Encryption at Rest: Windows (VeraCrypt)

Part of the Encryption in Transit and At Rest series.

Encryption at Rest on Windows

Windows has a built-in full disk encryption tool called BitLocker. We do not recommend it here. If you want to understand why, the full explanation is in BitLocker and Microsoft Accounts: Why Your Encryption Keys Aren’t Really Yours.

The short version: when you enable BitLocker while signed into a Microsoft account, Windows automatically uploads your recovery key to Microsoft’s servers without asking. That key can decrypt your entire drive. Your encryption is only as private as Microsoft’s access controls.

VeraCrypt is the recommended alternative. It is free, open source and your keys never leave your machine.

A Note on VeraCrypt and the April 2026 Microsoft Incident

Before getting into setup, this is worth knowing. In April 2026, Microsoft suspended the developer accounts for VeraCrypt, WireGuard and Windscribe as part of a mandatory identity verification process for the Windows Hardware Program. Without those accounts, the developers could not sign their Windows kernel drivers, which means they could not ship updates for Windows.

The VeraCrypt developer warned that if the suspension had not been resolved, Secure Boot would have blocked VeraCrypt from encrypting system drives as of June 2026.

The accounts were restored by mid-April 2026. Full details are in Microsoft Locked Out VeraCrypt, WireGuard and Windscribe: What Happened and Why It Matters.

The takeaway: always run the latest signed release from the official site at veracrypt.jp. Verify the signature before installing. If you skipped updates during April 2026, update now.

Installing VeraCrypt on Windows

Download the installer from veracrypt.jp/en/Downloads.html. The page includes PGP signatures for verification.

Run the installer and choose either Install or Extract. Install is the standard choice. Extract lets you run VeraCrypt as a portable application without writing to the registry.

Creating an Encrypted Volume

Open VeraCrypt and click Create Volume.

Step 1: Volume type

Choose “Create an encrypted file container” for a portable volume stored as a single file. Choose “Encrypt a non-system partition/drive” for a full drive or partition.

Step 2: Volume size and location

Pick where to save the container file and how large to make it. The container takes up that space on your drive immediately. Size it for what you actually need.

Step 3: Encryption settings

AES with SHA-512 is the default. It is well-tested and fast on modern hardware. Leave these as-is unless you have a specific reason to change them.

Step 4: Passphrase

Use a strong passphrase, not a password. A phrase of four or more unrelated words is harder to crack than a short complex password. VeraCrypt also supports keyfiles as a second factor.

Step 5: Format

Move your mouse around the window to generate entropy, then click Format. The volume is created.

Mounting and Using a Volume

In the main VeraCrypt window, select a drive letter from the list
Click Select File and choose your container
Click Mount and enter your passphrase
The volume appears as a drive in File Explorer

Work with files normally. When finished, select the drive letter and click Dismount. The volume goes back to being an unreadable encrypted file.

Auto-dismount on screen lock: In Settings > Preferences, enable “Auto-dismount volume when: Screen saver is launched” and “User session is locked”. This closes the volume automatically when you step away.

Encrypting a Full Drive or Partition

For a non-system drive (a secondary internal drive or external drive), choose “Encrypt a non-system partition/drive” in the wizard. The process is the same as creating a container, but VeraCrypt encrypts the entire partition in place.

For the Windows system drive, VeraCrypt can do this too under “Encrypt the system partition or entire system drive”. This creates a VeraCrypt boot loader that asks for your passphrase before Windows loads, similar to how LUKS works on Linux.

Keeping VeraCrypt Updated

Check veracrypt.jp for the latest release. VeraCrypt does not have an auto-update mechanism on Windows. Make checking for updates part of your regular maintenance.

After the April 2026 incident, it is worth being aware that Windows kernel driver signing is a dependency for VeraCrypt on Windows. If you ever see a warning that a VeraCrypt driver is unsigned or blocked by Windows, do not dismiss it. Check the official site for current status.

References

Continue reading:

Questions about a specific setup or drive configuration? Post below.