If a laptop is stolen, the cost of the computer may be the least of your worries. Tax records, work files, saved photos, financial documents, browser data, and years of personal information can all be sitting on the drive. A login password helps, but it does not always protect that data from someone holding the device. Full-disk encryption makes those stored files harder to reach after the computer is stolen.
When a Password Is Not Enough
Most people see the Windows or Mac login screen and assume their files are protected. It makes sense at first. If a stranger cannot enter the right password, how could that person reach the documents stored inside? The problem is that a login password mainly controls normal access through the operating system. Full-disk encryption protects the information stored on the drive itself, which is a different layer of security.
Without encryption, someone who has the computer may not need to guess your Windows or Mac password. Depending on the hardware and configuration, the storage device might be removed, connected to another system, or examined with tools that work outside the normal sign-in process. Microsoft describes BitLocker drive encryption as protection against unauthorized access when devices are lost, stolen, decommissioned, or recycled.
Changing your account password after a laptop disappears can still be a smart move because it helps protect online services and connected accounts. What it cannot do is go back and encrypt files that were already stored on an unencrypted drive. Your account password controls who can sign in through the usual route. Encryption determines whether the stored information itself can be read.
What Full-Disk Encryption Protects
Full-disk encryption takes readable information stored on a drive and turns it into encrypted data that requires the correct cryptographic keys to unlock. The phrase “full-disk encryption” is widely used, even though technologies such as BitLocker often protect storage at the volume level. For everyday users, the technical distinction matters less than the outcome: someone who gets the drive should not be able to open the protected files without authorization.
During normal use, you barely notice any of this happening. You sign in, open documents, save photos, run programs, and browse folders just as you normally would. The operating system handles encryption and decryption behind the scenes. You do not have to type another password each time you open a spreadsheet or view a picture.
The real benefit appears when the protected storage is locked. Instead of finding ordinary readable files, someone attempting offline access should encounter encrypted data. CISA recommends encrypting computers and removable media because unencrypted information may be read, copied, changed, or stolen when another person gains access to a device.
Encryption is mainly a defense for data at rest. It cannot stop someone from physically taking a laptop, and it does not make an already unlocked computer impossible to misuse. Its job is more focused than that, but extremely useful. If the computer disappears, the information sitting on the drive should not disappear with it in readable form.
Why Theft Changes the Threat
An online attacker is usually trying to reach your computer from somewhere else. A thief holding the actual machine has a different advantage. The person can keep the device, inspect its storage, try alternate startup methods, or spend hours looking for another way into the data. There is no need to finish the attack in a few seconds.
A powered-off computer with properly configured encryption creates a much harder problem. Microsoft explains that BitLocker can work with the Trusted Platform Module, or TPM, to protect encryption keys and verify parts of the startup environment. Its BitLocker security and recovery FAQ also notes that sleep and hibernation do not provide identical security conditions because sensitive information can remain in memory while a system sleeps.
This does not mean a laptop has to be shut down every time you leave the room. Automatic screen locking is useful for normal daily use. For travel, overnight storage, or long stretches when a sensitive computer will be out of your sight, a full shutdown can create a cleaner security boundary than leaving an active session running. An unlocked laptop, a sleeping laptop, and a powered-off encrypted laptop are simply not the same situation.
Check Windows Encryption First
Windows makes this topic a little confusing because users may see two related names: Device Encryption and BitLocker Drive Encryption. They rely on the same underlying BitLocker technology, but Windows presents them differently, and the available controls depend partly on the edition of Windows installed.
Device Encryption is the simpler option. On compatible hardware, it can protect the Windows operating system drive and fixed data drives, including on supported computers running Windows Home. Microsoft explains that Windows Device Encryption is turned on automatically when a compatible device is set up with a Microsoft account or a work or school account. If the PC uses only a local account, Device Encryption is not turned on automatically.
The full BitLocker Drive Encryption interface is available on Windows Pro, Enterprise, and Education. Windows 11 version 24H2 also broadened the hardware that can qualify for automatic Device Encryption by removing some older requirements. That means encryption is becoming more common on newer computers, but it still should not be assumed.
On Windows 11, check these items directly:
- Open Settings > Privacy & security > Device encryption and confirm whether the option is available and turned on.
- On Windows Pro, Enterprise, or Education, search for Manage BitLocker to review individual drives.
- Make sure recovery information exists before major hardware, firmware, or security changes.
- Remember that ordinary removable USB drives are not automatically protected simply because the computer’s internal drive is encrypted.
A Windows Hello PIN, fingerprint reader, facial recognition, or login password can improve account security and make sign-in easier. None of those features, by itself, proves that the data stored on the drive is encrypted.
What FileVault Adds on a Mac
Mac users run into a different kind of confusion. Newer Macs already encrypt their internal storage at the hardware level, so it is easy to hear that fact and assume FileVault no longer serves much purpose. It still does.
On Macs with Apple silicon or an Apple T2 Security Chip, internal APFS volumes are encrypted automatically. When FileVault is turned on, however, the protection around the encryption keys changes. Apple explains that FileVault on Apple silicon and T2 Macs uses the Secure Enclave and the user’s credentials as part of the process that protects the key used to unlock the volume.
That means enabling FileVault on a modern Mac is not the same as taking a completely unencrypted drive and beginning encryption from scratch. The internal storage is already encrypted. FileVault strengthens the conditions under which access to that encrypted data is released. On older Intel Macs without a T2 chip, FileVault must be turned on to provide full-volume encryption.
Mac users can review the setting under System Settings > Privacy & Security > FileVault. If FileVault is enabled, spend another minute checking the recovery method too. A MacBook containing tax records, work documents, customer files, contracts, private photos, or other personal information deserves more than an assumption that the default setup covers everything.
Recovery Keys Can Save Your Data
Strong encryption comes with an uncomfortable but necessary tradeoff. If strangers should not be able to bypass it, you should not expect an easy hidden back door when you lose access either. That is exactly why recovery keys matter.
BitLocker can request a 48-digit recovery key when Windows can no longer unlock a protected drive automatically. Certain hardware changes, TPM changes, firmware changes, or unusual startup conditions may trigger the recovery screen. Microsoft states that a lost BitLocker recovery key cannot be recreated by Microsoft Support. If the required key cannot be found and the condition that triggered recovery cannot be reversed, resetting the device may eventually be the only remaining option, and that removes the files stored on it.
The BitLocker recovery key may be stored with a Microsoft account, a work or school account, a printed copy, a USB drive, or another approved location. Windows also displays a recovery key ID that helps match the correct key to the correct computer. FileVault creates a similar responsibility. Depending on the Mac’s setup, recovery may involve an Apple Account or a personal recovery key.
Check recovery information before you need it. Make sure it exists, make sure you can find it, and avoid keeping the only copy beside the computer it unlocks. A printed key in the same laptop bag as the encrypted laptop defeats much of the point. For a business, the recovery method should also never depend entirely on one employee’s personal account or memory.
Protect External Drives Too
It is easy to protect a laptop and then forget about the small USB drive sitting in a desk drawer. That can leave a surprisingly large hole in the plan. Portable storage often holds concentrated collections of information because people use it for backups, transfers, archived documents, tax records, photos, customer data, and exported account files.
Windows Pro, Enterprise, and Education include BitLocker To Go for removable drives. Mac users can also create password-protected encrypted external storage. If losing a portable drive would expose information you would not want a stranger reading, it is worth considering encryption for that drive too.
Be careful before changing the format or encryption state of storage you already use. Some encryption workflows erase the existing contents first, so back up anything important before making changes. Compatibility matters as well. APFS encryption works well inside the Apple ecosystem, but it may not be appropriate for a drive that regularly moves between Windows and macOS systems.
It also helps to separate backup from encryption. A backup protects you when the original files are damaged, deleted, corrupted, or lost. Encryption protects the confidentiality of that backup if somebody else gets the storage device. An encrypted laptop sitting next to an unencrypted backup disk may still leave the same private data exposed through an easier route.
Encrypt Before a PC Leaves You
A computer can remain a privacy risk long after you stop using it. Selling it, donating it, recycling it, returning it, or discarding it means someone else may eventually have physical access to the storage inside.
Deleting a few folders does not necessarily make the underlying information impossible to recover. Even emptying the Recycle Bin or Trash should not be confused with complete data sanitization. Modern SSDs and flash storage also complicate old advice about repeatedly overwriting individual files because wear leveling, controller behavior, and built-in storage features affect where information is physically stored.
The current federal reference is NIST SP 800-88 Revision 2, finalized in September 2025. NIST defines media sanitization as a process that makes access to target data infeasible for a given level of effort, and the publication includes cryptographic erase among the approaches relevant to encrypted media.
Most home users do not need to become experts in storage sanitization. Before a computer leaves your possession, back up what you want to keep, sign out of important services, use the operating system maker’s supported reset or erase process, and remove the device from account-management pages when appropriate. A business handling confidential, regulated, or customer information may need more formal procedures, including documented sanitization, validation, or physical destruction. Encryption helps, but disposal still deserves its own process.
Speed, Repairs, and Drive Failure
Some people leave encryption disabled because they expect it to make the computer painfully slow. On current hardware, that concern is usually larger than the actual effect. Microsoft says BitLocker typically adds a small performance overhead, often in the single-digit percentage range, although the real impact depends on the storage workload, drive, processor, and system configuration. Microsoft’s BitLocker performance information also explains that initial encryption can continue in the background while the computer remains usable.
For many users, repairs are a more important issue than speed. A motherboard replacement, TPM change, firmware adjustment, altered boot configuration, or moving a protected drive into another computer can cause BitLocker to ask for recovery information. That is not an arbitrary inconvenience. Windows is responding because something important about the environment trusted to unlock the drive has changed.
Encryption cannot repair broken storage either. If an SSD fails, the recovery key will not bring damaged hardware back to life. A professional recovery company may be able to recover raw information from some failed drives, but encrypted data still needs the correct keys before it becomes useful.
This is why encryption and backups belong together. Keep important files somewhere separate from the main computer, occasionally test that your backup can actually be restored, and protect sensitive backups with encryption when appropriate. Encryption protects privacy. A backup protects your ability to get the data back. You do not want to discover the difference during an emergency.
What Encryption Cannot Protect
Full-disk encryption has an important job, but it is narrower than many people expect. It protects stored data when someone does not have authorization to unlock it. It does not turn the entire computer into a security fortress.
Once you sign in, the operating system has access to the files you are using. Malware running with enough access may be able to read those same files. Full-disk encryption does not block phishing, ransomware, malicious browser extensions, remote-access scams, stolen passwords, fake websites, or a person using a computer you already left unlocked.
CISA’s ransomware prevention recommendations include measures such as offline backups, software updates, multifactor authentication, endpoint protection, and controls around account access. Those defenses solve problems that disk encryption does not.
Encryption also stays with the storage it protects. If you email a private document to the wrong person, upload it to a compromised cloud account, or copy it to an unencrypted USB drive, the encryption protecting your laptop does not automatically follow that copy. Strong passwords, multifactor authentication, software updates, malware protection, backups, screen locking, and careful account use still matter. Computer security works best when several layers are doing different jobs.
Recovery Keys for Small Businesses
A small company may own only five or ten laptops, yet recovery-key management can become messy faster than most people expect. If every employee handles encryption independently, one BitLocker key might end up in a personal Microsoft account, another on paper, another in someone’s private password manager, and one may never be recorded anywhere useful.
The business should know which computers are encrypted, how each device can be recovered, where the recovery information is stored, who is allowed to retrieve it, and what happens when a machine is replaced or reassigned. Apple explains how organizations can use managed FileVault recovery keys with device-management systems, including escrow of personal recovery keys.
You do not need a large IT department to improve this. A small company can maintain a simple, accurate device inventory and keep recovery information in a controlled company-owned system rather than scattered across personal notes and accounts. Consistency is the important part. The employee who happens to use the laptop should not be the only person who knows how the organization can recover it.
Employee departures need to be part of the same process. Before an account is removed or a computer is erased, confirm that required business files and recovery information are available to the company. Encryption should keep outsiders away from company data. It should not leave the company locked out of its own information.
JENI® Security Action Plan
You do not need to understand the mathematics behind encryption to use it well. What matters is knowing whether protection is active, whether recovery will work, and whether sensitive information is sitting somewhere else without the same safeguards. A few practical checks cover most of the risks discussed throughout this article.
- Verify encryption on your main computer. On Windows, check Device Encryption or BitLocker. On Mac, review FileVault and understand how your particular Mac protects its internal storage.
- Find your recovery information. Confirm that the BitLocker or FileVault recovery method exists and belongs to the correct computer.
- Keep recovery information separate. Do not let the laptop bag or encrypted computer become the only place where the recovery method can be found.
- Check portable storage. Review USB drives, backup disks, memory cards, and portable SSDs that may contain personal or business information.
- Keep a separate backup. Encryption cannot recover deleted files or repair a failed drive.
- Use automatic screen locking. A computer that locks itself quickly gives an unattended session less time to remain exposed.
- Consider shutting down during travel. If a sensitive laptop will be out of your control for a long period, powering it off may provide stronger protection than leaving an active session running.
- Prepare old devices before disposal. Back up what you need, sign out of accounts, and follow supported reset or erase procedures.
- Document business recovery. A company should know where recovery keys are stored, who can retrieve them, and what happens when an employee is unavailable.
There is no need to fix every computer and storage device in one afternoon. Start with the laptop that travels most often or the system holding your most sensitive information. Once that is covered, move through backup drives, secondary computers, old systems, and removable media. The goal is to find the places where valuable data actually lives and make sure none of them were forgotten.
Full-Disk Encryption FAQs
Is a Windows PIN the same as encryption?
No. A Windows PIN is a method of proving your identity when you sign in, while full-disk encryption protects information stored on the drive from unauthorized offline access. A PC can use a Windows PIN and still require you to check separately whether Device Encryption or BitLocker is enabled.
Does FileVault slow down a Mac?
Apple does not publish one performance percentage that applies to every Mac because hardware and workloads vary. On Apple silicon and T2-equipped Macs, internal storage is already encrypted, so FileVault mainly strengthens how the encryption keys are protected rather than beginning with a completely unencrypted drive.
Can I recover files without the key?
Sometimes another authorized recovery method may be available, depending on the operating system and how encryption was originally configured. If the required credentials and every valid recovery method are lost, properly encrypted data may become impossible to recover.
Should I encrypt a desktop PC too?
Yes, if the desktop contains information you would not want exposed after theft, repair, resale, or unauthorized physical access. A desktop travels less than a laptop, but its storage can still be stolen, removed, serviced, recycled, or eventually handed to someone else.
Does encryption stop ransomware?
No. Ransomware running after you sign in may be able to reach files the operating system has already unlocked. Full-disk encryption protects data at rest, while backups, malware defenses, software updates, account protection, and careful browsing address other parts of the ransomware problem.
Protect the Data Behind the Login
A login password and storage encryption work well together, but they do not solve the same problem. Your password helps control who can use the account through the normal sign-in process. Encryption helps determine whether the files stored on the drive remain readable when somebody has the hardware in hand.
For home users, one of the best improvements is simply checking what is already in place. Find out whether encryption is active, locate the recovery method, look at removable storage, and make sure important files exist somewhere besides the main computer. Small businesses need those same basics, plus consistent recovery-key storage, device records, employee offboarding, and a clear process for computers that leave the organization.
CISA recommends encrypting devices and removable storage because physical loss can expose information that was never supposed to leave your control. That concern grows when laptops and portable drives travel between homes, offices, vehicles, airports, hotels, and customer locations.
A stolen computer is already expensive and disruptive. It should not automatically hand someone years of financial records, personal photos, customer files, work documents, or other private information at the same time. Full-disk encryption cannot prevent the theft itself, but it can make the data stored inside the computer far less useful to whoever takes it.
Related Articles
Windows Backup and Recovery Strategy
Build a stronger Windows backup plan with file backups, system images, recovery tools, and offline copies that help protect important data when a PC fails.
Mac Backup and Encrypted Storage
Learn how Time Machine, encrypted backup drives, offsite copies, and tested recovery can protect Mac data from theft, hardware failure, corruption, and loss.
Why Deleted Files Can Still Expose Data
See why deleted files may remain recoverable on computers and SSDs, and how encryption and proper sanitization help protect private data before disposal.
Prevent Data Loss From Shared Files
Learn how cloud permissions, shared links, local copies, and unencrypted devices can expose sensitive files even when the original computer is protected.
