To encrypt a Windows laptop, open Settings > Privacy & security > Device encryption (Windows Home) or Manage BitLocker in Control Panel (Pro, Enterprise and Education) and turn it on. On a Mac, open System Settings > Privacy & Security > FileVault and click Turn On.
To encrypt a Windows laptop, open Settings > Privacy & security > Device encryption (Windows Home) or Manage BitLocker in Control Panel (Pro, Enterprise and Education) and turn it on. On a Mac, open System Settings > Privacy & Security > FileVault and click Turn On. Before you do either, decide where your recovery key will live, because without it a locked drive can't be opened.
If your laptop is lost or stolen, a password on your account doesn't protect the files on its drive. Someone can take the drive out, or boot from a USB stick, and read everything. Full-disk encryption scrambles the whole drive, so the data is useless without your login or recovery key.
The good news is that many laptops sold in the last few years are already encrypted, or nearly so. This guide shows you how to check, how to finish the job, and how to avoid the one mistake that causes real trouble: losing the recovery key.
In this guide:
The tool you use depends on your operating system and, on Windows, your edition. Microsoft explains the difference between the two Windows options on its Device Encryption support page.
| Computer | Built-in encryption | Notes |
|---|---|---|
| Windows 11 or 10 Home | Device Encryption | Uses BitLocker underneath, with a simple on/off switch, on supported hardware |
| Windows 11 or 10 Pro, Enterprise, Education | BitLocker Drive Encryption | Full controls, including external drives (BitLocker To Go) |
| Mac with Apple silicon or a T2 chip | FileVault | Data is encrypted automatically; FileVault makes your password required to unlock it |
| Older Intel Mac without T2 | FileVault | Must be turned on to encrypt the drive |
| Linux | LUKS (usually chosen at install) | Most installers offer an "encrypt the disk" option |
Not sure which Windows edition you have? Open Settings > System > About and read Edition under Windows specifications.
Encryption rarely goes wrong, but turning it on rewrites every block of your drive, so a fresh backup is cheap insurance.
You can keep working while the drive encrypts. Time depends on the size of the drive and how much is on it.
There are three quick ways to check. Use whichever you're comfortable with.
manage-bde -status.In the command output, look at Conversion Status and Protection Status for drive C:. Microsoft's BitLocker operations guide lists the statuses you might see:
| Status | What it means | What to do |
|---|---|---|
| On / Protection On | The drive is encrypted and protected | Check your recovery key is saved (Step 5) |
| Off | The drive isn't encrypted | Turn on Device Encryption or BitLocker |
| Suspended | Encrypted, but protection is paused | Resume protection |
| Waiting for Activation | Encrypted with a clear key, so not yet protected | Finish setup by turning protection on |
"Waiting for Activation" catches people out. It can appear on new laptops set up with a local account, and it means the data is not yet protected even though encryption has started.
If you don't see Device encryption at all, your hardware may not support it or you may be on a standard account. To find out why, search for System Information, right-click it, choose Run as administrator, and read Device Encryption Support at the bottom of System Summary. Common reasons include no usable TPM chip, Secure Boot switched off in the firmware settings, or the Windows Recovery Environment not being set up.
Windows Home doesn't include the full BitLocker controls. If your hardware doesn't support Device Encryption, the options are upgrading to Windows Pro or using third-party encryption software.
After the restart, encryption carries on in the background. You can check progress at any time with manage-bde -status.
The recovery key is a 48-digit number. Windows asks for it when it can't unlock the drive automatically, for example after some firmware updates, hardware changes or too many wrong PIN attempts. Microsoft's guide to finding your BitLocker recovery key is clear that its support team can't recover a lost key for you.
aka.ms/myrecoverykey on another device and sign in. Check that your laptop's key is listed now, while everything works.If the laptop was set up by someone else, such as a family member or a shop, the key may be in their Microsoft account. Sort that out now rather than at the recovery screen.
On macOS Ventura and later, FileVault lives in System Settings. On older versions, look in System Preferences > Security & Privacy > FileVault. Apple's guide to protecting data on your Mac with FileVault covers each version.
Apple is blunt about the risk: if you forget your login password and also lose the recovery key, your files are gone for good. Once FileVault is on, automatic login is disabled and a password is always needed at startup.
System Settings shows whether FileVault is on, but Terminal gives a quick, scriptable answer. Open Terminal and run:
fdesetup statusYou'll see FileVault is On, FileVault is Off, or a progress message while encryption is running. For a simple yes or no, fdesetup isactive prints true or false. Both are handy when you look after several family Macs and want to confirm each one is protected.
Full-disk encryption only covers the internal drive. Files you copy to a USB stick or external SSD are unprotected unless you encrypt that drive too.
Pick a long password you can type from memory, or generate one with our password generator and save it in your password manager. A drive encrypted on Windows with BitLocker isn't natively readable on a Mac, and vice versa, so plan for where you'll open it.
| Situation | Does full-disk encryption help? |
|---|---|
| Laptop stolen while switched off | Yes, the data is unreadable without your key or password |
| Drive removed and plugged into another computer | Yes |
| Laptop stolen while unlocked | No, so lock your screen when you walk away |
| Malware or phishing while you're signed in | No, you need updates, antivirus and care with links |
| Files copied to a USB stick | No, unless that drive is encrypted too |
| Files in cloud storage | No, that depends on your cloud account's security |
File system choice matters here too. Copy a file from your encrypted laptop to a plain exFAT stick and the protection stays behind, which I explain in my guide to NTFS vs FAT32 vs exFAT. Encryption works best alongside a strong account password, a screen that locks quickly, and two-factor authentication on your cloud accounts.
Possibly. Many Windows 11 laptops set up with a Microsoft account turn on Device Encryption automatically, and Macs with Apple silicon or a T2 chip encrypt their data by default. Check in Settings, Manage BitLocker, manage-bde -status on Windows, or fdesetup status on a Mac.
On modern laptops you're unlikely to notice a difference in everyday use, because current processors and drives handle encryption efficiently. The first encryption pass runs in the background and can make the machine feel slightly busier until it finishes.
Device Encryption is a simplified version of BitLocker for Windows Home and supported hardware, with a single on/off switch. BitLocker on Pro, Enterprise and Education adds full controls, including startup PINs and encryption for external drives.
If Windows asks for the key and you can't find it in your Microsoft account, a work account, a printout or a USB drive, the data can't be unlocked. Microsoft can't recreate it, so the only option is to reset the laptop and lose the files on it.
For most personal Macs, letting iCloud unlock the disk is convenient and reduces the risk of losing a written key. If you'd rather not link the two, create a recovery key and keep it somewhere safe away from the Mac.
Not with built-in tools. If System Information shows your hardware doesn't meet the prerequisites, you can enable a missing setting such as Secure Boot, upgrade to Windows Pro for BitLocker, or use reputable third-party encryption software.
No, normal Windows updates work with encryption on. For BIOS or UEFI firmware updates, suspend BitLocker protection first unless the manufacturer's updater says it handles this for you.
Last checked: 21 October 2026. Figures, settings and guidance can change, so confirm anything important with the sources linked above.
msconfig opens Windows System Configuration, a built-in troubleshooting tool for controlling how Windows starts. What each tab does, how to do a clean boot, diagnostic startup and safe boot, how to escape a safe mode loop, and why it matters for security.
UAC (User Account Control) is the Windows feature that runs your apps with standard rights and asks before anything gets admin power. Here’s how the two tokens, the dimmed secure desktop, the four slider levels and the registry settings fit together.
Use NTFS for internal Windows drives, exFAT for USB sticks and SD cards you share with a Mac, and FAT32 only for small or old devices. Here are the real limits (4 GB files, 32 GB format cap), the security differences and the commands.
%windir% is an environment variable that points to the Windows folder, usually C:\Windows. Here’s what the common variables mean, the difference between user and system variables, set vs setx, PowerShell’s $Env: syntax and how PATH finds programs.