How To Encrypt A USB Flash Drive | Two Methods That Actually Work

BitLocker To Go on Windows and VeraCrypt on any OS are currently the two most practical ways to encrypt a removable USB drive.

Most USB drives ship with zero protection — plug one in and every file is readable. The fix takes about ten minutes and needs no special hardware. Here’s how to encrypt a USB flash drive on Windows, macOS, or both, with the tool that matches your setup.

The right approach depends on one thing: where that drive needs to open. If it stays inside Windows, one route is dramatically simpler. If it travels between operating systems, a different tool carries the day.

Which Encryption Method Should You Use?

The choice comes down to your operating system and whether the drive needs cross-platform access. BitLocker To Go is the native Windows option but requires a Pro, Enterprise, or Education edition. VeraCrypt works on Windows, macOS, and Linux and is free. macOS has built-in disk encryption but requires reformatting the drive first.

The table below compares the major approaches side by side.

Encrypting A USB Flash Drive: Matching The Tool To Your Workflow

BitLocker To Go (Windows Pro and above)

BitLocker To Go is built into Windows 11 Pro, Enterprise, and Education. You don’t download anything — the feature is already there. Right-click the USB drive in File Explorer, select Turn on BitLocker, and choose Use a password to unlock the drive. Save the recovery key to your Microsoft account or a file, pick whether to encrypt used space or the whole drive, then start the process. Encryption runs in the background and you can keep using the drive during it.

One catch: the drive asks for the password on any PC unless you enable auto-unlock on a trusted machine. Auto-unlock is convenient but ties that convenience to one computer — other devices still need the password. The bigger limit is compatibility. A BitLocker-encrypted USB won’t open natively on macOS or Linux without extra software, so this method works best when the drive stays inside Windows.

When encryption finishes, the drive ejects and reconnects like any other USB — except now it prompts for a password before showing files. If the password is lost, the recovery key is the only way back in.

VeraCrypt (Windows, macOS, Linux)

VeraCrypt is free open-source disk encryption software that runs on all three major desktop operating systems. It encrypts the entire USB drive — not just individual files — and the result is readable on any OS that has VeraCrypt installed. This is the practical choice when the drive needs to move between a Windows PC, a Mac, and a Linux machine.

The workflow: install VeraCrypt from VeraCrypt’s official site, launch it, and click Create Volume. Choose Encrypt a non-system partition/drive, pick Standard VeraCrypt volume, select the USB device, and choose Create encrypted volume and format it for a blank drive or Encrypt partition in place if the drive already has data. Set a strong password, then let the software format and encrypt the drive.

For cross-platform use, format the volume with exFAT — it handles files larger than 4 GB and works on Windows, macOS, and Linux without extra drivers. FAT32 is more universal but stops at 4 GB per file. Once the encrypted volume is created, plug the drive into any machine with VeraCrypt installed, enter the password, and the drive mounts like a normal removable disk.

What About macOS?

macOS can encrypt external drives using Disk Utility or Finder, but the process requires reformatting the drive first — which erases all existing data. Open Disk Utility, select the USB drive, click Erase, choose a format (APFS or Mac OS Extended), and enable encryption. Set a password, and the drive encrypts as it formats. The resulting drive is readable on other Macs but not on Windows or Linux without extra software.

For a drive that needs to move between a Mac and other operating systems, VeraCrypt with exFAT is the more practical route despite the extra install step.

Common Encryption Mistakes And How To Skip Them

Most problems with encrypted USB drives come from a handful of predictable errors. A few minutes of planning upfront prevents all of them.

The single most important rule: back up anything you can’t lose before encrypting. Several methods require formatting the drive, which wipes it completely. After that, save the recovery key or password somewhere safe — not on the same drive you just encrypted.

Final Decision: Pick Your Method And Encrypt Once

Walk through this checklist before touching the drive. If the USB will only ever plug into Windows PCs running Pro or above, choose BitLocker To Go. If it needs to open on macOS, Linux, or multiple operating systems, install VeraCrypt and create an encrypted volume with exFAT formatting. If the drive is for Mac-only use and can be erased, macOS built-in encryption works. For protecting a handful of individual files rather than the whole drive, EFS file encryption or a password-protected ZIP may be sufficient — but know that these leave the rest of the drive readable.

One encryption session, done right, protects that drive for as long as you own it. The password management is the only ongoing task after that.