How to Encrypt a Hard Drive in Windows

Encrypting a hard drive in Windows protects your data from unauthorized access if your computer is lost or stolen. This guide walks you through using BitLocker (built into Windows Pro and Enterprise) and the built-in device encryption on Windows Home. You’ll need an administrator account and, for BitLocker, a Trusted Platform Module (TPM) chip or a USB drive to store the recovery key.

What You’ll Need

Windows 10 or 11 Pro, Enterprise, or Education (for BitLocker) or Windows Home with device encryption enabled.
An administrator account.
A TPM chip (most modern PCs have one) or a USB flash drive for the startup key.
A printer or a safe place to store your recovery key (or a Microsoft account to back it up).

Step-by-Step

Check your Windows edition: Press Win + R, type winver, and press Enter. If you have Windows Home, look for “Device encryption� in Settings > Privacy & Security > Device encryption. If it’s not there, you’ll need to upgrade to Pro to use BitLocker.
Open BitLocker: Press Win + S, type Manage BitLocker, and select the result. In the Control Panel window, you’ll see your drives listed.
Turn on BitLocker for a drive: Click Turn on BitLocker next to the drive you want to encrypt (usually the C: drive). If the option is grayed out, your TPM may be disabled—see Troubleshooting.
Choose how to unlock the drive at startup: Select “Use a password to unlock the drive� or “Use a smart card.� For most users, a password is simplest. If you don’t have a TPM, you’ll see an option to use a USB startup key—insert a USB drive and select that.
Save your recovery key: This is critical. Choose to save it to your Microsoft account, a file, or print it. Store it somewhere safe—not on the encrypted drive itself. You’ll need this if you forget your password or if Windows changes.
Choose how much to encrypt: Select “Encrypt used disk space only� for a new PC or a drive with little data, or “Encrypt entire drive� for a drive that already has data or if you’re unsure. The latter is more secure but takes longer.
Select the encryption mode: Choose “New encryption mode� for fixed drives on this device, or “Compatible mode� if you’ll move the drive to an older Windows version. For internal drives, new mode is fine.
Run the encryption: Click “Start encrypting.� The process can take anywhere from minutes to hours depending on drive size and speed. You can keep using your computer, but it will be slower.
Verify encryption: Once done, the BitLocker status will show “On.� You can also check by looking for a lock icon on the drive in File Explorer.

Common Mistakes

Skipping the recovery key: Losing it means you could lose access to your data permanently if you forget your password.
Encrypting the wrong drive: Only encrypt drives with sensitive data; system drives are necessary, but external drives can be encrypted too.
Not checking TPM: If BitLocker won’t turn on, it’s often because TPM is disabled in BIOS. You must enable it before starting.
Interrupting encryption: Powering off or restarting during encryption can sometimes cause issues, though Windows usually resumes safely.

Tips

Use a strong password: Combine uppercase, lowercase, numbers, and symbols. Write it down and store it separately.
Back up your recovery key: Save it to a USB drive and also print a copy. Store them in different locations.
Encrypt external drives too: USB drives and external hard drives can be encrypted with BitLocker To Go. Right-click the drive in File Explorer and select “Turn on BitLocker.�
Consider performance impact: Encryption adds a small overhead, but modern CPUs handle it well. You likely won’t notice a difference.

Troubleshooting

BitLocker won’t turn on: This usually means TPM is disabled. Restart your PC, enter BIOS/UEFI (usually by pressing F2, F10, or Del during boot), find the Security or Trusted Computing section, and enable TPM. Save and exit, then try again.

You forgot your password: Use the recovery key. At the BitLocker recovery screen, press Esc, then enter the 48-digit recovery key. If you saved it to your Microsoft account, you can retrieve it online.

Drive is stuck encrypting: Sometimes the process appears stuck. Wait a few hours; if it doesn’t progress, restart your PC. Windows will resume encryption automatically.

“BitLocker is waiting for activation� This often happens after Windows updates. Open Manage BitLocker and click “Resume protection� or “Back up your recovery key.�

Device encryption missing on Windows Home: Device encryption is only available on certain hardware (Modern Standby, TPM 2.0, etc.). If it’s not there, you’ll need to upgrade to Windows Pro to use BitLocker.

Frequently Asked Questions

Does encryption slow down my PC? There’s a tiny performance hit, but on modern systems it’s usually unnoticeable for everyday tasks.

Can I decrypt my drive later? Yes. Open Manage BitLocker and click “Turn off BitLocker.� The drive will be decrypted, which takes time.

What happens if I lose my recovery key? If you also forget your password, your data is unrecoverable. Always keep a backup of the key.

Can I encrypt only a folder? BitLocker encrypts whole drives. For folders, use Encrypting File System (EFS) by right-clicking the folder > Properties > Advanced > Encrypt contents.

Is BitLocker the same as device encryption? Device encryption is a simplified version for Windows Home, automatically enabled on compatible devices. BitLocker offers more control.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →