Windows Security · BitLocker & Encryption · Lesson 3 of 5

Encrypting External Drives

Put a password lock on USB sticks and backup drives that leave the house.

BitLocker To Go for USB drives

An external drive is storage that plugs into the computer, like a USB flash drive or a backup drive. They are small, cheap and easy to lose. A flash drive left in a library computer or dropped in a parking lot is one of the most common ways private files leak.

Your laptop's encryption doesn't cover them. Files copied to a plain USB stick are readable by anyone who finds it.

BitLocker To Go is the BitLocker lock for removable drives. It protects the stick with a password you choose. Turning it on needs Windows 11 Pro, Enterprise or Education.

To set it up:

1. Plug in the drive and open File Explorer.
2. Right-click the drive and choose Turn on BitLocker. If you don't see it, search the Start menu for Manage BitLocker.
3. Choose Use a password to unlock the drive, and type a strong one twice.
4. Save the recovery key, for example to your Microsoft account or as a printout. Don't save the only copy on the stick itself.
5. Choose Encrypt used disk space only for a new, empty drive. Choose Encrypt entire drive if it has held private files before.
6. When asked about the mode, pick Compatible mode, which is meant for drives that move between computers.
7. Click Start encrypting, and don't unplug the drive until it finishes.

A big drive can take a while. You can keep using the computer during this time.

Afterward, the drive shows a padlock icon in File Explorer. Each time you plug it in, Windows asks for the password before it shows any files.

Yes, this is the same recovery key idea as your main drive. Forget the password, and the recovery key is the only spare.

Passwords, other PCs and Macs

The password is the whole lock, so make it a good one. A passphrase, a few unrelated words strung together, is long and still easy to remember. Something like Kettle Orbit Garden Ninety is far stronger than a short word with a number on the end. Use a different one than your email password.

Typing it every time can feel like a chore. On your own computer, Manage BitLocker offers Turn on auto-unlock. That computer then opens the drive by itself, while every other computer still asks for the password. Only use it on a computer that is itself encrypted and protected by your sign-in.

What about other computers?

• Windows Pro computers open the drive after you type the password.
• Windows Home computers can't turn on BitLocker To Go, but they can usually open a locked drive with its password.
• A Mac can't open a BitLocker drive without extra software, so for sharing with a Mac, use a different method.

Some people buy hardware-encrypted drives instead. These have their own lock built in, sometimes with a keypad on the case. They work with any computer, but cost more.

Two more habits help:

• Don't plug in USB sticks you find. A found drive is a classic trick for spreading malware.
• Lock your backup drive too. A backup holds copies of everything, so a lost backup drive is as bad as a lost laptop.

If a drive only ever moves between your two Windows computers, BitLocker To Go is a free, simple lock.