Personal documents, photographs, backups and work files often move between computers, external drives and USB sticks. When one of these devices is lost or stolen, the problem is not only the value of the hardware: the data inside it may be genuinely sensitive.
VeraCrypt is an open-source tool that can encrypt containers, partitions, external drives and, in some scenarios, the system disk. Used correctly, it adds an important layer of privacy protection without requiring files to be uploaded to a cloud service.
What is VeraCrypt?
VeraCrypt encrypts data in real time. When a volume is dismounted, its contents appear as encrypted data and cannot be used without the correct password and any required keyfiles. When it is mounted, the operating system sees it as a normal disk and files are encrypted and decrypted while they are read and written.
- it is free and open source
- it works on Windows, macOS and Linux
- it can protect file names, folders and the contents inside the volume
- it can create encrypted containers that look like ordinary files
- it can encrypt partitions and devices such as USB drives, SSDs and external hard disks
- it can also be used, with greater care, to encrypt the system
Three ways to protect your data
1. Encrypted container in a file
A container is a large file that behaves like a virtual disk once mounted with VeraCrypt. It is flexible: the container can be saved on a computer, external SSD or USB drive and copied like a normal file while the volume is dismounted.
It is often the simplest choice for protecting documents, photographs and personal files without changing the computer's partition structure. However, if the container is damaged or deleted, many files can become inaccessible at once, which is why a backup remains essential.
2. Encrypted partition or device
Alternatively, a partition or device can be encrypted directly. This is useful for an external SSD, hard disk or USB drive dedicated exclusively to protected data: there is no large container file to move because the encryption applies directly to the selected area.
The practical difference matters: if the whole USB drive is encrypted, VeraCrypt cannot be run from that same drive before it has been unlocked. The software needed to mount the volume must therefore be on the computer or in a separate unencrypted area.
3. System disk encryption
VeraCrypt can also protect the disk on which Windows is installed, asking for a password before the system starts. This is powerful protection against reading data while the computer is switched off, but it requires more preparation: a verified backup, a recovery plan and, where applicable, a Rescue Disk are needed before proceeding.
For a first use, it is generally safer to start with a container or external drive, become familiar with mounting and dismounting, and only then consider system encryption.
The USB drive with an encrypted partition and VeraCrypt Portable
Dividing a USB drive into two areas is possible and can be practical. A first, unencrypted partition can contain VeraCrypt in portable mode and a small instruction file. The second partition can be encrypted and contain personal data.
- unencrypted area: VeraCrypt Portable, instructions and any non-sensitive files
- encrypted area: documents, photographs, exported credentials and other confidential data
- a long, unique password for the encrypted volume
- dismounting the volume before disconnecting the USB drive
- safely ejecting the device after dismounting
There is an important limitation to know: on Windows, USB drives with multiple partitions may not be handled like an ordinary multi-partition disk. In some cases the system shows only the main partition, while the encrypted area is reached through VeraCrypt. The setup must therefore be tested on the operating system you intend to use.
Portable mode means that VeraCrypt can start without a normal installation, but it does not mean that it can always be used without permission. On Windows, the driver required to mount volumes normally needs administrator privileges. Use may also leave traces on the computer, and it is not wise to insert a USB drive containing sensitive data into an unknown or potentially infected computer.
Does VeraCrypt encrypt individual files?
Not in the traditional sense of a program that takes a file and produces an independent encrypted copy. VeraCrypt protects a container or partition: after mounting it, files are copied inside and encryption happens automatically during writing.
This approach is very convenient when many files need to be managed together. If a single encrypted copy must be sent to another person, compatibility, the availability of VeraCrypt on the recipient's computer and the way the password and instructions will be communicated all need careful consideration.
Passwords, keyfiles and hidden volumes
The password is the most important part of the whole system. It must be long, unpredictable and used only for that volume. A keyfile can add another requirement for opening it, but also introduces a risk: if it is lost and no safe copy exists, the volume may no longer be accessible.
VeraCrypt also offers advanced features such as hidden volumes. They are intended for particular scenarios and require very careful handling, because operations or copies performed incorrectly can damage hidden data. They are not a simple secret mode to activate without understanding the requirements and limits, especially on flash devices and SSDs subject to wear levelling.
What does it protect and what does it not protect?
VeraCrypt is especially useful when the main risk is physical loss of the device or unauthorised access to data while the computer is switched off. If the volume is dismounted, someone who finds the USB drive or disk should not be able to read its contents without the correct credentials.
- it does not replace a backup: an encrypted disk can still fail
- it does not protect files while the volume is mounted and unlocked
- it does not defend against malware, keyloggers or an already compromised computer
- it cannot recover a forgotten password and has no backdoor
- it does not make a public or unknown computer safe
- it does not prevent data loss if the USB drive is disconnected without dismounting the volume
Backups and good habits
Encryption protects confidentiality, not the physical integrity of the device. A VeraCrypt volume must therefore be part of a backup strategy: at least one separate copy kept in a different place, plus regular checks that the files can actually be restored.
- keep at least two copies of important data
- protect the backup with a consistent solution as well
- do not work directly on the only existing copy
- always dismount the volume before disconnecting the device
- store passwords and keyfiles securely and in a recoverable way
- periodically check that the backup opens and that files are readable
- download VeraCrypt only from official sources and verify the package's authenticity where possible
Powerful protection that needs to be designed properly
VeraCrypt can be an excellent solution for protecting the privacy of an individual, family or small business. The best result does not come from simply installing the program: it depends on the volume type, password management, backups and the procedures used every day.