system disk, a USB stick, a file sent by email and a folder you want to hide are four different tasks.
- System disk: BitLocker on Windows Pro, Device Encryption on Home, otherwise VeraCrypt.
- USB sticks, external drives, containers: BitLocker To Go, VeraCrypt or Cryptic Disk.
- Sending a file: a 7-Zip archive with AES-256.
- Data that must stay hidden: hidden volumes in VeraCrypt or Cryptic Disk.
Cryptic Disk is our own program, so we say plainly what it does not do.
Comparison table
| Tool | Price | System disk | Data drives, USB | Containers | Hidden volumes | Windows |
|---|---|---|---|---|---|---|
| BitLocker | included | yes | yes (USB: To Go) | via VHD/VHDX | no | Pro, Enterprise, Education |
| Device Encryption | included | yes | internal drives only | no | no | Home and others, supported hardware |
| EFS | included | no | single files on NTFS | no | no | Pro, Enterprise, Education |
| VeraCrypt | free | yes | yes | yes | one per volume | 10 and later; also macOS, Linux |
| 7-Zip | free | no | no (archives) | no | no | 11 back to XP |
| Cryptic Disk | paid, 30-day trial | no | yes | yes | up to 3 levels | 11 back to XP |
BitLocker
The full-volume encryption built into Windows Pro, Enterprise and Education. It encrypts the system drive, internal data drives and, as BitLocker To Go, removable drives.
- System disk with a TPM, optional PIN
- Free with Windows Pro
- 48-digit recovery key if the unlock fails
- Can't be turned on in Windows Home
- No hidden volumes; containers only as VHD/VHDX files
- Once you sign in, files are open to anyone at your PC and to malware
Without a TPM chip, BitLocker asks for a startup password or a startup key on a USB stick at boot, once the group policy that allows it is turned on. Keep the recovery key outside the computer: without it, a locked drive can’t be recovered.
Device Encryption (Windows Home)
A simplified BitLocker for more devices, including Windows 10 and 11 Home. It encrypts the system drive and internal fixed drives, not USB or external drives.
- It needs a TPM, Secure Boot and the Windows Recovery Environment. Since Windows 11 24H2, Modern Standby is no longer required, so more PCs qualify.
- It turns on when you sign in with a Microsoft account (or a work or school account), and the recovery key is saved to that account. With a local account it is not turned on automatically.
- To check support, run System Information (msinfo32) as administrator and look at “Device Encryption Support”.
If your Home PC doesn’t qualify, see what to do when Windows 11 Home has no BitLocker.
EFS (Encrypting File System)
EFS encrypts single files and folders on NTFS drives from the file properties. It is not available in Windows Home.
EFS is tied to your Windows account. Anyone who signs in as you sees the files decrypted, and after reinstalling Windows the files can't be opened unless you exported the certificate with its private key. Treat EFS as an extra layer on a shared PC, not as protection for a laptop that may be stolen.
VeraCrypt
Free, open-source software based on TrueCrypt 7.1a, for Windows, macOS and Linux. The most capable free tool on this list.
- System disk with a password before Windows starts
- Partitions, external drives, USB sticks, containers
- Hidden volumes and a hidden operating system
- AES, Serpent, Twofish, Camellia, Kuznyechik and cascades
- Long wizard, PIM, a rescue disk for system encryption
- Officially Windows 10 and later
- No longer mounts TrueCrypt volumes (since 1.26.7)
- Help only from docs and a forum
More in our VeraCrypt alternative comparison.
7-Zip with AES-256
A free archiver that protects 7z and ZIP archives with AES-256 and a password. The simplest way to send a few files by email or a link: the recipient needs an archiver that supports AES, and you send the password through another channel.
It is not for everyday storage: to work with the files you extract them, and the copies stay on the disk unencrypted until you delete them. Step by step: how to encrypt a file with a password.
Cryptic Disk
Cryptic Disk is our program for data that stays locked until you need it.
What it doesn't do: Cryptic Disk can't encrypt the system partition where Windows is installed. Keep sensitive files on a data partition or in a container. It runs only on Windows (11 back to XP), with no macOS, Linux, mobile or ARM versions. A license costs $94 per user, once, with a year of updates and support.
Which encryption software to choose
A practical combination: BitLocker or Device Encryption for the system disk, plus an encrypted container for the most sensitive files. The system disk opens when Windows starts; the container stays closed until you mount it and can unmount itself automatically.
Free or paid?
The free tools are excellent: BitLocker and Device Encryption come with Windows, VeraCrypt and 7-Zip are free and open source. If one of them does everything you need, use it.
A paid program makes sense when you want what they don’t give: hidden volumes nested three levels deep, older Windows versions, old TrueCrypt volumes without an outdated program, and support from the developer. Whatever you choose, the password matters more than the algorithm: use a long passphrase and keep backups.
FAQ
What is the best free encryption software for Windows?
For the system disk, BitLocker or Device Encryption if your edition and hardware support them, otherwise VeraCrypt. For sending files, 7-Zip with AES-256. VeraCrypt is the most complete free tool, but takes more time to learn.
Is BitLocker enough?
For a stolen laptop, yes, if the recovery key is stored safely. It doesn’t protect files while you are signed in, and it doesn’t hide that data exists. For that, add an encrypted container or a hidden volume.
Can Cryptic Disk encrypt the drive Windows is installed on?
No. It encrypts data partitions, external drives, USB sticks and containers. For the system disk, use BitLocker, Device Encryption or VeraCrypt.
What happens if I forget the password?
With any proper encryption, the data is gone. BitLocker has a recovery key for that case. Cryptic Disk can back up the volume header, but the backup is protected by the password valid when you saved it, so it doesn’t help if you forget your only password.
Can Cryptic Disk open VeraCrypt volumes?
No. It opens TrueCrypt containers and drives, but not VeraCrypt volumes. To move data, mount both and copy the files.
No limitations during the trial. Windows 11, 10, 8.1, 8, 7, Vista and XP.
Free Trial Pricing & Buy