How-To Guides

How to Encrypt Your Laptop and Phone

Turn on full-disk encryption so that a lost or stolen device never exposes your files, photos, passwords, or accounts -- it takes about five minutes per device.

01. Why Bother Encrypting?

A login password does not protect your data. Anyone with physical access to your laptop for five minutes can pull the drive out, slot it into another computer as a second disk, and read every single file -- because the password only guards the operating system's front door, not the data itself.

Full-disk encryption scrambles the actual bits on the drive. Without the decryption key (derived from your password or a recovery key), the disk reads as random noise. Even if a thief yanks the drive, plugs it into their own machine, and mounts it, the data is mathematically unreadable. The only thing they get is a useless brick of random bytes.

For phones the logic is identical but the stakes are higher -- your phone carries your email, your banking app, your two-factor codes, your photos, and your messages. Modern phones encrypt by default once you set a passcode, but the passcode is the actual encryption key, so a weak passcode undoes all the protection.

The honest summary: encryption converts "stolen laptop = total data breach" into "stolen laptop = annoying hardware replacement." It is the single highest-value security step you can take on any personal device, and on most platforms it is now a single toggle.

What this guide covers

We cover every major consumer platform. Pick the tab for your device (desktop or phone) and follow the numbered steps. The same encryption principles apply across all of them; only the brand-specific menus differ.

•Desktop tab: Windows BitLocker, macOS FileVault, Linux LUKS, and VeraCrypt for individual encrypted volumes.
•Phone tab: Android (modern default-on encryption) and iPhone (encryption kicks in once a passcode is set).

Full-Disk Encryption on Desktop

Every desktop operating system ships with a built-in full-disk encryption tool. They all work the same way: they encrypt the entire disk, transparently decrypt data on the fly as you use the machine, and require a key (derived from your password and/or a saved recovery key) to mount the disk at boot. The performance hit on any SSD made in the last decade is essentially unmeasurable.

Pick your operating system below and follow the steps. If you use multiple platforms (a Windows PC and a Mac, say), set up encryption on each one -- the tools do not talk to each other.

Step 1. Windows: Turn On BitLocker (or Device Encryption)

Windows 10 and 11 both include encryption. Windows Home editions call it "Device Encryption" and it is available on most modern hardware. Windows Pro, Enterprise, and Education editions get the full "BitLocker" version with more options.

Windows 11 Home / 10 Home -- Device Encryption

1.Open Settings → Privacy & Security → Device Encryption.
2.If the toggle is there, turn it On. If the page says "BitLocker is not available on this edition of Windows" or the menu is missing entirely, your device does not support the Home-edition encryption -- upgrade to Pro for BitLocker, or fall back to VeraCrypt in Step 4.
3.Windows immediately begins encrypting in the background. You can keep using the machine normally.
4.Save the recovery key when prompted. It is saved to your Microsoft account by default -- verify you can see it at account.microsoft.com/devices/recoverykey. Back it up somewhere else too (printed paper, a password manager, a USB stick in a drawer).

Windows 10 / 11 Pro, Enterprise, Education -- BitLocker

1.Open Control Panel → System and Security → BitLocker Drive Encryption.
2.Click Turn on BitLocker next to the OS drive (usually C:).
3.Choose how to unlock the drive at startup: a password, a smart card, or automatic unlock on a TPM-equipped machine (almost all modern PCs have a TPM).
4.Choose how to back up the recovery key. Pick at least two options: Save to your Microsoft account, Save to a file (on a USB stick that is not the one being encrypted), and Print the recovery key. Do not skip this step.
5.Choose Encrypt used disk space only for a faster first pass on a drive already in use, or Encrypt entire drive for a brand-new install. Either is fine.
6.Choose New encryption mode (the right choice for a fixed internal drive) and run the BitLocker system check before rebooting. Reboot when prompted and enter your unlock password/key.
7.Encryption continues in the background after the reboot. You can use the PC normally. To check progress, return to the BitLocker control panel.

The TPM chip. Most modern Windows PCs include a Trusted Platform Module that stores the encryption key securely on the motherboard. With a TPM, you boot straight to your normal Windows login and the disk unlocks invisibly. The login password still protects your user account, but to make the encryption useful against physical access, enable BitLocker pre-boot authentication -- a separate password prompt before Windows even starts.

Step 2. macOS: Turn On FileVault

FileVault is the built-in full-disk encryption on every Mac since 2010. It uses XTS-AES-128 with a 256-bit key, is transparently supported by macOS, and the performance impact on Apple Silicon and T2/Intel Macs with SSDs is essentially zero. There is no good reason not to enable it.

1.Open System Settings → Privacy & Security → FileVault (on macOS Monterey and earlier: System Preferences → Security & Privacy → FileVault tab).
2.Click Turn On.
3.Choose how to recover if you forget your password. You have two options: Allow my iCloud account to unlock my disk (convenient, recommended for most users) or Create a recovery key and do not use my iCloud account (more private -- the recovery key is a 24-character string you must keep safe yourself).
4.If you chose the recovery key option, macOS shows a 24-character alphanumeric key. Write it down on paper, store it in a password manager, but do not keep it on the Mac itself. Apple cannot regenerate this key for you.
5.Click Continue. macOS starts encrypting in the background. The original encryption pass takes a few hours; you can keep working.
6.Reboot once during the process when prompted. After that, every boot requires your user password to unlock the disk -- which it already did at login anyway, so day-to-day nothing changes.
7.Confirm encryption completed: return to FileVault in System Settings and the status should read "Encryption is on" with no remaining progress bar.

Find FileVault's recovery key with iCloud: if you chose the iCloud option and ever need the recovery key, sign in to account.apple.com or icloud.com, go to Account Settings, and look under Devices → your Mac → Recovery Key.

Step 3. Linux: LUKS Full-Disk Encryption

LUKS (Linux Unified Key Setup) is the standard for full-disk encryption on Linux. Almost every Linux installer offers it as a checkbox during install -- and if you missed it then, you can add encryption post-install with a tool called cryptsetup.

Easiest: enable encryption during install

1.Boot the installer USB for your distro (Ubuntu, Fedora, Debian, Mint, Arch, etc.).
2.At the disk setup step, choose "Encrypt the new Ubuntu installation" (or the equivalent option -- it is always labelled). On Fedora it is "Encrypt my data". On the manual partitioner, format the root partition as LUKS.
3.Choose a strong passphrase. This is the actual encryption key -- a weak passphrase means weak encryption. Use 12+ characters.
4.Write the passphrase down somewhere safe -- there is no recovery if you forget it. Linux distributions do not store a backup key with a vendor.
5.Continue the install. On every future boot you will be prompted for the passphrase before the root filesystem mounts.

Post-install: encrypt a new partition or external drive

To encrypt a drive after the OS is already installed (for example an external USB disk or a new data partition), use cryptsetup with LUKS2:

sudo apt install cryptsetup
sudo cryptsetup luksFormat /dev/sdX
sudo cryptsetup luksOpen /dev/sdX mydrive
sudo mkfs.ext4 /dev/mapper/mydrive
sudo cryptsetup luksClose mydrive

Replace /dev/sdX with the actual device (check with lsblk). luksFormat wipes the disk -- back up any data first. After the format, store the passphrase safely; you cannot recover the data without it.

Adding a backup passphrase. LUKS supports up to 8 key slots. Add a second passphrase as a backup with sudo cryptsetup luksAddKey /dev/sdX -- useful if you want a recovery option stored separately from your daily password.

Step 4. VeraCrypt for Encrypted Files and Volumes

VeraCrypt is a free, open-source tool for creating encrypted containers -- individual files that act as encrypted drives you can mount and unmount. It is perfect when you cannot (or do not want to) encrypt the whole disk -- a shared family PC, a work laptop you do not own, or a portable USB drive you carry between machines.

1.Download VeraCrypt from veracrypt.fr -- the official site. There are Windows, macOS, and Linux builds. Avoid third-party download mirrors.
2.Install it. All defaults are fine. On Linux you will need to install the dependencies the installer prompts for.
3.Open VeraCrypt and click Create Volume.
4.Choose Create an encrypted file container. This makes a single large file that acts as an encrypted disk.
5.Pick a location for the container file and a size. A 5GB container holds quite a lot of documents; a 50GB container holds plenty of photos.
6.Choose the encryption and hash algorithms. The defaults (AES + SHA-512) are excellent; do not overthink this step.
7.Set a strong password -- 20+ characters is recommended because VeraCrypt has no password-reset option. If you forget this password the data is gone forever.
8.Move your mouse around the window randomly for as long as you can spare -- VeraCrypt uses the mouse movement to generate strong cryptographic random numbers. Then click Format.

Mounting and unmounting

Once the container exists, you use it by mounting it as a virtual disk:

1.Select an empty slot in the VeraCrypt window and click Select File. Pick your container file.
2.Click Mount and enter the password. The container appears as a new drive letter (Windows) or mount point (Mac/Linux).
3.Use it like any external drive -- copy files in and out, edit them, save them.
4.When you are done, click Dismount. The drive disappears and the container file is now just an encrypted blob again. Back it up like any other file -- a copy of the container file is a fully encrypted backup.

VeraCrypt's hidden volume feature lets you put a second, deniable encrypted volume inside the outer one with a different password. Entering the outer password shows harmless decoy files; entering the hidden password reveals the real files. It is overkill for most people but useful if you are worried about being forced to disclose a password.

Phone Encryption

Modern phones are actually better encrypted out of the box than most laptops. Both Android and iPhone have used file-based encryption by default for several years, which means each file is encrypted with a key that is only unlocked after you enter your screen lock. The practical consequence is simple: the minute a strong passcode is set, the device is encrypted. The minute the screen is locked, the data is unreadable without the passcode.

The work to do here is not "turn encryption on" -- it is "make sure the passcode is strong enough to be worth encrypting against."

Step 1. Android: Set a Strong Screen Lock

Android 10 and later encrypt by default with file-based encryption. There is no separate "encrypt phone" button on modern devices -- the encryption is tied directly to your screen lock. So the job becomes: set a screen lock that is actually strong, and confirm encryption is active.

1.Open Settings → Security (on some skins: Settings → Lock screen, or Settings → Biometrics and security).
2.If your phone is older (Android 9 or below) you may still see an explicit Encrypt phone option under Settings → Security → Encryption. Tap it and follow the prompts -- the phone will reboot and the encryption pass takes an hour or more on older hardware, with the phone plugged in.
3.On modern Android, go to Screen lock and pick PIN or Password. Avoid Pattern -- patterns are easy to smudge-read off the screen and have low entropy.
4.Use a PIN of at least 6 digits, ideally 8 or more. A 4-digit PIN has only 10,000 combinations and can be brute-forced; an 8-digit PIN has 100 million.
5.For maximum strength, choose Password and use a long alphanumeric passphrase. The trade-off is convenience at every unlock -- pick what you will actually keep on, not what is theoretically strongest.
6.Enable Auto factory reset if your device offers it (Settings → Security → Find My Device or Smart Lock). After a configurable number of failed unlocks (default usually 10-15), the phone wipes itself -- protecting the data even from offline brute force.

Biometrics do not replace the passcode. Your fingerprint or face unlock is a convenience layer over the passcode -- the actual decryption key. Law enforcement in many jurisdictions can compel biometric unlocks but not passcode disclosure. If you want maximum legal protection of the data, disable biometrics at lock time (on Pixel: press power button and tap "Lockdown" before handing the phone over).

Step 2. iPhone: Set a Strong Passcode

Every iPhone since the 3GS encrypts by default the moment a passcode is set. There is no separate encryption toggle to find -- the moment you set any passcode, the entire user data partition is encrypted with keys derived from the passcode and the device's Secure Enclave hardware. Face ID and Touch ID are conveniences layered on top, just like on Android.

1.Open Settings → Face ID & Passcode (on home-button iPhones: Touch ID & Passcode; on devices without biometrics: Passcode).
2.If "Turn Passcode On" is shown, tap it. If "Change Passcode" is shown, the phone is already encrypted -- skip to step 4 to upgrade the strength.
3.iOS suggests a 6-digit numeric passcode by default. Do not accept the default. Tap "Passcode Options" and choose Custom Alphanumeric Code.
4.Enter a long passphrase (12+ characters, mixing letters, numbers, symbols). You only type it after a reboot or every so often -- Face ID handles the everyday unlocks -- so length does not cost much daily friction.
5.Set Require Passcode to Immediately (the default). Anything longer than Immediately means a brief window after the screen locks during which the phone could still be unlocked without the passcode.
6.Scroll down and enable Erase Data -- this wipes the phone after 10 failed passcode attempts. Combined with a long passphrase, this makes offline brute force essentially impossible.
7.Under Settings → Apple Account → iCloud → iCloud Drive / Backup, confirm your device backup is encrypted (it is by default for backups made by Finder/iTunes, and iCloud backups are encrypted server-side). For local Mac/PC backups, tick "Encrypt local backup" to include health and password data.

SOS / lockdown mode on iPhone (iOS 16+): quickly press the side button five times to disable Face ID and require the passcode. This is the equivalent of Android's Lockdown and matters in the same situations -- crossing a border, when you might be compelled to unlock biometrically.

If you ever forget your iPhone passcode, the only way back in is to erase the device and restore from a backup. The encryption key is destroyed with the wipe -- your data is gone if you have no backup, and fully restored if you do. Keep a current iCloud or Finder backup.

Quick Tips

•Save recovery keys somewhere safe -- but never on the encrypted device itself. A printed copy in a fireproof box, a password manager entry on a different device, or a USB stick you keep somewhere you can find again. If the recovery key lives on the same laptop it unlocks, lost-with-laptop = lost-forever.
•Test your recovery key once. Right after enabling encryption, deliberately reboot and use the recovery key instead of your password to confirm it works. Do this before you actually need it. A surprise "wrong key" message at 1am before a flight is a bad day.
•Performance impact is negligible on SSDs. Modern AES-NI CPU instructions and Apple's storage controllers handle encryption essentially for free. Mechanical hard drives are slightly slower; SSDs barely register it. You will not notice.
•Encryption only protects against physical access. It does nothing against malware that runs while you are logged in, against phishing, or against a guessed password at the lock screen. Pair it with a password manager, 2FA, and a healthy skepticism of links.
•Encrypt before you put sensitive data on a device. If you encrypt after the data is already there, the original unencrypted blocks may persist on the disk until they are overwritten. BitLocker offers "Encrypt used disk space" for exactly this reason -- it does the cleanup pass for you.
•Backups must be encrypted too. Encrypting your laptop is meaningless if your Time Machine or File History backup is an unencrypted external drive sitting on the same desk. Mac: enable "Encrypt backup disk" in Time Machine. Windows: tick "Encrypt this backup" in File History. Mac/PC local phone backups: tick "Encrypt local backup".
•The "Sleep vs Hibernate" gotcha on Windows. A BitLocker machine that goes to Sleep keeps the key in RAM and can be unlocked without the password until it hibernates or shuts down. For maximum physical security, set the machine to hibernate (not sleep) on lid-close, or require a password on wake.
•Keep your firmware updated. Disk encryption security depends on a healthy TPM/Secure Enclave and BIOS/firmware that has not been compromised. Apply BIOS and iOS/Android updates promptly -- they occasionally patch encryption-related issues.

Need More Help?

Encryption setup is short but the recovery key handling, firmware quirks (TPM, Secure Enclave), and backup encryption tend to bite people. We can walk through your specific devices, verify everything is correctly encrypted end-to-end, and make sure your backups are protected -- book a free call.

Book a Free Call Contact Us