How to password-protect folders and files on Windows 10 and 11

If you’ve arrived here, you’re probably interested in password protection and encryption — putting you a big step ahead of everyone else who isn’t fussed about the security of their confidential documents and files. Read on to learn how and which tools you need to password-protect and encrypt entire hard drives as well as individual folders and files. We’ll also show you how to create strong passwords for your encrypted files and folders, and store them securely — something that’s a breeze to do by getting Avira Password Manager.

There are a range of ways to password-protect hard drives, folders, or individual files from unauthorized access on Windows 10 or 11. But first, let’s take a brief detour to give an overview of the terms “password protection” and “password encryption” as they’re sometimes used inconsistently (we’ll go into greater details on those points at the end of this article).

Whereas simple password protection is basically just a lock that stops someone from opening a file through the user interface, file encryption goes a step further by using cryptographic techniques to turn the file’s contents into unreadable data. This data can only be decrypted with the appropriate key, which is either protected by a password or derived from one. That’s why the terms password protection or password encryption are often used in this context. 

In some cases, though, the key can also be protected and released by hardware chips (such as the TPM (Trusted Platform Module) in computers), biometric features (such as fingerprint or facial recognition), or physical security keys (such as USB tokens). Sometimes, the terms password protection and password encryption are also used to cover the protection or encryption of passwords themselves, such as through the use of a password manager.

Whether using built-in Windows tools, Office document encryption, or third-party tools — you’ll now learn about the various ways you can password-protect and encrypt drives, folders, and individual files or otherwise protect them from unauthorized access. 

Use built-in Windows tools

There are two ways to encrypt folders and files for free using Windows’ own tools: The Encrypting File System (EFS) and BitLocker drive encryption. Encryption is user-account or device based, meaning the protected files can only be encrypted and decrypted with a specific user account or only on the original system. These tools are also only available in the Pro, Enterprise, and Education versions of Windows 10 and 11, but not in Windows Home. That said, Windows Home does come with Device Encryption: A consumer-friendly version of BitLocker, which is turned on automatically after you log in with your Microsoft account.

Alternatively, you can also use NTFS file permissions in Windows to control who can access a file or folder and what they can do with it. However, this has nothing to do with password protection or password encryption.

File and folder encryption with EFS 

Windows provides an account-based encryption feature for individual folders and files — including ZIP files — directly in the file system. Known as the Encrypting File System (EFS), it uses AES-256 encryption, which is considered the industry standard for high security. Nevertheless, EFS is often viewed as an additional layer of protection rather than an unbreakable barrier, since security depends primarily on the strength of the local user account password.

This is because EFS generates a user-specific asymmetric key pair that is stored in a digital certificate. The private key is secured by the Windows user account and is released automatically when you log in, so no separate password is required to encrypt files. You only need to set an additional password if you export the certificate and your private key — such as if you want to back up your data or migrate your system. As such, you should definitely create a backup of your certificate and store it someplace safe.

When you’re logged in to your local user account, the operating system automatically decrypts your files and folders so you don’t need to do anything else. Other users of your PC won’t be able to access the encrypted files and folders without access to your user account — meaning they won’t be able to open, copy, or move them. 

Here’s how to encrypt a file or folder using EFS in Windows Pro, Enterprise, or Education: 

1. Select the folder or file you want to encrypt.
2. Right-click it and select Properties. 
3. On the General tab, click the Advanced… button on the bottom right.
4. Select the checkbox next to Encrypt contents to secure data and then click OK to close the Advanced Attributes window.
5. Now click Apply.
6. You’ll now be asked whether you want to encrypt only the file or also the parent folder, or only the folder or all the files and subfolders it contains. Make your selection and confirm by clicking OK. Now whenever you place new files in an encrypted folder, they’ll be encrypted automatically.  
7. As a final step, you’ll have the option to back up your certificate and key to removable media. If you choose to create a backup, click Next twice in a row, set a password, and then re-enter the password to confirm it. Next, choose a location to store your back up and follow the remaining instructions to complete the export process. 

Drive and device encryption with BitLocker

Instead of just encrypting individual files or folders, you can encrypt an entire hard drive manually with BitLocker Drive Encryption if your device has Windows Pro, Enterprise, or Education. If you want to encrypt a data drive, you’ll need to set a password or use a smartcard.

If you have Windows Home, you’ll instead find Device Encryption. This is based on BitLocker, but offers fewer options — you can’t select individual drives or set a separate password. It’s usually activated automatically when you first sign in with a Microsoft account, encrypting the operating system drive and any internal drives. When you start your system, the TPM chip automatically releases the key, provided no hardware tampering is detected. If no Microsoft account has been added, Device Encryption won’t be enabled. To enjoy automatic device encryption on Windows 10 Home, your device must have a TPM chip (version 1.2 or higher), UEFI firmware, and Secure Boot. By contrast, Windows 11 requires TPM 2.0.

Here’s how to manually encrypt a drive on Windows Pro, Enterprise, or Education:

1. Open Explorer.
2. Right-click the drive name and select Turn on BitLocker. 
3. For data drives: You’ll be prompted to set a password or use a smartcard. If necessary, turn on the option Automatically unlock this drive on this computer.

For operating system drives: By default, Windows uses the integrated TPM chip to enable automatic unlocking. 

1. Now choose where you want to save the recovery key: “Save to your Microsoft account” (recommended), “Save to a file” (on an external hard drive or USB stick), or “Print the recovery key” and then click Next.
2. Choose how much of your drive to encrypt: “Encrypt used disk space only” (faster) or “Encrypt entire drive” (slower). 
3. Now choose the encryption mode: Select “New encryption mode” (XTS-AES, recommended for internal drives) or “Compatible mode” (AES-CBC, recommended for external drives) and then click Next.
4. Now click Start encrypting. Your drive will now be encrypted. This might take a while, but you can continue to use your device.

Important: You’ll need your BitLocker recovery key if you’ve forgotten your password or if the TPM chip denies access. The key consists of a 48-digit number which you can use to regain access to the drive. Since Microsoft support cannot retrieve, provide, or recreate a lost recovery key, it’s essential you keep the key safe. When device encryption is turned on, the recovery key is stored automatically in your Microsoft account in the cloud.

Expert tip: You can encrypt individual folders and files using BitLocker on Windows Pro, Enterprise, and Education. To do that, create a virtual drive (VHD/VHDX), encrypt it with BitLocker, and place the desired files or folders into it.

Control access using NTFS permissions 

With NTFS permissions, you can control who can access, read, edit, and delete specific documents and folders, even without password protection or encryption. This is really useful when multiple users share the same system or drive and certain files or folders should only be accessible to selected people. It’s important to note, though, that no encryption takes place.

1. Right-click a file or folder and select Properties. 
2. Go to the Security tab and click the Edit button. You’ll now see a list of users and groups who have access. 
3. In the Permissions dialog, add the relevant users or groups who should have access.
4. Set the permissions (“Full control”, “Modify”, “Read & execute”, “List folder contents”, “Read”, “Write”, “Special permissions”) for the users or groups.
5. Click OK twice in a row to close the dialog.

Password-protect individual files

Thanks to Office document encryption, you can encrypt Word, PowerPoint, and Excel files and password-protect them from unauthorized access. Current Office versions use the AES-256 standard, as used by banks and VPN providers. 

You can also encrypt and password-protect PDF and ZIP files, although you’ll usually need third-party software to do that. 

The advantage of this type of encryption is that it’s not tied to a device or account. Instead, the file itself is encrypted, regardless of where it’s stored.

Read on to learn how to turn on password protection for Excel, Word, PowerPoint, PDF, and ZIP files. But always bear in mind that if you ever forget your password, it can’t be recovered. 

Password-protect Excel files

The following steps will guide you through using Excel’s built-in encryption feature to protect an Excel file containing confidential information.  

1. Open the Excel file. Click File and select Info. 
2. Click Protect Workbook. Choose Encrypt with Password. 
3. Set a password and click OK.  
4. Confirm your password and click OK again. 
5. Save the Excel file.

Password-protect Word documents

Microsoft Word also includes a document encryption tool that’s quick and easy to use.  

1. Open the Word document. Click File and select Info. 
2. Click Protect Document. Choose Encrypt with Password. 
3. Set a password and click OK.  
4. Confirm your password and click OK again. 
5. Save the Word document.

Password-protect PowerPoint files

It’s also quick and easy to encrypt and password-protect PowerPoint files.

1. Open the PowerPoint file. Click File and select Info. 
2. Click Protect Presentation and select Encrypt with Password. 
3. Set a password and click OK.  
4. Confirm your password and click OK again. 
5. Save the PowerPoint file.

Password-protect PDF files

To encrypt a PDF file and password-protect it, you’ll need PDF editing software that supports this function. The good news is that there are some free tools like PDFgear or PDF24 Creator that allow you to do this on your device. If you use Adobe Acrobat, however, you’ll need a paid Pro subscription to password-encrypt PDFs on your device. Alternatively, you can go to Adobe’s website and encrypt PDF files for free there — provided, of course, that you don’t mind uploading confidential PDF files to a third-party server.  

Here’s how to password-protect a PDF file in Adobe Acrobat Pro:

1. Open the PDF file and go to All tools. Then click Protect a PDF. 
2. In the left-hand panel, select Protect with password. 
3. Now choose whether you require the user to enter a password to either view or edit the file. 
4. Enter your password, re-type it, and click Apply. In current versions, the file will then be encrypted using AES-256 by default. 

Password-protect ZIP files

You’ll need third-party file-archiving software, such as 7-Zip or WinRAR, to encrypt and password-protect ZIP files. These apps derive the key from the password you enter using what’s known as a key derivation function (or KDF for short).

To compress and encrypt a file using 7-Zip, follow these steps:

1. Download the latest version of 7-Zip for free and install the program.
2. Right-click a file or folder and select Show more options from the context menu (Windows 11 only), choose 7-Zip, and then select the option Add to archive….
3. In the Encryption section of the dialog, set a password, re-enter it to confirm your password, and choose whether you also want the file name to be encrypted. We recommend selecting AES-256 as the encryption method.
4. Click OK. Unless you select a different location, your newly encrypted archive will be saved in the same folder as the original file or folder. If necessary, delete any originals so no one can access them.

If you want to extract the file or folder again, first right-click the archive, select 7-Zip, then Extract files…. Choose where you want to extract the file or folder, enter the password, and click OK.

Save files to your OneDrive Personal Vault

You can also store confidential files in your Personal Vault in the Microsoft OneDrive cloud. Files stored there — like all other files in the cloud — are encrypted using the AES-256 standard, but you need to re-enter your credentials to access them. For added security, you can also encrypt the files individually and password-protect them prior to uploading. 

1. Log in to your Microsoft account at onedrive.com.
2. Click the folder called Personal Vault and turn it on, if you haven’t done so already.
3. Authenticate yourself via PIN, SMS code, fingerprint, or facial recognition (depending on your device options and the chosen identity verification method) to open the vault.
4. Move the desired OneDrive files into the vault or add files via drag and drop.

Use third-party password protection and encryption tools

Cybercriminals are getting ever more creative at hijacking devices and online accounts. Even the best antivirus protection cannot always prevent a hacker from gaining access to a system and sensitive data. Unlike built-in system solutions that are tied to your Windows user account (EFS) or computer (BitLocker), third-party encryption tools add an independent layer of security. This means that attackers won’t be able to access your encrypted data even if they gain access to your Windows account.

Tools like 7-Zip and VeraCrypt use very computationally intensive KDFs, where each attempt to guess a password takes much longer. This slows down brute-force attacks significantly. In comparison, built-in Windows tools like EFS use significantly fewer key derivation iterations, which can make password-based attacks easier.

Hard drive encryption with password protection

VeraCrypt is an open-source tool that can encrypt volumes, such as encrypted containers, partitions, hard drives, SSDs, USB sticks, or SD cards. The free program uses strong algorithms such as AES, Serpent, or Twofish, making it a good alternative to BitLocker for drive encryption. You can store confidential files and folders in an encrypted file container which you can save on any drive or in the cloud. Once you open the container using your password, it will appear as a virtual drive on your computer. 

VeraCrypt also offers the option to hide data using hidden containers that are created within an encrypted drive or container. These containers remain invisible until the correct password is entered.

Container-based encryption with password protection

With programs like Folder Lock, you can password-protect and encrypt files and folders so only authorized users can access them. Similar to VeraCrypt, encrypted containers — called “lockers” — are created for this purpose. You can then simply drag files and folders into the locker. 

Folder Lock also uses the leading encryption algorithm AES-256 and additionally offers features for locking and hiding folders as well as a file shredder function. Folder Lock also allows you to back up and synchronize encrypted files via cloud services such as Dropbox, Google Drive, or OneDrive.

Password protection without encryption

Tools like My Lockbox allow you to lock folders with a password and hide them on your computer. However, they don’t offer encryption; rather, they prevent other users from seeing and opening your password-protected content. Such tools are really useful if several people use the same system and certain files or folders should remain private. However, due to the lack of encryption, they don’t offer a high level of protection. 

File-based encryption with password protection

Apps like Cryptomator and AxCrypt allow you to password-protect and encrypt individual files or entire folders at file level, unlike container-based tools. Both solutions also use the AES-256 encryption standard.

The open-source software Cryptomator was designed specifically for use with cloud services, offering file-based encryption where each file is protected individually. This makes syncing files with cloud providers such as Dropbox, Google Drive, or OneDrive efficient as when changes are made to a file, only that changed file needs to be re-synced — not the entire vault.

Cryptomator creates what’s known as a virtual vault, which is protected with a master password. Unlike a container, which consists of a single large file, each file stored in this vault remains an individually encrypted element. The files in the vault remain protected from unauthorized access, even if the cloud provider were to be compromised.

AxCrypt can also encrypt individual files, and integrates into the right-click menu of Windows. Each file is encrypted directly in its storage location and can be opened by entering a master password. This password unlocks all encrypted files — saving you from having a separate password for each file.

How do password protection and encryption work? 

Both password protection and encryption of files and folders serve the same purpose: To protect your privacy and sensitive data. Whereas password protection only restricts access to the data without fundamentally changing it, encryption uses an algorithm to transform the data into an unreadable form. That means it’s protected even if it’s accessed by technical means. 

If someone wants to open the file, they need the password to release or derive the decryption key, which is then used to convert the data back into a readable form. Encryption is considered significantly more secure than password protection alone since nobody can decipher an encrypted file, even if the protection is bypassed and access is forced.

Tools like 7-Zip and Folder Lock use direct password-based encryption (PBE) and convert the password into a cryptographic key that encrypts the archives or containers. Volume-based tools (BitLocker, VeraCrypt) use a randomly generated master key that encrypts the volume key, which in turn encrypts the data. The master key is protected by a password or the TPM chip. 

By contrast, file-based tools encrypt the file encryption keys (FEKs) with a key encryption key (KEK) derived from the password (AxCrypt, Microsoft Office, and Adobe Acrobat Pro). In the case of Cryptomator, the KEK encrypts a randomly generated master key, which in turn encrypts the FEKs. With EFS, the FEKs are encrypted directly with the public key of the user certificate and decrypted with the private key. This means, an asymmetric method is used here.

File versus disk encryption

As you’ve seen, there are different encryption tools and techniques for different security needs and use cases. Both file and hard drive encryption convert understandable data into an encrypted, unreadable form (what’s called a ciphertext). As the name suggests, file-based encryption encrypts individual files and folders, while disk encryption makes the entire hard drive or individual volumes/partitions unreadable. Let’s take a look at the pros and cons of each method.  

Hard drive encryption is very convenient as you only need a single password for the entire system. However, this poses a risk. If someone gains access to this password, all your data is unprotected. On top of that, you won’t be able to recover your data if you forget or lose your password — unless the tool you use offers a recovery key and you’ve backed it up beforehand. 

File-based encryption works at the file and folder level, making it more granular. Although this method is more secure, as you can protect each document individually, it’s also more cumbersome because you often need to manage multiple passwords for different documents.

Container-based encryption is a flexible alternative. With this method, a digital vault is created in which you can collect and encrypt multiple files and folders. You then get to enjoy the convenience of a single password for a specific group of documents, without having to encrypt the entire hard drive.

Why should I password-protect my files and folders?

Like most users, you probably only log in to your PC with your local user account. Using a Windows password is an important first step to protecting confidential folders and files from other users of your device as well as from curious co-workers or family members. However, your Windows user account only guards against unauthorized access through the operating system — it doesn’t encrypt data, so files remain vulnerable if the device is lost or stolen, infected with malware, or your hard drive is accessed directly.

As such, you should password-protect and encrypt really sensitive files such as banking information and documents, scans of your ID documents, tax receipts, and personal photos. In doing so, nobody will be able to open the files without knowing the password — even if they gain access to your device.  

Protection in the event of theft or loss of your computer

If someone gets their hands on your laptop or PC, they can start the computer from a removable drive and access your files. They can even remove the hard drive, install it on another computer, and in doing so access all your files and personal data. This makes drive encryption tools like BitLocker or VeraCrypt ideal in these sorts of situations as all the data on your hard drive is encrypted.

Malware protection

If your computer gets infected with malware, like a virus, Trojan, or spyware, it will essentially have the same access rights as the user who’s currently logged in. This means that the malware can read, copy, send, or manipulate your files. This makes it all the more important to encrypt your files independently of your user account, making the content unreadable to malware. Keyloggers are also dangerous because they record what you type — including passwords — making it possible for hackers to access encrypted files. To prevent getting infected by malware in the first place, use powerful antivirus protection like Avira Free Security. 

Protection from cloud storage attacks

Many users also store their confidential files in the cloud, making cloud storage services a popular target for cybercriminals. Among other things, they can use phishing attacks to get their hands on your access credentials or exploit vulnerabilities in the security of cloud systems to gain access. As such, always encrypt sensitive documents before uploading them to the cloud.  

Secure file sharing

You’ll be able to share files that are encrypted independently of your device and user account over insecure channels (such as email without end-to-end encryption) without the fear of unauthorized third parties being able to access their contents. That’s because the recipient will need the password to open the sent file. 

Top tips for uncrackable passwords

The strength of your password determines how well your files and folders are protected. As such, always use strong passwords that are difficult to guess. Never use your date and place of birth, even if they consist of a combination of numbers and letters. This applies not only to password-protected files and folders but also to your online accounts.

• Never use easy-to-remember passwords — they’ll be easy to crack. 
• Never reuse passwords — unless you want to save a hacker time by giving them access to multiple online accounts with a single password.  
• Choose passwords comprising at least 12 characters and containing a random mix of uppercase and lowercase letters, numbers, and special characters.  
• Use two-factor authentication (2FA) to protect your online accounts so potential hackers need more than just your password. Use an authenticator app to simplify things.  
• Use a password manager to create, store, and manage strong passwords for your online accounts. 

Protect your passwords from cybercriminals and loss

You can use Avira Password Manager to not only create and store strong passwords for your online accounts but also for your encrypted files and folders. Once you’ve generated a password, you can copy it and store it in a secure note in the password manager. There, it is stored in an encrypted format using the secure AES-256 standard and protected from unauthorized access. 

And the best bit: You won’t go forgetting where you put your passwords and you’ll be able to access them whenever you need to. After all, you can’t reset your encryption password — there’s no “forgot your password” option like with your online accounts. 

Windows, BitLocker, Microsoft Office, Word, Excel, PowerPoint, and OneDrive are registered trademarks of Microsoft Corporation.
Adobe Acrobat is a registered trademark of Adobe Inc.
PDF24 is a registered trademark of geek software GmbH.
Google Drive is a trademark of Google LLC.
Dropbox is a trademark of Dropbox, Inc.
Folder Lock is a registered trademark of NewSoftwares.net, Inc.
Cryptomator is a registered trademark of Skymatic GmbH.
VeraCrypt is a trademark of IDRIX.
My Lockbox is a trademark of FSPro Labs.
AxCrypt is a registered trademark of AxCrypt AB.

This post is also available in: GermanFrenchItalian