A USB flash drive is small, convenient and very easy to lose. It slips out of a pocket in a matatu, gets left in a printing shop computer, falls behind a desk or walks out of an office in someone else's bag. When it contains payslips, client contracts, ID scans, school records, medical documents, business accounts or family photos, losing it is more than an inconvenience. It can be a privacy and security incident. The good news is that you can make a lost drive worthless to a stranger with a few clicks. This guide shows you how to encrypt a USB drive with BitLocker on Windows, what to do on a Mac, when to use VeraCrypt, how to store your recovery key safely, and how to avoid the mistakes that lock people out of their own files.
We hedge where behaviour depends on your Windows edition or your device, and say "we confirm per unit" or "check your edition" rather than guess. Encryption is a strong protection, but it is not magic, and it does not replace a backup.
We are City Gadgets Kenya, at New Alnoor Exhibition, Second Floor, Shop C7, Accra Road, Nairobi CBD, with same-day Nairobi delivery and next-day delivery outside Nairobi. Message us on WhatsApp for advice.
The short version
- Encryption scrambles the contents of the drive so that without the password or key, the data is unreadable.
- BitLocker To Go is Windows' built-in tool for encrypting removable drives. Creating it needs a supported Windows edition such as Pro, Enterprise or Education. Check your edition. Home editions can generally unlock BitLocker drives but may not be able to create them.
- Choose a strong password and save the recovery key in at least two safe places.
- Pick "Compatible mode" on removable drives you may use on other or older Windows PCs.
- On a Mac, use Finder or Disk Utility to encrypt a drive with a Mac format, or use a cross-platform tool such as VeraCrypt.
- Encrypt before you store sensitive files, and keep a backup because a forgotten password means lost data.
- Buy genuine drives. A fake drive with the wrong capacity can corrupt encrypted data.
| Option | Works on | Strength | Cross-platform | Notes |
|---|---|---|---|---|
| BitLocker To Go | Windows (Pro and above to create) | Strong | Windows mainly | Built in, simple |
| macOS encryption | Mac (APFS or Mac OS Extended) | Strong | Mac mainly | Built in, requires a Mac format |
| VeraCrypt | Windows, Mac, Linux | Strong | Yes | Free, open source, extra steps |
| Hardware-encrypted drives | Varies by product | Varies | Varies | Built-in keypad or software, we confirm per unit |
| Password-protected archives | Most systems | Depends on the tool | Yes | Good for a few files, not whole drives |
What encryption actually does
When you save a file normally on a USB drive, anyone who plugs it in can open it. Encryption transforms the data into unreadable scrambled information using a mathematical key. To read it, you need to unlock the drive with the password or recovery key. Without that, the data looks like random noise.
Modern encryption such as the AES standard used by BitLocker is considered very strong when used with a good password. The realistic weak point is not the maths but people: weak passwords, passwords written on a sticky note stuck to the drive, recovery keys saved on the same drive, or keys lost entirely.
Encryption protects data at rest. It does not protect you from malware on a computer where you have already unlocked the drive, from someone looking over your shoulder as you type the password, or from you accidentally sharing the files once opened.
Who should encrypt a USB drive?
- Business owners carrying client data, invoices or staff records.
- Accountants and lawyers handling confidential documents.
- Teachers and school administrators storing student records.
- Healthcare workers (following their institution's rules) carrying patient information.
- Journalists, activists and consultants protecting sources.
- Students with research data, scholarship documents or ID scans.
- Anyone with scans of ID cards, KRA PIN certificates, passports, bank statements or title deeds.
- Families with private photos and videos.
If losing the drive would embarrass you, expose someone else or cost money, encrypt it.
Before you start: plan so you do not lock yourself out
Spend two minutes on this. It prevents most disasters.
- Back up the drive first. Encryption touches every file. A power cut or removal mid-way can cause problems. Copy the contents to your computer or another drive first.
- Choose a strong password you can remember. A long passphrase of several unrelated words is stronger and easier to remember than a short complex one.
- Decide where to store the recovery key. Plan at least two locations that are not the USB drive itself.
- Check your Windows edition. Open Settings, then System, then About, and look under Windows specifications.
- Check your file system. BitLocker works on common formats such as NTFS, exFAT and FAT32. If you are unsure, read our post on exFAT, FAT32 and NTFS explained.
- Decide how you will use the drive. If you need to open it on other computers, including Macs, plan accordingly.
- Use a healthy drive. A failing drive is a poor candidate. See how flash drives fail.
Step-by-step: encrypt a USB drive with BitLocker To Go
These steps are for Windows 10 and Windows 11 Pro, Enterprise or Education. Menu wording can differ slightly between versions.
Step 1: Insert the drive
Plug the USB drive into your computer. Wait until it appears in File Explorer under This PC.
Step 2: Turn on BitLocker
Right-click the drive in File Explorer and choose Turn on BitLocker. If you do not see this option, your Windows edition may not support creating BitLocker drives, or BitLocker may be disabled by your organisation.
Step 3: Choose how to unlock
Choose Use a password to unlock the drive. Enter a strong password twice. Some editions also offer unlocking with a smart card, which is rare for personal use.
Step 4: Save your recovery key
BitLocker asks how you want to back up your recovery key. Options usually include saving it to your Microsoft account, saving it to a file or printing it. Choose at least two methods that make sense for you:
- Save to a file and store that file on your computer and in a secure cloud folder, but never only on the USB drive you are encrypting.
- Print it and keep the paper somewhere safe at home or in the office.
- Save to your Microsoft account if you are signed in with one.
The recovery key is a long string of numbers. It is your emergency way in if you forget the password. Anyone who has it can open the drive, so protect it.
Step 5: Choose how much to encrypt
BitLocker usually offers two choices:
- Encrypt used disk space only. Faster, and suitable for a new or freshly formatted drive.
- Encrypt entire drive. Slower, and better for a drive that has held sensitive files before, because deleted data that remains on the drive is also protected.
If the drive has been used for sensitive material before, choose the entire drive.
Step 6: Choose the encryption mode
On removable drives you will normally see:
- New encryption mode. Stronger and for drives used only on newer versions of Windows.
- Compatible mode. For drives you may use on older versions of Windows.
For a USB drive that moves between computers, Compatible mode is the safer choice. Check what your version of Windows recommends.
Step 7: Start encrypting
Click Start encrypting. Do not remove the drive or shut down the computer until it finishes. Time depends on drive size, speed and mode. A large, slow drive can take a while. A fast drive finishes sooner.
Step 8: Test it
Eject the drive, unplug it and plug it back in. Windows should ask for the password. Unlock it, open a file and check that everything works. Also test your recovery key at a safe moment if you can, so you know it is valid.
Using a BitLocker drive day to day
Unlocking. Plug the drive in, enter the password when prompted. You can often choose to automatically unlock on a computer you trust, which is convenient on your own PC but not on shared ones.
On other Windows computers. Plug it in and enter the password. Older versions of Windows may need Compatible mode.
On a Mac. BitLocker is not supported natively on macOS. You would need third-party software, which is often a paid tool. If you move between Windows and Mac, consider VeraCrypt or format and encrypt according to your needs.
On Android phones. Some phones can read USB drives through OTG, but BitLocker-encrypted drives generally will not unlock on Android natively.
Ejecting. Always use Safely Remove Hardware or eject, so that writes finish.
Locking manually. Right-click the drive and choose Lock to relock without removing it.
Changing the password. Right-click the drive and choose Manage BitLocker, then change the password.
Turning BitLocker off. From the same menu, choose to turn off BitLocker. This decrypts the drive, which takes time and removes protection.
Encrypting a USB drive on a Mac
macOS has built-in encryption for drives formatted with Apple formats. The tool you use depends on the drive's format.
If the drive is formatted APFS or Mac OS Extended (Journaled): open Finder, Control-click the drive in the sidebar and choose Encrypt, then set a password and a hint. The Mac encrypts in the background. A hint should help you, not reveal the password.
If the drive is formatted exFAT or FAT32: macOS cannot encrypt it in place. You would need to back up the contents, erase the drive in Disk Utility using APFS (Encrypted) or Mac OS Extended (Journaled, Encrypted), set a password, and copy the files back. Erasing deletes everything, so back up first.
Cross-platform trade-off: drives encrypted with Apple formats will not open on ordinary Windows computers without extra software. If you move between Mac and Windows, VeraCrypt is a better fit.
VeraCrypt: a cross-platform alternative
VeraCrypt is a free, open-source encryption tool that works on Windows, macOS and Linux. It can encrypt an entire drive or create an encrypted container file that you mount like a drive. Many people like it because it works on any edition of Windows, including Home, and it is not tied to one company.
Pros: works across systems, free, strong encryption, supports hidden volumes for advanced users.
Cons: you must install the software on any computer where you want to open the drive (unless you use a portable mode on Windows with administrator rights), it is more technical, and the learning curve is higher.
Basic idea: install VeraCrypt from its official website, choose to create a volume, select the USB drive or a container file, pick an encryption algorithm (the defaults are sensible), set a strong password, format the volume and then mount it with your password when you want to use it.
Download VeraCrypt only from its official site. Fake download pages exist for popular security tools. If you are not confident, ask our team on WhatsApp and we will point you in the right direction.
Hardware-encrypted USB drives
Some USB drives perform encryption inside the drive using a keypad or a bundled application. These can be handy if you must use computers where you cannot install software, or if you want a physical PIN. They vary widely in quality and design, and some cheap ones have been criticised for weak implementations. Whether a particular model suits you depends on how it works, so we confirm per unit what a given drive offers before recommending it. A software-encrypted standard drive that you control is often simpler and just as safe for most people.
Password-protected archives for a few files
If you only need to send or store a few files, a password-protected archive (such as a ZIP or 7z file with strong encryption) can be enough. Use a tool that supports strong encryption, such as 7-Zip with AES-256. Older "ZIP passwords" may be weak, so check the settings. For whole drives that you carry daily, BitLocker or VeraCrypt is a better fit.
Encrypting phone storage and SD cards
Modern iPhones and most recent Android phones encrypt their internal storage by default once you set a screen lock, so setting a strong lock code matters. Memory cards may be treated differently. Some Android phones let you encrypt a card, but a card encrypted by one phone may not be readable elsewhere. Check your phone's settings and the guidance for your model, and keep important files backed up. For general card choices, see our microSD card guide.
Choosing a strong password or passphrase
The strength of your encryption depends on your password.
- Use a passphrase of four or more unrelated words, for example a random sentence only you would know. Length beats complexity.
- Avoid obvious choices: your name, birth year, phone number, football team, "password" or "123456".
- Do not reuse your email or M-Pesa-related passwords.
- Do not stick it on the drive or on the laptop.
- Use a reputable password manager if you have many passwords.
- Never share the password over an insecure channel. If you must share a drive, send the password separately by a different method.
Recovery keys: the most important step
Most people who lose access to encrypted data do so because they never saved the recovery key, saved it only on the encrypted drive, or lost it.
Do:
- Save the key in at least two separate places.
- Print a copy and keep it in a safe place.
- Label it clearly with which drive it belongs to, without writing the password.
- Store a copy in a secure cloud folder that you control.
- Tell a trusted person where to find it in an emergency, if appropriate.
Do not:
- Save the key only on the USB drive itself.
- Email it to yourself without protection if the email is shared or unsecured.
- Post photos of it on social media or in group chats.
- Throw it away after "testing".
Without the password or the recovery key, encrypted data is effectively gone. There is no back door and nobody, including us, can unlock it for you.
Common mistakes with encrypted USB drives
- Encrypting the only copy. If the drive fails, you lose everything. Keep a backup. See the 3-2-1 backup rule.
- Storing the recovery key on the drive. It is useless if you cannot unlock the drive.
- Weak passwords such as a name or a phone number.
- Removing the drive during encryption, causing corruption.
- Forgetting to test after setting up.
- Using the drive on untrusted computers. If the computer has malware, it can capture your password or copy the files once unlocked.
- Assuming encryption equals backup. It does not protect against failure or deletion.
- Using a fake drive whose real capacity is smaller than advertised.
- Letting the drive sit unlocked in a shared computer.
- Forgetting to tell colleagues who share the drive how to open it.
Performance, size and speed
Encryption adds a small amount of work. On modern computers, the effect on a USB drive is small, and you may not notice. Older computers and slower drives may feel slower, especially during the initial encryption. Encrypting a full drive takes longer than encrypting used space only. If speed matters, a quality drive makes a real difference. Our guide to the best flash drive and USB-C flash drive explains how to choose.
Encrypting external SSDs and hard drives
BitLocker To Go works on external hard drives and portable SSDs too, and the steps are the same. For a drive that holds all your business files or backups, encryption is especially valuable, because these drives are larger and more likely to hold sensitive data. Remember that if you encrypt a backup drive, you must keep the key safe, otherwise you cannot restore. Read about options in our guides to the best portable SSD and best backup drive.
Legal and workplace considerations
Businesses in Kenya handle personal data of customers, staff and clients, and data protection law expects reasonable safeguards. Encryption is a widely accepted safeguard for portable media. We are not lawyers, and this is not legal advice, but if you hold personal data, ask your legal or compliance adviser what your obligations are. Many employers also have IT policies on removable media, so check your workplace's rules before using personal drives for work data. Never encrypt files in a way that locks your employer out of data they own.
Encryption at the office: a simple policy
A small business can adopt a simple rule: no confidential data on unencrypted removable media. Practical steps:
- Buy company-owned drives from a trusted source.
- Encrypt each drive with BitLocker To Go or VeraCrypt.
- Store recovery keys centrally, with restricted access.
- Label drives and record who holds them.
- Train staff to eject properly, lock drives and report loss at once.
- Keep backups of anything on a portable drive.
- Retire old drives properly, wiping and destroying them when they are no longer needed.
What to do if you lose an encrypted drive
Do not panic. If the drive was encrypted with a strong password, the finder cannot read it. Still:
- Change passwords for any accounts whose details were on the drive.
- Notify your employer or clients if required.
- Restore from your backup onto a new encrypted drive.
- Consider whether the loss needs to be reported under your obligations.
- Note the lesson and tighten your habits.
Selling, giving away or recycling a drive
Before passing on a drive, wipe it properly. Deleting files is not enough. A full format with overwrite or a secure erase tool reduces the chance of recovery. For SSDs and flash drives, behaviour varies, and encrypted drives are easier to make unreadable because destroying the key makes the data unreadable. If the drive held very sensitive data, physical destruction may be the safest option. Do not sell or donate a drive containing recoverable personal data.
Example scenarios
These are illustrative, not customer records.
Scenario 1: The freelance accountant. She carries client records on a flash drive. She buys a genuine drive, turns on BitLocker To Go on her Windows Pro laptop, saves the recovery key to a file and a printed copy, and keeps a backup on her office computer. When the drive is left in a cyber café, she is relieved the files are unreadable.
Scenario 2: The school administrator. He needs to carry student records between campuses. He uses Compatible mode so that the drive opens on older school computers. The head teacher keeps the recovery key in a locked drawer.
Scenario 3: The Mac and Windows mix. A designer uses a MacBook at home and Windows PCs at a print shop. BitLocker will not open on her Mac. She chooses VeraCrypt, installs it on both, and keeps a backup.
Scenario 4: The forgotten password. A man encrypts a drive, forgets the password and has not saved the recovery key. Without either, the data cannot be recovered. He learns the hard way to save the key and keep backups.
Scenario 5: The family photos. A mother stores family photos on an external hard drive and encrypts it. She prints the recovery key, keeps it with other important papers and adds a second backup at a relative's house.
Troubleshooting
"Turn on BitLocker" is missing. Your Windows edition may not support creating BitLocker drives, or policy may block it. Check your edition, or use VeraCrypt.
The drive will not unlock. Check Caps Lock and keyboard layout. Try the recovery key. If you have neither, the data may be unrecoverable.
Encryption is very slow. Large drives and slow USB ports take time. Use a faster port and drive, and keep the computer powered.
The drive does not open on another computer. Check whether it was encrypted in new mode. Re-encrypt in Compatible mode if needed. On a Mac, BitLocker will not work natively.
The drive shows as RAW or asks to format. Do not format. See our post on data recovery in Kenya.
The computer asks for the recovery key unexpectedly. On drives, this can happen after a change. Enter the key from your records.
How encryption works, a little deeper
Encryption uses an algorithm and a key. BitLocker generally uses the AES algorithm. When you set a password, it does not encrypt your files directly with that password. Instead, a random "volume master key" encrypts the data, and your password (and recovery key) protect that master key. That design is why you can change your password without re-encrypting the whole drive, and why the recovery key can unlock the same data. The strength of the system rests on the secrecy of the key, which is why passphrase quality and key storage matter more than any technical setting you will see in the wizard.
Encryption and malware: what it will not stop
Encryption protects a locked drive. Once you unlock it on a computer, the files are accessible to anything running on that computer with your permissions. A computer infected with malware can read your files, and ransomware can encrypt them again on top of your encryption. Keep your computer updated, use reputable security software, be careful with unknown attachments, and avoid unlocking sensitive drives on public computers in cyber cafés or print shops. If you must use a shared computer, assume it may be unsafe and avoid unlocking highly sensitive drives there.
Travel, border checks and sharing passwords
If you travel with an encrypted drive, remember that rules differ between countries and that officials may ask you to unlock devices. Know the rules of the places you visit, and carry only what you need. Never send a password and the drive together. If a colleague needs access, give the drive in person and share the password through a separate channel, or arrange a temporary arrangement that you can later revoke by changing the password.
Encrypted drives and cloud backups
Some people copy encrypted drives into cloud storage as an extra backup. A cleaner approach is to back up the plain files to an encrypted cloud container or to use a backup tool that encrypts before uploading. Make sure you control the keys. If you use a cloud service with its own encryption, read how it handles keys and who can access your data. Remember to protect your cloud account with a strong, unique password and two-step verification.
Questions to ask any seller before you buy a drive
- Is the drive brand new and sealed?
- What is the exact model and capacity?
- Is the capacity genuine, and can I test it in front of you?
- What is the exchange policy?
- Will I get a receipt?
- Where is your shop if something goes wrong?
How to spot a fake USB drive
Encryption on a fake drive is a recipe for disaster. Fake USB drives report a large capacity but contain far less real storage. They accept files until the real space fills, then overwrite earlier data. If that data is encrypted, corruption can make the whole volume unreadable. Use these ten checks together.
- Test the real capacity. Use a trusted capacity test tool to write and verify data across the whole drive. A fake fails.
- Check the packaging. Genuine boxes are clean and accurate. Spelling mistakes and poor print are warning signs.
- Check the model and serial number. They should match on the box and device and be verifiable on the maker's site.
- Inspect the casing. Rough seams, misaligned logos and cheap plastic suggest a fake.
- Check the connector. Genuine connectors are neat and snug. Loose or rough ones are warning signs.
- Check the speed. A fake often copies slowly or in odd bursts.
- Check the price. If it looks too good to be true, it probably is.
- Check the seller. No shop address, no receipt and no return policy are warnings.
- Check how it formats. A fake may show an unusual size after formatting.
- Check the drive's behaviour after a few days. Files that go missing or become corrupt are a red flag.
If you are unsure, bring the drive to New Alnoor Exhibition, Second Floor, Shop C7, Accra Road, and we will help you check it.
Why buy your USB drives from City Gadgets Kenya
- Genuine products, checked before they reach you.
- A real shop at New Alnoor Exhibition, Second Floor, Shop C7, Accra Road, Nairobi CBD.
- Same-day delivery in Nairobi and next-day delivery outside Nairobi.
- M-Pesa payment and clear receipts.
- Honest advice, including telling you when a simple password-protected file is enough.
- Flash drives, SSDs and memory cards in our accessories category.
- Support and repairs through our repair service.
- Trade-ins through our sell page.
- WhatsApp help on +254745575931.
Your encryption checklist
- I backed up the drive before encrypting.
- My Windows edition supports BitLocker To Go, or I chose VeraCrypt.
- I chose a strong passphrase.
- I saved the recovery key in at least two places, not only on the drive.
- I chose Compatible mode for drives used on several PCs.
- I tested unlocking after ejecting.
- I keep a separate backup.
- I bought a genuine drive.
Frequently asked questions
Can I encrypt a USB drive on Windows Home? BitLocker To Go creation generally needs Pro, Enterprise or Education, while Home can usually unlock BitLocker drives. Check your edition. VeraCrypt works on Home.
Is BitLocker safe? It uses strong encryption when used with a good password. The weak point is usually the password and key handling.
What if I forget the password? Use the recovery key. Without it, the data is effectively unrecoverable.
Will it open on a Mac? Not natively. Use VeraCrypt or a Mac-formatted encrypted drive.
Does encryption slow the drive? Slightly, and on modern computers it is often unnoticeable.
Is encryption a backup? No. Keep separate backups.
Can I encrypt an SD card? Possibly, depending on the device. Check the instructions for your phone or camera.
How do I know my drive is genuine? Use the ten checks above, and test the real capacity.
Where can I buy a USB drive in Nairobi? At City Gadgets Kenya, Shop C7, Second Floor, New Alnoor Exhibition, Accra Road.
Need help choosing a drive?
Message us on WhatsApp with how you will use the drive, and we will recommend a genuine one.
Related reading: Data recovery: what to do in Kenya · The 3-2-1 backup rule · exFAT, FAT32 and NTFS explained · Best flash drive in Kenya
