How to Enable Encryption on Your Laptop

You want your data protected in case your laptop is lost or stolen, but the built-in options seem confusing. This guide gives you the exact steps to turn on full-disk encryption on Windows or Mac.

What you need before you start

Securing your laptop is fast, but only if you prepare the right tools first. The most common mistake is starting the process without a safe place to store your recovery key. If the drive fails later, that key is the only way to get your data back. If that sounds like your bench, read up on reset pc keep files next.

Gather these specific items before you open your computer settings. You do not need to buy anything new if you already have a USB stick and a cloud account.

• BitLocker Recovery Key Storage: A printout or a secure cloud account
• USB Flash Drive: Required only for the no-TPM workaround on older Windows
• External Backup Drive: To keep a copy of your files outside the encrypted system
• TPM Status Check: To see if your hardware supports the standard path

If you are planning to move data between machines or keep a physical backup, an external enclosure is useful. It lets you plug in your 2.5-inch SATA drive directly, making it easy to verify your backup files are accessible.

How to encrypt a Windows 10 or 11 laptop

For most Windows users, BitLocker is the built-in and safest tool. It uses a chip on your motherboard called a TPM to store keys securely, away from the main operating system. This makes it very hard for thieves to extract your data even if they remove the drive.

First, confirm your laptop has a Trusted Platform Module (TPM) chip. Most modern business laptops and recent consumer models have one. Press the Windows Key + R, type tpm.msc, and hit Enter.

If you see a message saying “Compatible TPM cannot be found,” do not panic. You will need to use the USB workaround detailed in the next section. If it works, you are ready for the standard path. Loaders in this spot often ask about deciding if your hinges need lube as well.

The standard TPM path

1. Open the Start Menu and type “Manage BitLocker”
2. Select your main drive (usually C:)
3. Click “Turn on BitLocker”
4. Choose “Use a BitLocker recovery password”
5. Save the recovery key to your Microsoft account or print it out
6. Click “Start BitLocker” to begin the process

Encryption runs in the background. You can keep working while your drive is secured. The process might take 20-60 minutes depending on your drive speed. Do not turn off the computer during this time.

The Windows workaround without a TPM

Older laptops or some consumer models lack a TPM chip. You can still use BitLocker, but it requires a password at startup and a USB drive for the recovery key. This is less convenient but still provides strong security.

Microsoft requires a specific policy change to allow this. Do not skip this step or the option will not appear in your settings. This method is often the reason users see the error “BitLocker cannot be enabled because additional configuration is required” when they try the standard path on older hardware.

1. Press Windows Key + R, type gpedit.msc, and hit Enter
2. Navigate to Computer Configuration > Administrative Templates > Windows Components
3. Find BitLocker Drive Encryption then Operating System Drives
4. Double-click “Require additional authentication at startup”
5. Select Enabled and check Allow BitLocker without a compatible TPM
6. Restart your computer

After the reboot, open “Manage BitLocker” again. You will now see the option to turn it on. You will need to insert a USB stick to start your PC with this method, so keep it with you when you travel.

How to enable FileVault on your Mac

Mac encryption is called FileVault and is managed through your System Settings. It is tightly integrated into macOS and uses the Secure Enclave chip on Apple Silicon Macs, or the T2 chip on Intel Macs, for key management. This makes it one of the most secure options available.

It is much simpler than the Windows path and is already built into every modern Mac. You do not need to check for specific chips or edit policy files. You just need to confirm your identity. Before you buy anything, it is worth looking at how encryption works in computers.

1. Open the Apple menu in the top-left corner
2. Select System Settings (or System Preferences on older macOS versions)
3. Go to Privacy & Security in the left sidebar
4. Click on the FileVault section
5. Click Turn on FileVault
6. Choose to use your iCloud account to unlock the disk or create a recovery key

The system will ask for your Apple ID password to verify your identity. Once confirmed, the encryption starts in the background. You can keep using your Mac while the process runs. It usually takes less time than on Windows because Apple optimizes it for their hardware.

Common mistakes and how to fix them

Even with a built-in tool, a few common errors can lock you out or slow your machine down. Here is what to watch for.

• Mistake: Losing the recovery key. What to do instead: Keep a printed copy in a safe and a digital copy in a password manager. If you lose both, your data is gone.
• Mistake: “BitLocker cannot be enabled.” What to do instead: Check your BIOS settings and ensure Secure Boot is turned on. This is a common requirement for TPM-based encryption.
• Mistake: Corrupted system files. What to do instead: Open an Admin Command Prompt and run sfc /scannow. This repairs the Windows image and often resolves BitLocker glitches.
• Mistake: Slow performance on old hard drives. What to do instead: If you are using a mechanical HDD, expect a slight slowdown. Modern SSDs have almost zero impact on daily use.

Encryption protects against physical theft, but it does not stop ransomware. Keep a physical backup drive encrypted as well to create a secure chain of data protection. This ensures you can recover your files even if your laptop is compromised digitally.

The bottom line

Frequently asked questions