Full-disk encryption makes the data on a computer’s drive unreadable without the right password or key. This guide shows how to turn it on with Windows Device Encryption or BitLocker, macOS FileVault and the Ubuntu installer, and how to keep the key that unlocks each one if the normal sign-in fails.

Before you start

  • Back up your data. Canonical’s tutorial warns that any encryption procedure on a drive that already holds data can lead to data loss.
  • Plan where the key will live. Microsoft says its support staff cannot retrieve, provide or recreate a lost BitLocker recovery key, and Apple and Canonical give similar warnings about their keys.

Windows: Device Encryption

According to Microsoft, Device Encryption turns on BitLocker automatically for the operating system drive and fixed drives, and it is available on more devices than full BitLocker, including those running Windows Home. When you first set up or sign in to a device with a Microsoft account or a work or school account, it is turned on and a recovery key is attached to that account. With a local account, it is not turned on automatically.

  1. Sign in to Windows with an administrator account.
  2. Open the Settings app, go to the privacy and security section and select Device encryption. Microsoft also gives the shortcut ms-settings:deviceencryption.
  3. Set the toggle to On.

Windows Pro, Enterprise or Education: BitLocker

  1. Sign in with an administrator account.
  2. From Start, type BitLocker and select Manage BitLocker, as Microsoft’s BitLocker page describes.
  3. Next to the operating system drive, select Turn on BitLocker.
  4. Select an unlock option and back up the recovery key.
  5. Let encryption run. Microsoft says it can take some time, but you can keep using the device.

On PCs managed by an employer, the IT department usually controls BitLocker because policies may require encryption.

macOS: FileVault

Apple says Macs with Apple silicon or an Apple T2 Security Chip encrypt data automatically, and FileVault adds a layer by requiring your login password before the data can be decrypted. On other Macs, FileVault must be on for the data to be encrypted at all. You need to be an administrator.

  1. Choose Apple menu > System Settings, click Privacy & Security in the sidebar, then click FileVault. You may need to scroll down.
  2. Turn on FileVault and enter your password if asked.
  3. Choose how to unlock the disk if you forget your password: Allow my iCloud account to unlock my disk, or Create a recovery key and do not use my iCloud account. If you take the key, copy it exactly and store it somewhere safe, away from the Mac.
  4. Click Continue. If an Enable Users button appears, enter each other user’s login password so they can unlock the disk.

Apple warns that if you forget both your login password and the recovery key, you will not be able to log in and your files and settings will be lost forever.

Ubuntu: encrypt at install time

Canonical’s Install Ubuntu Desktop tutorial, written for Ubuntu 24.04 LTS, ties encryption to the installer option that erases the whole disk.

  1. At the “Type of installation” step, select Erase disk and install Ubuntu.
  2. Before continuing, open Advanced features and select Encrypt the new Ubuntu installation for security, using LVM or ZFS based encryption.
  3. Create the security key when prompted. You will enter it at every boot, before logging in with your user account.
  4. Write the key down and keep it somewhere outside the computer. The tutorial warns you will not be able to recover your data without it.

The same screen offers encryption backed by the Trusted Platform Module (TPM), a security chip on the device. Canonical calls it highly experimental, says machines needing extra drivers for webcams or NVIDIA graphics cards are not yet supported, and advises choosing it only if you are comfortable debugging or reinstalling. With TPM encryption, the tutorial says to run snap recovery –show-keys after installation to generate a recovery key.

Common problems

  • Device encryption is missing from Settings. Microsoft says the device may not support it, or you may be signed in as a standard user. To check, type System Information in Start, run it as administrator and look for “Automatic Device Encryption Support” or “Device Encryption Support.” “TPM is not usable” means the chip is missing or disabled in the BIOS or UEFI; “WinRE is not configured” means the Windows Recovery Environment is not set up; “PCR7 binding is not supported” means Secure Boot is off or peripherals such as docking stations are connected during boot.
  • Manage BitLocker does not appear. Microsoft says that means the PC is not running a Windows edition that includes it.
  • Windows asks for a recovery key. Note the first eight digits of the recovery key ID, then on another device go to aka.ms/myrecoverykey (aka.ms/aadrecoverykey for work or school accounts) and find the key with the matching ID, as Microsoft’s recovery key page explains. Also check printouts and USB drives. If someone else set up the PC or turned on BitLocker, the key may be in their account. Without the key, the remaining option is a reset that removes all your files.
  • The Ubuntu installer cannot read a BitLocker drive. Canonical says the installer will prompt you to disable BitLocker in Windows first, which is not needed if you erase Windows entirely or install to a separate unencrypted drive. It notes that some versions of Windows will not let you re-enable BitLocker afterward.

Corrections and tips: email the editor using the address on the Contact page.