How to Encrypt a USB Drive With Built-In Windows Tools

5 min read

A USB drive is easy to lose: it slips out of a pocket, gets left in a meeting room, or rides home in the wrong bag. Anyone who finds it can read every file on it unless the drive is encrypted. Encryption turns the contents into scrambled data that only your password can unlock.

Windows includes a built-in encryption tool called BitLocker that can protect a USB drive without any extra software. If your edition of Windows supports it, the setup takes a few minutes. This guide shows how to encrypt a drive, how to unlock it later, and how to keep a safe recovery key.

What BitLocker To Go Does

BitLocker To Go is the portable-drive version of Windows encryption. It encrypts the entire USB drive, including free space if you choose, so every file on the drive is protected. The drive asks for a password or a smart card each time it is plugged into a Windows computer.

The encryption uses the AES standard with 128-bit or 256-bit keys, which is strong enough that a lost drive is effectively unreadable without the password. A finder can see that the drive exists, but cannot open a single file on it.

BitLocker To Go is available on Windows Pro, Enterprise, and Education editions. Windows Home does not include the encryption feature, though it can unlock a drive that was encrypted on a Pro machine. If you use Windows Home, the free VeraCrypt tool is the standard alternative.

Before You Encrypt the Drive

Back up the files on the drive first. Encryption rewrites the drive, and while the process is safe, any interruption, such as a power cut or an accidental unplug, can damage the data. Copy the files to your computer or another drive before you start.

Check that the drive is healthy. Run a quick error check from the drive properties, and replace the drive if it has a history of disconnects or read errors. Encrypting a failing drive can turn a small problem into total data loss.

Decide whether to encrypt the whole drive or only the used space. Encrypting the whole drive, including empty space, is slower but safer, because it also protects files you deleted earlier that still sit in the free space. For a new drive, used-space encryption is fine.

Encrypting the Drive Step by Step

Plug in the USB drive, open File Explorer, right-click the drive, and choose Turn on BitLocker. Windows will ask how you want to unlock the drive. Choose a password, and pick one that is long and unique, because this password is the only thing standing between a finder and your files.

Next, Windows asks where to save the recovery key. Save it to your Microsoft account, print it, or save it to a file on a different drive. The recovery key rescues the drive if you forget the password, so store it somewhere safe and separate from the drive itself.

Choose the encryption mode. New encryption mode, XTS-AES, is the default for drives used only on Windows 10 and 11. Compatible mode is the right choice if you need to open the drive on older Windows versions. Start the encryption and wait for it to finish before removing the drive.

Unlocking and Using the Encrypted Drive

When you plug the encrypted drive into a Windows computer, a prompt asks for the password. Enter it, and the drive unlocks for that session. You can also choose to unlock the drive automatically on a trusted computer, which is convenient but removes protection if that computer is shared.

On a Mac or a Linux machine, BitLocker drives do not open natively. If you need cross-platform access, use VeraCrypt instead, which works on all three systems. Choose the tool that matches the computers you actually use.

If you forget the password, the recovery key is your only way in. Enter the 48-digit recovery key at the prompt, and Windows will unlock the drive. Without the password or the recovery key, the data is unrecoverable, which is exactly the point of encryption.

A USB drive that you unlock on a shared computer stays unlocked until you remove it, so eject the drive before you walk away. An encrypted drive left plugged into an unattended computer is no safer than an unencrypted one, because anyone passing by can read it while it is unlocked.

Managing the Drive Long Term

Keep the recovery key with your other important records, not in a text file on the drive itself. A recovery key stored on the encrypted drive is useless, because you need the key to open the drive that contains it. A password manager is a good home for the key.

Decrypt the drive before lending it to someone or handing it to a repair shop, unless you want them to have the password. BitLocker lets you turn off encryption from the same menu, and the process returns the drive to normal unencrypted storage.

Re-encrypt any drive that held sensitive files, even if you later delete them. Deleting a file does not remove its data from the drive, so an unencrypted drive that once held tax returns or client files can still leak them. Encryption is the only reliable way to make deleted files unreadable.

Take the next step when you are ready: Setting Up Passkeys Across Your Devices for Stronger Logins is waiting below, along with more security reads.

What is your take?

Share your experience or questions in the comments — especially if you have used this tech yourself.

Found this useful? Share it with a friend who would want to know.