Full-Disk Encryption: How to Turn On BitLocker and FileVault the Right Way

Your laptop has a strong password. You assume that means your files are protected if it is ever stolen. It does not.

Without disk encryption, a login password is a door on a house with no walls. Anyone who takes the machine can remove the drive, connect it to another computer, and read every file — documents, saved passwords, browser history, photographs, tax records — without ever seeing your login screen. The same is true of booting the laptop from a USB stick, which takes about two minutes and requires no specialist tools.

Full-disk encryption closes that gap. It scrambles everything on the drive so that the data is meaningless without a key. It is built into Windows and macOS, it is free, and on modern hardware it costs you essentially nothing in performance. Most people simply never turn it on — or assume, incorrectly, that it is already on.

What Encryption Actually Protects You From

Being precise about the threat matters, because encryption is often oversold.

It protects against physical access when the device is off. A stolen laptop, a phone left in a taxi, a drive pulled from a machine you sent for repair, a computer sold or recycled without a proper wipe. In every one of these cases, encryption is the difference between an inconvenient hardware loss and a serious data breach.

It does not protect against malware while you are logged in. Once you unlock the machine, files are readable by anything running on it. Encryption and antivirus solve different problems; you need both.

It does not protect data in the cloud. Files synced to a cloud account are governed by that account's password and two-factor settings, not your disk encryption.

There is also a practical angle people underestimate: encryption makes secure disposal trivial. A wiped encryption key renders an entire drive unrecoverable in seconds, no matter how many files were on it. If you have ever wondered whether a "delete everything" really deleted everything, this is the answer.

Turning On BitLocker (Windows)

Windows offers two related features, and the distinction trips people up.

Device Encryption is the automatic version, available on Windows Home. On many recent machines it switches itself on the first time you sign in with a Microsoft account. BitLocker is the full-featured version on Pro, Enterprise and Education, with more control over the recovery key.

Check whether it is already on

1. Open Settings → Privacy & security → Device encryption. If the toggle is there, that tells you the state directly.
2. If that page does not exist, open Control Panel → System and Security → BitLocker Drive Encryption and read the status next to your C: drive.

Enable it

1. In the BitLocker panel, click Turn on BitLocker next to the operating system drive.
2. When asked how to back up the recovery key, choose the option you will still have access to if the machine dies. Saving to your Microsoft account is the most reliable default for home users; a printed copy stored somewhere physically safe is a good second copy. Do not save the only copy to the drive you are encrypting.
3. Choose Encrypt entire drive if the machine has been in use for a while. "Used disk space only" is faster but leaves previously deleted data readable in unallocated space.
4. Pick the newer encryption mode (XTS-AES) unless the drive needs to be readable on older Windows versions.
5. Run the system check when offered, then restart. Encryption continues in the background and you can keep working.

The recovery key is the whole ballgame

BitLocker occasionally asks for the 48-digit recovery key after a firmware update, a motherboard repair, or a BIOS change. If you cannot produce it, the data is gone — permanently, with no support line that can help. Verify now that you can actually retrieve yours at account.microsoft.com/devices/recoverykey. Doing this today takes one minute. Doing it after the prompt appears is impossible.

Turning On FileVault (macOS)

Macs with Apple silicon and the T2 chip encrypt the internal drive at the hardware level by default, but FileVault still matters: without it, the decryption key is available at startup without requiring your password. FileVault ties the key to your login credentials, which is what actually stops someone reading the disk.

1. Open System Settings → Privacy & Security and scroll to FileVault.
2. Click Turn On.
3. Choose your recovery method. Create a local recovery key gives you a code you store yourself — more private, and entirely your responsibility. Allow your iCloud account to unlock the disk is more forgiving if you lose the code, but means your Apple account security becomes the weak point. Either is defensible; the iCloud route is the safer choice for most people, provided that account has strong two-factor authentication.
4. Let it finish encrypting in the background. Keep the Mac plugged in.

If you chose a local key, store it in a password manager entry or on paper away from the machine — never in a text file on the Mac itself.

Phones, External Drives and the Rest

• iPhone and iPad: encrypted by default as soon as a passcode is set. A six-digit or longer passcode is meaningfully stronger than four digits, and an alphanumeric one stronger still.
• Android: encrypted by default on modern versions, again tied to your screen lock. A device with no lock screen is not protected.
• External and USB drives: these are where sensitive data most often escapes. Use BitLocker To Go on Windows (right-click the drive → Turn on BitLocker) or Finder's Encrypt option on macOS. For a drive that must work on both, VeraCrypt is the standard free cross-platform option.
• Backup drives: an unencrypted backup of an encrypted laptop defeats the entire exercise. Time Machine offers an encryption checkbox; most Windows backup tools do too.

Common Mistakes

• Assuming it is on. Check rather than assume. Machines upgraded from older Windows versions, custom builds, and Macs restored from certain backups frequently have it off.
• Storing the recovery key on the encrypted device. Self-defeating, and surprisingly common.
• A weak login password. Encryption inherits the strength of what unlocks it. A four-digit PIN on a laptop undermines the whole setup.
• Leaving the machine suspended in public. Encryption protects a powered-off device. Sleep keeps keys in memory. Shut down properly when travelling, and require a password immediately on wake.
• Encrypting the laptop but not the backup drive or the USB stick in the bag beside it.

If Your Device Is Already Lost or Stolen

1. Use remote tracking straight away — Find My Device on Windows, Find My on Apple devices — and issue a remote lock or erase while the device may still be online.
2. Change the password of the account tied to the device (Microsoft or Apple) from another machine, then review active sessions.
3. Change any password saved in that device's browser. If the machine was not encrypted, treat every stored credential as compromised.
4. Revoke active sessions on email, banking and social accounts so that stolen session cookies stop working.
5. File a police report with the serial number. Insurers and, occasionally, recovery efforts require it.
6. If the drive was encrypted and powered off, your data is realistically safe. That is exactly the scenario encryption exists for.

The Bottom Line

Full-disk encryption is one of the few security measures that is genuinely set-and-forget: fifteen minutes once, no ongoing effort, no daily friction, and it converts the worst-case version of a lost laptop into a merely expensive one.

Check the status on every device you own this week. Turn it on where it is off. Then do the step almost everyone skips — confirm you can actually retrieve your recovery key from somewhere other than the encrypted machine. Encryption you cannot recover from is not protection; it is a slower way to lose your files.