How to encrypt a USB drive with AES-256: a simple guide for Windows and Mac

Key figures

Why an unencrypted USB drive is a risk

USB flash drives are small, cheap and easy to lose: in a taxi, at a hotel desk, in a jacket at the dry cleaner's. Whoever finds one only has to plug it in to read everything on it. For most people that means ID scans, payslips, contracts, tax returns or family photos; for professionals it can mean client data, which in many countries brings legal obligations if it leaks.

Encryption solves that problem. An encrypted drive looks like random data to anyone who does not have the password. If you lose it, you lose the hardware, not your privacy.

AES-256 explained without jargon

AES (Advanced Encryption Standard) is the algorithm that protects most of the digital world today: Wi-Fi networks, HTTPS websites, smartphones, banking apps and disk encryption. It was selected after an open international competition and published by the US National Institute of Standards and Technology (NIST) as FIPS 197 in 2001.

The number after AES is the key length: 128, 192 or 256 bits. A 256-bit key can take 2^256 values, a number with 78 digits. Trying them all is impossible with any computer that exists, even assuming billions of guesses per second for billions of years.

That is why AES-256 is often called "military-grade" encryption: the US Committee on National Security Systems approved AES with 192- or 256-bit keys to protect TOP SECRET information (CNSS Policy No. 15). The phrase is marketing, but the fact behind it is real.

The catch: nobody attacks AES itself. Attackers guess the password that unlocks the key. A drive "protected by AES-256" with the password "12345678" is not protected. Good encryption software slows down password guessing on purpose (it runs the password through a key-derivation function thousands of times), but a long, unique password remains your real shield.

Five ways to encrypt a USB drive

1. BitLocker To Go (Windows)

BitLocker To Go is built into Windows 11 and Windows 10 Pro, Enterprise and Education. Windows Home cannot turn it on, but it can usually unlock a drive encrypted on a Pro PC if you know the password.

• 1. Back up the files on the drive first.
• 2. In File Explorer, right-click the USB drive and choose Turn on BitLocker (under "Show more options" on Windows 11 if needed).
• 3. Choose Use a password, and type a long passphrase twice.
• 4. Save the 48-digit recovery key to your Microsoft account, print it or store it on another device, never on the drive itself.
• 5. Choose Encrypt entire drive, then the compatible mode if the drive will be used on older Windows versions.
• 6. Wait until encryption finishes before unplugging the drive.

Expert tip: by default, Windows encrypts removable drives with 128-bit AES. Administrators of Pro PCs can require 256-bit keys in the Local Group Policy Editor (BitLocker Drive Encryption, "Choose drive encryption method and cipher strength") before encrypting the drive.

2. Encrypted APFS (Mac)

On a Mac, you can format a drive as APFS (Encrypted) in Disk Utility, or right-click it in Finder and choose Encrypt. You choose a password and a hint; the drive then asks for the password whenever it is connected.

Two limits: an encrypted APFS drive is readable only by Macs, and formatting erases the drive, so back it up first. Apple also warns that encrypted Mac OS Extended (HFS+) volumes will not work with macOS 28 or later; if you have an old encrypted drive in that format, convert it to encrypted APFS or decrypt it before upgrading.

3. VeraCrypt (Windows, Mac and Linux)

VeraCrypt is a free, open-source successor to TrueCrypt. It can encrypt a whole USB drive, or create an encrypted "container" file that you open like a virtual disk. It supports AES-256 and other algorithms, and works on Windows, macOS and Linux, which makes it the best choice if you move between systems.

The limit: VeraCrypt must be installed on the computer, and its documentation states that portable mode also needs administrator privileges. It is ideal for your own computers, less so for a hotel business center or a locked-down office PC.

4. An encrypted 7-Zip archive

If you only need to protect a few files, the free tool 7-Zip can create a .7z archive with AES-256 encryption. Tick "Encrypt file names" so that nobody can even see what the archive contains. It is a quick solution for sending documents, but not a way to work comfortably on a whole drive: you must extract files to edit them, which leaves unencrypted copies on the computer.

5. A hardware-encrypted drive with a keypad

Keypad drives encrypt data inside the stick itself and unlock with a PIN typed on the drive, so they work without software on Windows, Mac, Linux, Chromebooks and even some TVs or printers. For example, Kingston's IronKey Keypad 200 uses XTS-AES 256-bit hardware encryption, locks after ten wrong user PINs and crypto-erases itself after ten wrong admin PINs.

They cost several times more than a basic stick, but they are the simplest option for professionals who handle sensitive data or who cannot install software on the computers they use. For regulated data, look for FIPS 140-2 or FIPS 140-3 validation.

Good habits that make encryption work

• Use a passphrase, not a password: four or five unrelated words, at least 15 characters, used nowhere else.
• Store the recovery key separately: in a password manager, on paper at home, or in your Microsoft account for BitLocker. Without it, a forgotten password means losing your files.
• Keep a backup elsewhere. Encryption protects privacy, not the data itself: a broken or lost drive is still lost.
• Eject the drive properly before unplugging it, especially during encryption.
• Unlock only on trusted computers. Once a drive is unlocked, malware on that computer can read it.
• Update your system and use antivirus software, especially if you plug the drive into many PCs.
• Encrypt the whole drive, not just one folder, if it travels with you.

Mistakes that make encryption useless

• 1. Writing the password on a label stuck to the drive, or keeping it in a text file on the same drive.
• 2. Storing the BitLocker recovery key on the encrypted drive.
• 3. Copying files from the encrypted drive to the desktop of a shared computer and forgetting them there.
• 4. Choosing a short or reused password: attackers try leaked passwords first.
• 5. Assuming a "secure" drive bought online is encrypted: check that the encryption is enabled and, for professional use, that the model is certified.

Frequently asked questions

Can AES-256 be cracked? Not by trying all keys. Practical attacks target weak passwords, malware on the computer or a recovery key stored in the wrong place.

Is AES-256 better than AES-128? Both are considered secure today. AES-256 gives a larger safety margin, including against future quantum computers, which is why it is recommended for long-term secrets.

Can I open my encrypted drive on someone else's computer? With BitLocker on most Windows PCs, yes. With encrypted APFS, only on a Mac. With VeraCrypt, only if it is installed and you have administrator rights. With a keypad drive, on almost any device.

Does encryption slow down the drive? Slightly with software encryption on old computers; modern processors include AES acceleration, so the difference is usually small.

What happens if I forget the password? Without the recovery key, the data is lost. That is the price of real security.

Verdict

AES-256 is not the weak link: used correctly, it keeps a lost USB drive unreadable. The right method depends on your computers. BitLocker To Go is the obvious choice for Windows Pro users, encrypted APFS for Mac-only users, VeraCrypt for people who switch between systems, and a hardware keypad drive for professionals who need protection without software. Whatever you choose, the essentials are the same: a long passphrase, a recovery key stored somewhere safe and a backup. For more everyday security advice, read our guide to password managers.

This guide is based on official documentation from NIST, Microsoft-focused guides, Apple, VeraCrypt and Kingston, cited in our sources. RealDigitalTech does not sell any of the products mentioned.