Turn on full-disk encryption so a stolen laptop's files stay locked

This guide gets full-disk encryption switched on and verified on your Windows laptop, Mac or Linux machine. You'll also store the recovery key safely and encrypt the external drives that hold the same files. Plan on 20 to 40 minutes of your time. The encryption itself can run for a few hours in the background while you keep working.

Why bother

Your login password only protects the operating system while it's running. It doesn't scramble the files on the drive. A thief can remove the drive, or boot the laptop from a USB stick, and read your documents, photos, saved browser sessions and password exports on another computer. Microsoft names this exact risk: data being read "by transferring the device's hard drive to a different device."

Full-disk encryption scrambles everything on the drive. The key stays locked until the laptop itself starts up properly with your credentials. On another computer, the drive is just noise. BitLocker (Windows), FileVault (Mac) and LUKS (Linux) are built in and free.

Before you start

• Time: 20 to 40 minutes of clicking. Encryption continues in the background afterwards.
• You need: an administrator account on the laptop, the laptop plugged into power, and a safe place for a recovery key. A password manager on another device, a printout kept at home, or a separate USB stick all work.
• Checked on: Windows 11 (24H2 and later) and Windows 10, macOS 27 (the same path has existed since macOS Ventura 13), and Ubuntu 26.04 LTS. Microsoft's and Apple's support pages were checked on 2026-10-16.
• Windows edition matters: Windows Home has Device encryption. Windows Pro, Enterprise and Education also have full BitLocker. To see which edition you have, open Settings > System > About and look at Edition.

Steps

1 Check whether your drive is already encrypted

Many newer laptops encrypt automatically, but often only halfway. Check before you change anything.

• Windows: Open Settings > Privacy & security > Device encryption. On Pro, also click Start, type BitLocker and open Manage BitLocker. Next to drive C:, you'll see BitLocker on, BitLocker off, Suspended or Waiting for Activation.
• Mac: Open Apple menu > System Settings > Privacy & Security, then scroll down to FileVault. It says On or Off.
• Linux: Run the command below. Your main partition should show crypto_LUKS.

lsblk -f

If Windows shows Waiting for Activation, or a drive icon with a yellow warning sign, the data is encrypted but the key is stored in the clear. Microsoft says a device in this state "remains unprotected even though the data is encrypted." Step 2 or Step 3 fixes it.

2 Windows Home: turn on Device encryption

1. Sign in with an administrator account.
2. Open Settings > Privacy & security > Device encryption. You can also press Win + R, type ms-settings:deviceencryption and press Enter.
3. Turn Device encryption to On.

The setting shows On only after encryption finishes. If you sign in with a local account, Windows doesn't turn this on automatically. You need to sign in with a Microsoft account at least once so the recovery key gets backed up to that account. That's what removes the clear key.

If you can't see Device encryption, your device doesn't support it, or you're signed in as a standard user. To find out why, click Start, type System Information, right-click it and choose Run as administrator. Under System Summary, find Device Encryption Support. Common reasons are TPM is not usable (turn on TPM, often called PTT or fTPM, in the BIOS/UEFI) and PCR7 binding is not supported (turn on Secure Boot, or unplug docks while booting). Windows 11 24H2 removed some old requirements, so more laptops qualify than before.

If it still isn't supported, don't stop there. Upgrade to Pro at Settings > System > Activation and follow Step 3 to use BitLocker. Or use the free VeraCrypt system encryption. VeraCrypt makes you create a Rescue Disk, which can repair a damaged boot loader or key data. Keep it safe, away from the laptop.