How To Encrypt File On Windows 10

To encrypt files on Windows 10, use built-in options like EFS, BitLocker, or password-protected archives based on how and where you store data.

Windows 10 gives you more than one way to protect files, but the choices can feel confusing. Do you flip on device encryption, turn on BitLocker, use Encrypting File System, or just lock a folder with a password tool? Pick the wrong path and you might still expose data or, worse, lock yourself out.

This guide walks through how to encrypt a file on Windows 10 step by step, explains where each method works best, and points out the limits that many users only discover after losing data. By the end, you’ll know which method to use for personal files, shared work folders, laptops that leave the house, and backups that sit on a shelf.

Why Encrypt Files On Windows 10

Plain files on a Windows 10 PC are easy to copy if someone gets past your sign-in screen or steals the laptop. A simple password on the account slows attackers down a bit, but once they bypass that password, every unprotected file is exposed.

Encryption changes this by scrambling data so that only someone with the right key can read it. If a drive is removed from your computer and connected to another system, encrypted files stay unreadable junk without that key. Agencies such as the UK’s National Cyber Security Centre recommend disk encryption on laptops and removable media where there is a risk of physical theft, because it reduces the damage when a device goes missing.

For anyone handling customer details, HR records, or other personal data, encryption is more than a nice extra. Regulators treat it as one of the standard ways to keep stored data safe under modern data protection rules, and it often helps limit the fallout when a device is lost.

The good news: Windows 10 already includes strong encryption tools. The challenge is picking the right one for your setup and turning it on safely so you don’t lose files.

How To Encrypt Files On Windows 10 Safely

On Windows 10, “how to encrypt file” does not have a single answer. You have several built-in options, each aimed at a different situation:

Encrypting File System (EFS) — Encrypts specific files or folders tied to your Windows user account.
BitLocker Drive Encryption — Encrypts entire drives, including internal and external disks.
Device Encryption — A lighter version of BitLocker that some laptops enable automatically.
Application Encryption — Password protection inside apps (Office documents, third-party archive tools, and similar).

Before you pick a method, you need to know which Windows 10 edition you run, because not every option is available.

Check Your Windows 10 Edition

Open Settings — Press Windows + I on your keyboard.
Go To System Info — Select System, then scroll down and choose About.
Check Edition — Under Windows specifications, look at the line that shows Edition.

If you see Windows 10 Home, you don’t get EFS or full BitLocker on that device. You may still have device encryption on some hardware and you can still use application-level encryption, including password-protected Office files and archive tools. Windows 10 Pro, Enterprise, and Education unlock EFS and full BitLocker.

With that checked, you can choose the method that matches your risk, your edition, and how you use the files.

Method 1: Encrypt Individual Files And Folders With EFS

Encrypting File System (EFS) is built into Windows 10 Pro, Enterprise, and Education. It lets you encrypt a single file, a folder, or a whole tree of folders without touching the rest of the drive. That works well when you only want to protect specific work documents or a private folder on a shared computer.

When EFS Makes Sense

Shared PC, Single User Account — You use one account and only want to hide sensitive folders from anyone who gets past the sign-in screen.
Selective Protection — Only certain projects or client folders need extra protection while the rest of the drive stays unencrypted.
Low Overhead — You want encryption with minimal impact on performance and without managing full-disk keys.

EFS ties encrypted files to the Windows account and its encryption certificate. If someone signs in with a different account or moves the disk to another PC, those files stay unreadable. If you lose that certificate and key, the files are lost too, so backing up the key is a must.

Encrypt A Folder Or File With EFS

Open File Explorer — Press Windows + E and browse to the file or folder you want to protect.
Open Properties — Right-click the file or folder and choose Properties.
Open Advanced Attributes — On the General tab, select Advanced….
Turn On Encryption — Check Encrypt contents to secure data, then select OK.
Apply The Change — Select Apply. If you’re encrypting a folder, choose whether to apply the change to that folder only or to the folder, subfolders, and files.

When you encrypt a folder, Windows marks it with a small padlock icon in File Explorer. Files created inside that folder later inherit the encryption setting, so you don’t have to repeat the process each time.

Back Up Your EFS Encryption Key

After you encrypt something for the first time, Windows may prompt you to back up your encryption certificate and key. Don’t skip this step. Losing the key means losing access to every file encrypted with EFS.

Start Key Backup — When prompted, choose the option to back up your file encryption certificate and key.
Create A Password — Set a strong password for the exported certificate file.
Choose A Safe Location — Save the file to an external drive, a secure USB stick, or another safe location that is not always connected.

Store the export password somewhere safe and separate from the device. You only need this file if the PC fails or you move your user profile to another system.

Limits Of EFS On Windows 10

Tied To Your Account — Other user accounts on the same PC cannot open those files unless you add them explicitly as authorized users.
Edition Requirements — File encryption with EFS is not available on Windows 10 Home, so you need Pro, Enterprise, or Education.
Local Threats Only — EFS protects data when someone accesses the drive directly, but it doesn’t replace good access control if files sync to cloud services.

If these limits bother you or you move devices around often, a full-disk approach like BitLocker might be a better fit.

Method 2: Encrypt A Whole Drive With BitLocker

BitLocker encrypts an entire drive: the operating system drive, extra internal drives, and supported external drives. Once a drive is encrypted, everything stored on it is protected at rest. Without the recovery key or unlock method you set, the raw data on that drive is unreadable.

When BitLocker Fits Best

Laptops That Travel — You carry the device to work, school, or on trips and want protection if it gets lost or stolen.
Shared Drives — You keep a lot of mixed files on one drive and don’t want to decide which ones to encrypt individually.
External Drives — You use portable drives for backups or archives and need them locked if they’re misplaced.

On many modern systems with Windows 10 Pro or higher, BitLocker is available through the Control Panel. Some devices ship with device encryption auto-enabled, which is a variant of BitLocker with fewer options.

Turn On BitLocker On A Data Drive

Before turning on BitLocker, make sure you’re signed in with an administrator account and that you can write down or print the recovery key.

Open BitLocker Settings — Open the Control Panel, choose System and Security, then select BitLocker Drive Encryption.
Pick A Drive — Find the drive you want to protect and select Turn on BitLocker.
Choose Unlock Method — Decide how you’ll unlock the drive, such as a password or a smart card, and set it up.
Back Up Recovery Key — Save the recovery key to your Microsoft account, a file, a USB drive, or print it. Use more than one location if possible.
Pick Encryption Scope — Choose whether to encrypt used disk space only or the entire drive. Full drive encryption offers wider coverage but takes longer.
Start Encryption — Confirm your choices and let Windows encrypt the drive in the background. You can still use the PC while this runs.

The first run can take a while on large drives. You can monitor progress from the BitLocker window. When the process ends, the status shows that the drive is encrypted.

BitLocker On The System Drive

Encrypting the main system drive uses nearly the same steps but may prompt you to run a hardware check and restart. Many laptops also store the recovery key in your Microsoft account automatically. You can usually view those keys in your account’s device page in a web browser.

Before you encrypt the system drive, take these safety steps:

Confirm Backup — Make sure you have at least one recent backup of irreplaceable files on a separate drive or cloud storage.
Print Or Save Keys — Store the recovery key in at least one offline place, such as a printed copy or a USB stick kept in a safe drawer.
Test Restart — After enabling BitLocker, restart once and confirm that Windows boots without asking for a recovery key.

Common BitLocker Pitfalls

Losing Recovery Keys — If you misplace every copy of a recovery key and the device later demands it, the encrypted drive contents are usually lost.
Surprise Prompts — Firmware updates, motherboard swaps, or certain Windows updates can sometimes trigger a BitLocker recovery screen. This is why printed or offline keys matter.
Performance On Old Hardware — On some older devices without hardware acceleration, full-disk encryption can slow disk-heavy tasks. In those cases, EFS or application-level encryption on a smaller set of files might be a better match.

If you treat the recovery key like any other secret and store it safely, BitLocker gives strong protection for lost or stolen devices with minimal day-to-day effort.

Method 3: Encrypt Files With Apps And Password-Protected Archives

Even when you can’t use EFS or BitLocker, you still have options. Two common ones are built into everyday tools: Office applications with document encryption and third-party archive software that creates password-protected ZIP or 7z files.

Encrypt Office Documents On Windows 10

Word, Excel, and PowerPoint include a simple way to encrypt documents with a password. It works the same on Windows 10 as on later versions.

Open The Document — Start Word, Excel, or PowerPoint and open the file you want to protect.
Open The Info Screen — Select File in the top-left corner, then choose Info.
Choose Protect Option — Select Protect Document, Protect Workbook, or Protect Presentation, then pick Encrypt with Password.
Set A Strong Password — Enter a long, unique password and select OK, then confirm it.
Save The File — Save the document to apply encryption.

Next time you open that file, Office prompts for the password before loading any content. There is no built-in way to recover that password, so don’t rely on memory alone.

Use Password-Protected Archives

Windows 10 can compress files into ZIP archives, but its built-in ZIP feature doesn’t add strong password-based encryption. To encrypt a ZIP or 7z archive, you need a third-party tool such as 7-Zip, WinRAR, or a similar program installed on the PC.

Most archive tools follow a similar pattern:

Select Files — Choose the files and folders you want to compress.
Create Archive — Right-click and choose the archive tool’s add-to-archive option.
Set Encryption — In the archive settings, enter a password and pick an encryption method such as AES-256.
Confirm And Save — Create the archive and delete any original unencrypted copies if you no longer need them.

Password-protected archives are handy when you need to move a small bundle of sensitive files between systems, send them by email, or store them on cloud services that you don’t fully trust.

Choosing The Right Windows 10 Encryption Method

There’s no single best way to encrypt files on Windows 10. The right choice depends on what you’re protecting and how you use the machine. This quick table sums up the main options.

Method	Protects	Best For
EFS	Selected files and folders	Specific work folders on one Windows account
BitLocker	Entire internal or external drives	Laptops, system drives, backup drives
Device Encryption	Whole device on supported hardware	Home laptops where full BitLocker isn’t exposed
Office Encryption	Individual Office documents	Single reports or spreadsheets you share or email
Encrypted Archives	Groups of files inside a ZIP or 7z	Sending or storing bundles of files on other systems

Quick Ways To Decide

Protect Everything On A Laptop — Turn on BitLocker (or device encryption if that’s the only option) for the system drive.
Protect A Few Sensitive Folders — Use EFS if you run Windows 10 Pro or a higher edition.
Protect Files You Email Or Upload — Use Office encryption or encrypted archives so the files stay locked even off the original machine.
Protect Backup Drives — Enable BitLocker on external drives and store the recovery key away from them.

Many users mix methods: full-disk encryption on the laptop, EFS on the most sensitive folders, and encrypted archives when sharing files across networks or to cloud storage. That way, a single mistake or lost drive doesn’t expose everything.

Best Practices For Keys, Passwords, And Compliance

Encryption only helps if you keep control of the keys and passwords that unlock it. Misplacing those keys can turn strong protection into permanent data loss. On the other hand, leaving keys in plain text or using weak passwords defeats the point of encrypting files in the first place.

Build Safer Habits Around Keys And Passwords

Use Long, Unique Passwords — For BitLocker, archives, and Office documents, create passwords with a mix of words, numbers, and symbols rather than short, simple strings.
Store Keys Separately — Keep printed BitLocker keys and EFS certificate backups away from the device they protect, such as in a locked drawer.
Use A Password Manager — Save encryption-related passwords in a reputable password manager instead of in a text file or notebook that sits next to the laptop.
Limit Who Has Keys — Only give access to people who truly need it, and record who holds which recovery keys for shared machines.

Stay Ready For Lost Devices Or Windows Issues

No one expects to lose a laptop or run into a failed Windows update, but those events happen. A little planning makes them far less stressful.

Test Recovery Once — For BitLocker, confirm that you can sign in to your Microsoft account and see the recovery key, or that your printed copy is readable.
Keep Backups Unlocked But Protected — Backups that stay encrypted and unusable help no one. Use encrypted drives or secure cloud storage, and make sure you can restore files quickly when needed.
Document Your Setup — Write a short note describing which devices use EFS, BitLocker, or other methods and where the keys live. Store that note securely.

Think About Legal And Policy Duties

If you handle client data or staff records, encryption is not only about avoiding embarrassment. Regulators treat it as one of several technical measures that show you took reasonable steps to protect personal data. In many cases, encrypted data lost on a stolen device leads to less severe consequences than unencrypted data.

To stay aligned with those expectations, match your method to the sensitivity of the data, train anyone who uses encrypted devices, and keep written procedures for how keys are created, stored, and revoked when staff leave.

Putting It All Together On Your Own PC

If you’ve reached this point still wondering how to encrypt file on Windows 10 for your exact setup, a short checklist can help.

Step 1: Check Your Edition — Confirm whether you run Windows 10 Home or Pro (or higher) so you know which built-in tools you can use.
Step 2: Decide What Needs Protection — List the folders, drives, and file types that would cause problems if someone copied them.
Step 3: Pick A Primary Method — Choose BitLocker or device encryption for whole-disk protection, or EFS for selective folders.
Step 4: Add App-Level Protection — Enable encryption in Office and use encrypted archives for files that move between systems.
Step 5: Create And Store Keys Safely — Export EFS certificates, store BitLocker keys offline, and record passwords in a password manager.
Step 6: Review Once A Year — Revisit which devices and drives are encrypted and whether any old keys or copies need to be updated or destroyed.

Handled this way, file encryption on Windows 10 becomes part of your normal setup rather than a one-time task. You gain protection against stolen hardware, casual snooping, and mistakes that would otherwise turn into serious data leaks, all while keeping access smooth in day-to-day use.