BitLocker USB Flash Drive Encryption: How To

Yes, you can use BitLocker to encrypt a USB flash drive on Windows 10 and 11 Pro, Enterprise, and Education editions. BitLocker To Go, the feature that handles removable drives, lets you password-protect the entire drive so that no one can read or copy your files without the password. This article explains how to set it up, what to watch out for, and how it compares to other encryption options.

What BitLocker To Go Actually Does

BitLocker To Go is the name Windows gives to BitLocker Drive Encryption when it is applied to removable drives like USB flash drives, external hard drives, and SD cards. When you encrypt a USB drive with BitLocker, the entire contents of the drive are scrambled using AES (Advanced Encryption Standard) with a 128-bit or 256-bit key. The key itself is protected by a password you choose, or by a smart card if your organization uses one.

Once encrypted, the drive appears in File Explorer with a padlock icon. When you plug it into a Windows PC, Windows asks for the password before it will show any files. Without the password, the data is unreadable, even if someone removes the flash drive and connects it to another computer or a forensic tool. This is a strong protection against physical theft of the drive.

One important detail: BitLocker does not encrypt individual files. It encrypts the whole drive at the block level, which means everything on it is protected, including hidden files, deleted files, and the file system itself. This is generally more thorough than file-level encryption.

Requirements and Limitations

Before you start, check that your Windows edition supports BitLocker. It is available only on:

Windows 10 Pro, Enterprise, and Education
Windows 11 Pro, Enterprise, and Education
Windows Server editions (with the BitLocker feature enabled)

Windows 10 and 11 Home do not include BitLocker To Go. If you have a Home edition, you cannot encrypt a USB drive with BitLocker without upgrading to a supported edition. There is no official workaround from Microsoft for this limitation.

Another requirement is that the USB drive must be formatted with NTFS, exFAT, or FAT32. BitLocker To Go works with all three, but there are differences. NTFS supports larger files and permissions, while exFAT and FAT32 are more compatible with other devices like cameras, game consoles, and older operating systems. If you plan to use the drive on a non-Windows device, keep in mind that BitLocker encryption will make it unreadable there unless the device has a BitLocker reader (which is rare).

Also note that BitLocker To Go does not work on drives that are already using other encryption software. You must decrypt or reformat the drive first.

How to Encrypt a USB Drive with BitLocker

The process takes a few minutes, depending on the size of the drive and the amount of data on it. Here are the steps for Windows 10 and 11:

Insert the USB flash drive into a USB port on your computer.
Open File Explorer (Win+E) and right-click the drive under “This PC”.
Select “Turn on BitLocker” from the context menu. If the option is grayed out, your Windows edition does not support it.
Choose “Use a password to unlock the drive”. Enter a strong password (at least 8 characters, but longer is better) and type it again to confirm.
Choose how to back up your recovery key. The recovery key is a 48-digit number that can unlock the drive if you forget the password. You can save it to a file, print it, or save it to your Microsoft account. Do not save it on the same USB drive you are encrypting.
Select how much of the drive to encrypt. “Encrypt used disk space only” is faster and works fine for a new or empty drive. “Encrypt entire drive” is slower but safer if the drive has previously contained sensitive data that you deleted but have not overwritten.
Choose the encryption mode. For a USB drive that will be used with Windows 10 or 11 only, select “Compatible mode”. For a drive that might be used with older Windows versions, select “Compatible mode” as well. The “New encryption mode” is only for fixed drives on Windows 10 1511 and later, so it is not applicable here.
Click “Start encrypting”. The process runs in the background. You can continue using the drive, but it is best to wait until it finishes before unplugging it.

After encryption, a small lock icon appears on the drive. When you unplug it and plug it back in, Windows will prompt for the password before showing any files.

How to Unlock, Manage, and Decrypt a BitLocker USB Drive

Unlocking a BitLocker USB drive is straightforward: plug it in, double-click the drive in File Explorer, and type the password. You can also check the box “Automatically unlock on this PC” if you want Windows to remember the password for that specific computer. This is convenient but reduces security if someone else uses your PC.

To change the password, right-click the drive and select “Manage BitLocker”. This opens the BitLocker Drive Encryption control panel. From there you can change the password, add a smart card, save or print the recovery key, and turn off BitLocker.

To decrypt the drive (remove encryption), right-click the drive and select “Manage BitLocker”, then click “Turn off BitLocker”. Windows will decrypt the drive, which can take a while. After decryption, the drive is normal again and can be used on any device without a password.

If you forget the password, you can use the 48-digit recovery key. When Windows asks for the password, click “More options” and then “Enter recovery key”. Type the key and the drive will unlock. You can then set a new password.

Common Problems and How to Fix Them

Here are the issues people run into most often with BitLocker USB drives:

BitLocker option is missing or grayed out. This almost always means your Windows edition does not support BitLocker. Check your edition by going to Settings > System > About. If it says Home, you need to upgrade to Pro or use a different encryption method.
Drive is not recognized after encryption. If you plug the drive into a computer that does not have BitLocker support (like a Mac or a Windows Home PC), it will not show any files. You need to unlock it on a supported PC first, or use a different encryption method for cross-platform use.
Forgot the password. Use the recovery key. If you lost the recovery key too, there is no way to recover the data. This is why backing up the recovery key is critical.
Encryption is stuck at a percentage. This can happen if the drive is very large or if you are using it while encrypting. Let it finish; do not unplug the drive. If it seems frozen for hours, check the drive’s activity light. If nothing happens after a long time, you may need to restart the process after safely ejecting the drive.
Drive is write-protected. Some USB drives have a physical write-protect switch. Check the side of the drive. If there is no switch, the drive may be failing; back up your data immediately.

BitLocker vs. Other USB Encryption Options

BitLocker is not the only way to encrypt a USB drive. Here is how it compares to common alternatives:

VeraCrypt (free, open source): Works on Windows, macOS, and Linux. You can create an encrypted container or encrypt the whole drive. It is more portable than BitLocker because the software can be installed on any OS. However, it requires installing software on every computer you use, whereas BitLocker is built into Windows.
Hardware-encrypted USB drives: Some flash drives (like those from Kingston, SanDisk, and others) have built-in encryption hardware. They usually require a PIN entered on a keypad or software to unlock. They are convenient but more expensive and may have proprietary software.
File-level encryption (e.g., 7-Zip with AES): You can compress and encrypt individual files or folders with a password. This is portable and works on any OS, but it does not protect file names, and you must remember to encrypt each file.
Windows built-in EFS (Encrypting File System): This encrypts files on NTFS volumes, but it is tied to your Windows user account and is not meant for removable drives.

For most people using Windows, BitLocker is the easiest because it is already there and integrates with the OS. For cross-platform use, VeraCrypt or a hardware-encrypted drive is better.

Safety Tips and Best Practices

Encrypting a USB drive protects the data, but it does not protect the drive from physical damage or loss. Here are some practical tips:

Always back up the recovery key in a separate location. If you lose the password and the key, your data is gone forever.
Use a strong password. A passphrase like “correct horse battery staple” is far better than a short mix of characters.
Do not leave the drive plugged in when you are not using it. Even encrypted, a plugged-in drive can be accessed by malware running on your PC.
If you use the drive on multiple computers, make sure they all support BitLocker. Otherwise, you will not be able to access the data on the go.
Consider using “Encrypt entire drive” if the drive has ever contained sensitive data that you deleted. Deleted files can often be recovered with software, and encryption only protects the used space.
Do not confuse BitLocker with “BitLocker Device Encryption” which is a different feature for built-in storage on some Windows 10/11 devices. That feature is automatic and does not apply to USB drives.

Frequently Asked Questions

Can I use BitLocker on a USB drive with Windows 10 Home?

No. BitLocker To Go is only available on Windows 10/11 Pro, Enterprise, and Education. Windows Home does not include it. You can upgrade to Pro, or use a free tool like VeraCrypt instead.

Will BitLocker encrypt a USB drive that already has files on it?

Yes. When you turn on BitLocker, you can choose to encrypt only the used space or the entire drive. The existing files will be encrypted in place, so you do not need to reformat or move them.

Can I open a BitLocker-encrypted USB drive on a Mac?

Not without additional software. macOS does not natively read BitLocker-encrypted drives. You would need a third-party tool like M3 BitLocker Reader or use a different encryption method for cross-platform use.

What happens if I lose my BitLocker password?

You can use the 48-digit recovery key to unlock the drive. If you lost the recovery key as well, there is no way to recover the data. That is why saving the key to your Microsoft account or printing it is essential.

Does BitLocker slow down a USB flash drive?

There can be a slight performance impact because encryption adds a layer of processing. On modern CPUs, the difference is usually negligible for everyday use. On very old or slow USB 2.0 drives, you might notice a small delay when reading or writing large files.

Can I use BitLocker on a USB drive with exFAT format?

Yes. BitLocker To Go supports NTFS, exFAT, and FAT32. exFAT is a good choice if you need to share files with other devices that support exFAT, but those devices will still not be able to read the encrypted drive without BitLocker support.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →