How to Encrypt a USB Drive on Windows, Mac, and Linux

On supported Windows editions, you can encrypt a USB drive with BitLocker To Go. On macOS, use Disk Utility. Linux users can use LUKS. Each method prevents other people from reading the drive without its password or recovery key.

Back up the USB drive before you begin. The macOS and Linux methods described below erase the drive’s current contents. BitLocker, however, can encrypt an existing Windows-compatible drive without formatting it. And never keep the only copy of important files on an encrypted USB drive.

Choose the right encryption method

No native encrypted USB format works easily across Windows, macOS, and Linux. If you regularly move a drive among all three operating systems, a VeraCrypt volume may be a better choice than a platform-specific method.

Before you encrypt the USB drive

1. Copy every existing file to another storage device.
2. Check the USB drive’s identity and capacity. Choosing the wrong disk could erase a different drive.
3. Create a strong, unique passphrase. Four or more unrelated random words are safer than a short password and usually easier to type.
4. Choose a separate place to keep the recovery key, such as a password manager or a securely stored printed copy.

Encrypt a USB drive on Windows

BitLocker To Go encrypts removable storage and can keep files that are already on the drive. Its management interface is available in the Pro, Enterprise, and Education editions of Windows 10 and Windows 11. Windows Home generally can’t create BitLocker To Go volumes through the standard interface.

1. Connect the USB drive, then open Control Panel.
2. Go to System and Security, then open BitLocker Drive Encryption.
3. Locate the drive under Removable data drives and select Turn on BitLocker.
4. Choose the password option and enter a strong password.
5. Save the recovery key somewhere other than the USB drive. Depending on your account and device, Windows may let you save it to your Microsoft account, store it in a file, or print it.
6. For a new, empty drive, choose Encrypt used disk space only. If the drive previously held sensitive files, select Encrypt entire drive.
7. If Windows asks you to select an encryption mode, choose the compatible mode intended for removable drives.
8. Start the encryption process. Leave the USB drive connected until Windows confirms that it’s finished.

To lock the drive again, eject it and disconnect it. The next time it’s connected, Windows will ask for the password.

Encrypt a USB drive on a Mac

This method creates an encrypted APFS volume and erases the entire USB drive. APFS is the best native option for current Macs, but it isn’t suitable if you need to open the drive natively on Windows.

1. Connect the USB drive and open Disk Utility from Applications and Utilities.
2. Select View, followed by Show All Devices.
3. In the sidebar, select the physical USB device rather than the indented volume beneath it. Check the capacity carefully before continuing.
4. Select Erase.
5. Enter a name for the drive and choose APFS (Encrypted) as the format.
6. For the scheme, select GUID Partition Map.
7. Enter and verify a strong encryption password, then select Erase.
8. Wait for Disk Utility to complete the process before selecting Done.

If you need compatibility with older Macs, Disk Utility may also provide the Mac OS Extended (Journaled, Encrypted) format. Always eject the volume through Finder before unplugging the drive.

Encrypt a USB drive on Linux with LUKS

LUKS is the standard full-volume encryption system used by many Linux distributions. The commands below erase the selected partition. Replace /dev/sdX1 with the actual USB partition shown by lsblk.

1. Connect the USB drive and identify it by checking its size and model:

   lsblk -o NAME,SIZE,MODEL,FSTYPE,MOUNTPOINTS

2. Unmount the USB partition:

   sudo umount /dev/sdX1

3. Create the LUKS container. Double-check the device name before entering the confirmation:

   sudo cryptsetup luksFormat /dev/sdX1

4. Open the encrypted container:

   sudo cryptsetup open /dev/sdX1 encrypted_usb

5. Create an ext4 filesystem inside the container:

   sudo mkfs.ext4 /dev/mapper/encrypted_usb

6. Create a mount point, then mount the volume:

   sudo mkdir -p /mnt/encrypted-usb
   sudo mount /dev/mapper/encrypted_usb /mnt/encrypted-usb

Once you’re finished, unmount the volume and close the encrypted mapping before removing the USB drive:

sudo umount /mnt/encrypted-usb
sudo cryptsetup close encrypted_usb

Many desktop Linux distributions also support LUKS through the Disks application. In its formatting dialog, the feature may be described as password-protected Linux storage. The exact label depends on the distribution.

Check that USB encryption is working

1. Copy a non-sensitive test file to the encrypted drive.
2. Eject or unmount the drive properly.
3. Disconnect it, then connect it again.
4. Make sure the system asks for the encryption password before showing any files.
5. Enter the password and open the test file.
6. Check that you can access the recovery key or password-manager entry from another trusted device.

If you can see files before entering a password, you may have encrypted only a folder or accidentally created an unencrypted partition.

Encryption and recovery best practices

• Keep backups: Encryption won’t protect your files from drive failure, accidental deletion, or corruption.
• Store recovery information separately: A recovery key kept only on the encrypted USB drive can’t help you while the drive is locked.
• Avoid automatic access: Don’t enable it on shared or portable computers.
• Eject the drive safely: Unplugging a USB drive during a write operation can damage its filesystem.
• Protect the computer as well: Malware can still read or copy files after you enter the password and open the drive.
• Don’t treat encryption as secure erasure: Before selling or disposing of storage hardware, use an appropriate sanitization process.

Frequently asked questions

Can I encrypt a USB drive without deleting its files?

BitLocker To Go can encrypt an existing compatible Windows volume without formatting it, though you should still make a backup first. The Disk Utility and LUKS methods covered here erase the selected drive or partition.

Can an encrypted USB drive work on Windows and Mac?

Native encryption doesn’t make this convenient. Windows can’t natively open APFS-encrypted drives, while macOS can’t natively open BitLocker volumes. A cross-platform application such as VeraCrypt is usually more practical, but you’ll need to install it on every computer where the drive is used.

What happens if I forget the USB encryption password?

You’ll need the recovery key or another configured method of access. Strong encryption is designed to prevent anyone from bypassing the password, so your data may be permanently inaccessible if you lose all recovery information.

Does formatting an encrypted USB drive remove the password?

Yes. Repartitioning or formatting the device can make it usable again, but doing so destroys access to the encrypted files. Formatting won’t recover the password.

Does USB encryption protect the drive from viruses?

No. Encryption protects the data only while the drive is locked. After you open it on an infected computer, malware may read, alter, encrypt, or copy its contents.