Encryption converts your files into something unreadable without a key. It sounds technical, and at the level most people need, it's a checkbox and a password.
The useful thing is knowing which of three levels you actually need, because they protect against different threats and most people only need the first.
Level 1: Full disk encryption
Encrypts your entire drive. When the device is off, its contents are unreadable. When you log in, everything works normally.
What it protects against: a lost or stolen device. Without it, anyone who has your laptop can remove the drive, connect it to another machine, and read everything, regardless of your login password.
What it doesn't protect against: anything while you're logged in. Malware, someone using your unlocked machine, or files you send elsewhere.
Turn it on. Everywhere. Today.
Mac: FileVault, in the security settings. Newer Macs encrypt by default at the hardware level, and FileVault ties it to your login. Turn it on and store the recovery key in your password manager.
Windows: BitLocker, on Pro editions. Some editions offer device encryption with fewer options. Save the recovery key — to a file stored elsewhere, or printed. Windows may offer to save it to your Microsoft account, which is convenient and means the key is in a cloud account.
iPhone and Android: encrypted by default when a passcode is set. Set a passcode; that's the whole task.
External drives: both platforms support encrypting them. Do it for any drive holding backups, because a backup drive is a complete copy of your life and losing an unencrypted one is a serious exposure.
The one caution: a lost recovery key means lost data. Store it in your password manager and print a copy for the important machines.
Level 2: Encrypted containers
An encrypted file that acts like a folder. Unlock it with a password, use it normally, lock it, and it's an opaque blob again.
What it protects against: exposure of specific sensitive files even when the machine is running or when the files are stored somewhere you don't fully control — cloud storage in particular.
When to use it: you have a small pile of genuinely sensitive material and you're storing it in the cloud. Client records, medical documents, identity documents, financial records, anything covered by a confidentiality obligation.
The approach: create the container locally, put the sensitive files in it, and let the container be what syncs to the cloud. Your provider sees an unreadable blob.
Options include the encrypted disk image tool built into macOS, established third-party encryption tools available across platforms, and — for a simple version — a strongly encrypted archive file, using AES rather than the older ZIP encryption.
Two practical cautions:
Size matters for sync. The whole container re-uploads whenever anything inside changes. Keep it modest — a few hundred megabytes, not fifty gigabytes — or the sync becomes painful.
A corrupted container can lose everything inside it. Encrypted containers are less forgiving of partial damage than ordinary files. Keep a second copy.
Level 3: Per-file encryption
Individual files encrypted separately, so each syncs independently.
When to use it: a large volume of sensitive material in cloud storage, where a single container would be impractical.
Client-side encryption tools exist that present you with a normal-looking folder locally while storing individually encrypted files in your cloud folder. This solves the re-sync problem and keeps per-file version history working.
For occasional one-off needs, encrypting a single file with a strong archive password is enough.
Choosing passwords for encrypted things
Encryption passwords are different from account passwords in one crucial way: there is no reset. No support line, no recovery email. Lose it and the data is gone permanently.
So:
Use a strong passphrase — four or five random words. Long, memorable, and not guessable.
Store it in your password manager immediately upon creation, before you put anything in the container.
Print it and store it physically for anything that matters. Consider a sealed envelope with your important documents.
Make sure someone you trust can access it if something happens to you — through your password manager's emergency access, or the physical copy.
The most common encryption failure isn't an attacker breaking in. It's the owner losing the key.
What encryption doesn't do
It doesn't protect files while they're open. An unlocked container on a running machine is just a folder. Malware sees what you see.
It doesn't hide metadata. Filenames, sizes, and modification times are often visible even when contents aren't, depending on the method. Names can be revealing: settlement-agreement-2025.pdf tells a story without being opened.
It doesn't protect files you send elsewhere. Encryption applies to storage. Once you email a decrypted copy, it's a decrypted copy.
It doesn't survive a lost password. Bears repeating.
It doesn't protect against you being compelled to unlock it. The legal situation around compelled decryption varies significantly by country and by circumstance. If this is a live concern for you, get legal advice rather than technical advice.
Sending sensitive files to other people
Encryption at rest is one problem; transfer is another.
Don't email sensitive attachments unencrypted. Email is stored in multiple places for years and forwarded casually.
Encrypt the file, send it, and send the password separately — by phone or a different messaging channel, never in the same email.
Or use a share link with a password and an expiry date, where your cloud service supports it.
Or use a service designed for secure transfer, several of which offer end-to-end encrypted, expiring one-time links.
The separate-channel rule is the one that matters most and is broken most often. A password in the same email as the file is decoration.
What to encrypt, practically
Everyone:
- Full disk encryption on every computer and phone
- Encrypted backup drives
- Recovery keys stored in a password manager and printed
If you handle sensitive material — client records, health information, legal documents, other people's personal data:
- An encrypted container for that material, synced to the cloud in encrypted form
- Encrypted transfer when sending it
- The password stored properly and accessible to someone you trust
If you're subject to specific regulatory requirements, encryption is likely mandatory rather than advisable, and there may be specific requirements about how. Get advice appropriate to your sector.
The thirty-minute setup
- Turn on full disk encryption on every computer. Save each recovery key to your password manager and print the important ones.
- Set a passcode on every phone and tablet.
- Encrypt your backup drives. Store those passwords too.
- Identify your sensitive pile — usually under a gigabyte.
- Create one encrypted container for it, put it in your cloud folder, and store the password properly.
- Test it: lock it, unlock it, open a file. Then verify you can unlock it from a different device.
Step six matters. An encrypted container you can't open on a second machine is a container you'll lose access to when the first machine dies.
Encryption tools, availability by operating system edition, and default behaviours change. Check your platform's current documentation.
Next in this series: How to Securely Delete Files You Don't Want Recovered