Encrypted USB drives and storage explained

An encrypted USB drive scrambles everything stored on it, so the files can only be read after the right password or PIN is entered. If an ordinary USB stick is lost on a train, anyone who picks it up can open it. If an encrypted one is lost, the finder sees locked storage. This guide starts with the encryption already built into Windows and macOS, then explains when a hardware-encrypted drive adds something, what FIPS 140 validation means, and how four widely available drives compare on their makers’ published specifications.

Why encryption matters for portable storage

USB sticks and portable drives are small, easy to lose and often carry copies of exactly the files people care about: tax records, client lists, scanned IDs, backups. The ACSC’s guidance on disposing of devices securely warns: “If a cybercriminal gets access to your removable device, they could steal your information.”

For people who travel for work, the ACSC’s travelling with mobile devices guidance says to “Ensure all mobile devices and removable media being taken are encrypted.” The same page says removable media shouldn’t be used for transfers or backups until it has been scanned for malware. These points also come up for people working from home who move files between work and home computers.

Do you need an encrypted drive?

Often the drive you already own can be encrypted. If BitLocker To Go or Disk Utility is available on the computers that will open the drive, built-in software encryption may cover the basics. A dedicated hardware-encrypted drive adds something mainly when the drive has to work on computers without those tools, or when an employer, client or contract specifies a particular product or certification. Those requirements come from that organisation, not from the drive. A business working out what it needs can start with the first steps for small business cyber security.

Software encryption built into Windows and macOS

• BitLocker To Go (Windows). Microsoft describes BitLocker To Go as “BitLocker Drive Encryption on removable data drives”, covering USB flash drives, SD cards and external hard disk drives. Microsoft’s FAQ says drives “encrypted by BitLocker To Go can be opened by using a password or smart card on another computer”. Microsoft says BitLocker is available on Windows Pro, Enterprise and Education, and “isn’t available on Windows Home edition.”
• Disk Utility (Mac). A storage device can be formatted with an encrypted file system and protected with a password, which an external device then asks for each time it’s connected. Apple notes the device must be erased first.
• Encrypted disk images (Mac). Disk Utility can create an encrypted disk image: a single file that opens like a drive once the password is entered, and can be stored on any drive. Apple warns: “If you forget this password, you won’t be able to open the disk image and view any of the files.”
• FileVault (Mac) encrypts the Mac’s own startup disk rather than external storage. Our Mac security settings guide shows how to turn it on.

Software encryption is free and built in, but depends on the operating system on each computer that opens the drive.

How to encrypt a USB drive with BitLocker To Go

Based on Microsoft’s instructions (checked October 2026). Microsoft’s guide has the latest steps.

1. Open BitLocker Drive Encryption from Control Panel as an administrator. Removable drives are listed under Removable data drives - BitLocker To Go.
2. Select Turn on BitLocker next to the drive.
3. Choose an unlock option, such as a password, and back up the recovery key.
4. Wait for encryption to finish.

Microsoft’s FAQ says a removable drive’s recovery key can be saved to a folder, saved to a Microsoft account, or printed.

How to encrypt an external drive on a Mac

Based on Apple’s instructions (checked October 2026). Apple’s guide has the latest steps. Apple says erasing removes everything on the drive, so files are copied elsewhere first.

1. Open Disk Utility and choose View > Show All Devices.
2. Select the drive and click Erase.
3. Enter a name, set Scheme to GUID Partition Map, and choose an encrypted format from the Format menu.
4. Enter and confirm a password, then click Choose.
5. Click Erase, then Done.

When a hardware-encrypted drive adds something

Hardware encryption happens inside the drive itself. The drives compared below describe encryption done by the drive, with the PIN or password checked by the drive rather than by the computer. Apricorn, for example, says the Aegis Secure Key 3NX PIN is entered on the drive’s own keypad, and that the drive stays invisible to the host computer until it’s unlocked. Because the computer isn’t doing the encryption, makers describe these drives as working across operating systems: Apricorn describes “Software-Free Setup and Operation”, and Kingston says the Keypad 200 works with any system that supports a USB mass storage device.

How PIN keypad drives work

Keypad drives have number or letter buttons on the drive. The PIN is entered on the drive, and the computer only sees the storage once it’s unlocked. Some keypad drives have a battery so they can be unlocked before plugging in; Kingston describes this for the IronKey Keypad 200.

Most also have brute-force protection: after a set number of wrong PINs, the drive erases its encryption key and the data becomes unrecoverable. Kingston says the Keypad 200 crypto-erases after 10 consecutive incorrect Admin PIN entries. Apricorn says its drives let an admin set a limit of between 4 and 20 attempts. This protects against guessing, but a forgotten PIN can mean lost files, which is why an encrypted drive is usually not the only copy. Our guide to the 3-2-1 backup approach explains keeping more than one copy.

For a hardware-encrypted drive, the maker’s user guide sets out how to create the first PIN; these steps differ between products.

What to compare

• Encryption type. Hardware or software, and which standard the maker states.
• Validation. FIPS 140-3 or 140-2 level and certificate number, or FIPS 197 certification. These are different claims (explained below).
• How it unlocks. Keypad PIN, password typed on the computer, or both.
• Brute-force behaviour. How many attempts, and whether the drive locks or erases.
• Admin and recovery options. Whether an admin PIN can restore a forgotten user PIN.
• Read-only mode. Whether the drive can be set so files can be read but not changed.
• Compatibility. Operating systems the maker lists.
• Capacity, durability and warranty.

What FIPS 140 validation means

FIPS 140 is a US Government security standard for cryptographic modules, the part of a product that does the encryption. The US National Institute of Standards and Technology (NIST) describes its Cryptographic Module Validation Program (CMVP) as “a joint effort” between NIST and the Canadian Centre for Cyber Security.

According to NIST:

• modules are tested by independent laboratories, each “accredited by NVLAP”, and CMVP then reviews and validates each submission
• since 22 September 2020 the program has validated modules against FIPS 140-3, the current version
• CMVP stopped accepting new FIPS 140-2 submissions for new certificates from 1 April 2022
• NIST’s timeline says active FIPS 140-2 modules could be used for new systems until 21 September 2026, after which their certificates move to the Historical List and, according to NIST, can be used only for systems already in operation
• NIST publishes a searchable list of validated modules.

Products describe levels (such as Level 2 or Level 3), and makers’ pages state which level and certificate number applies; a certificate number can be looked up on NIST’s list. Validated under FIPS 140 is different from certified under FIPS 197. NIST describes FIPS 197, the Advanced Encryption Standard (AES), as specifying “a FIPS-approved cryptographic algorithm that can be used to protect electronic data”, with keys of 128, 192 and 256 bits. FIPS 140 validation covers the cryptographic module as a whole.

How the products compare

Based on makers’ published specifications, checked October 2026. Listed alphabetically, not ranked. Prices aren’t shown; the maker’s site has current details.

Detailed facts and considerations for each product appear in the summaries on this page.

Things to watch for

• Forgotten PINs and lost recovery keys. With brute-force erase, repeated wrong guesses can wipe the drive.
• Validated vs certified. “FIPS 140-3 validated” and “FIPS 197 certified” are different claims; certificate numbers can be checked on NIST’s list.
• Found or returned drives. The ACSC’s travel guidance says devices that were lost or stolen and later returned are to be treated as potentially compromised.
• Disposal. The ACSC says “cyber criminals can easily recover data that hasn’t been securely erased”, and that some removable media “may be difficult to wipe correctly”. Our guide to selling or recycling a device covers this.

Common questions

Do I need an encrypted USB drive?

Not always: a drive already owned can often be encrypted with tools built into the computer. BitLocker To Go (Windows Pro, Enterprise and Education) and Disk Utility (Mac) may cover the basics. A hardware-encrypted drive adds something mainly when the drive has to work on computers without those tools, or when an employer, client or contract specifies a product or certification. See Do you need an encrypted drive?

What is a hardware encrypted USB drive?

It’s a drive that does the encryption itself, with the PIN or password checked by the drive rather than by the computer. Apricorn, for example, says the Aegis Secure Key 3NX PIN is entered on the drive’s own keypad and the drive stays invisible to the host computer until unlocked. Because the computer isn’t doing the encryption, makers describe these drives as working across operating systems. See when a hardware-encrypted drive adds something.

Is hardware or software encryption better for a USB drive?

They suit different situations. Built-in software such as BitLocker To Go and Disk Utility is free, but depends on the operating system of each computer that opens the drive. Hardware-encrypted drives work across systems according to their makers, but are a separate purchase, and their “validated” and “certified” claims differ. The comparison table sets out what each maker states.

How do I encrypt a USB drive I already have?

On Windows Pro, Enterprise or Education, Microsoft describes BitLocker To Go: open BitLocker Drive Encryption, select Turn on BitLocker next to the drive, choose a password and back up the recovery key. Microsoft says BitLocker isn’t available on Windows Home. On a Mac, Disk Utility can erase the drive with an encrypted format, or create an encrypted disk image without erasing. See the Windows and Mac steps.

What does FIPS 140-3 mean?

It’s the current version of FIPS 140, a US Government security standard for cryptographic modules, the part of a product that does the encryption. NIST says independent accredited laboratories test modules, its Cryptographic Module Validation Program validates them, and it publishes a searchable list. FIPS 140 validation is a different claim from FIPS 197 certification, which covers the AES algorithm. See what FIPS 140 validation means.

What happens if I forget the PIN on an encrypted USB?

It depends on the drive, and a forgotten PIN can mean lost files. Kingston and Apricorn describe drives that erase their encryption key after a set number of wrong attempts, while an admin PIN, where set up, can restore a forgotten user PIN on some drives. For software encryption, Apple warns a forgotten disk image password means the files can’t be opened. That’s one reason an encrypted drive is usually not the only copy; see the 3-2-1 backup approach.

Where to get official help

• ASD’s ACSC: travelling with mobile devices
• ASD’s ACSC: how to dispose of your device securely
• Microsoft: BitLocker Drive Encryption
• Apple: encrypt a storage device with Disk Utility