Drive, container, file or cloud folder
Encryption tools differ less in their ciphers than in what they wrap. Pick the kind first, then the tool:
- Whole drive. Everything on the disk is encrypted and unlocked when the computer starts. This protects a lost or stolen laptop. Microsoft describes BitLocker as encryption for entire volumes, Apple's FileVault encrypts the startup disk, and on Linux cryptsetup and LUKS do the job. VeraCrypt can encrypt a partition, a USB drive or the Windows system drive.
- Container. One large file holds an encrypted disk that you mount when you need it. VeraCrypt calls this a virtual encrypted disk within a file. Good for a private folder on a shared computer or an external drive.
- Cloud folder (vault). Each file is encrypted on its own, so a sync service uploads only the files that changed. Cryptomator works this way inside Dropbox, Google Drive, OneDrive and other synced folders and also encrypts file names; gocryptfs is an encrypted overlay filesystem on the same principle.
- Single file. You encrypt one file or archive to send or store it. 7-Zip offers AES-256 encryption in 7z and ZIP archives with a password; age and GnuPG also encrypt to a recipient's public key, so you never have to share a password.
Whole-drive encryption does not protect a file once it leaves the disk, as an email attachment or in a cloud folder. Many people use two kinds: disk encryption on the laptop, and a vault or encrypted file for what they upload or send.
Free encryption tools compared
From the official pages on the date in the list. An empty cell means the page states nothing about it.
| Tool | Encrypts | Interface | Platforms | License |
|---|---|---|---|---|
| VeraCrypt | Containers, partitions, USB drives, Windows system drive | App | Windows, macOS, Linux, FreeBSD | Apache 2.0 and TrueCrypt License 3.0 |
| Cryptomator | Vaults in synced cloud folders, file names included | App | Windows, macOS, Linux; iOS and Android read-only for free | GPLv3 |
| 7-Zip | 7z and ZIP archives with AES-256 | App on Windows, console on Linux and macOS | Windows, Linux, macOS | GNU LGPL, parts BSD 3-clause |
| age | Files, with a passphrase, age keys or SSH keys | Command line | Windows, Linux, macOS, FreeBSD | BSD-3-Clause |
| Gpg4win with Kleopatra | Files and email (OpenPGP, S/MIME) | App, Explorer and Outlook add-ins | Windows | GNU GPL |
| GnuPG | Data and communications (OpenPGP) | Command line | Windows, macOS, Linux and more | GNU GPL |
| gocryptfs | An encrypted folder, file names included | Command line | Linux; macOS in beta | MIT |
| cryptsetup (LUKS) | Disks and partitions | Command line | Linux | GPL-2.0-or-later |
| BitLocker | Entire volumes | Built in | Windows Pro, Enterprise, Education | Part of Windows |
| FileVault | The Mac startup disk | Built in | macOS | Part of macOS |
The Gpg4win project states that its software is free of charge for all commercial and non-commercial purposes, and 7-Zip says you can use it on any computer, including a computer in a commercial organization. The VeraCrypt FAQ says companies can install and run VeraCrypt free of charge under its license terms.
What to check before you trust one
- Open code. All tools in the list except BitLocker and FileVault publish their source under a named license, which lets outside experts read how the encryption is done.
- Audits. Only trust audit claims you can trace. VeraCrypt's FAQ names an audit by Quarkslab and says version 1.19 fixed the issues it found. The gocryptfs README states that its security was audited in March 2017 and links the report. Cryptomator's home page says it is audited by security researchers and links its audits.
- Maintenance. A tool you will need in ten years should still be updated. VeraCrypt lists version 1.26.30 from October 2026 on its home page, and 7-Zip version 26.05 from October 2026. Projects can also stop: the Picocrypt repository was archived by its owner on Sep 7, 2025, so we left it out of the list.
- Recovery when the password is lost. Good encryption has no back door. VeraCrypt says it does not allow decryption without the correct password or key. Cryptomator cannot reset a vault password for you, but a recovery key lets you set a new one. Apple warns that with FileVault, if you forget both your login password and your recovery key, your files are permanently lost. Store the recovery key or password somewhere else, such as a password manager.
A password-protected ZIP is not the same as an AES-encrypted one: the ZIP specification itself calls its traditional encryption weak by today's standards. In 7-Zip, choose AES-256.
Privacy: who holds the key
Encryption only keeps data private from those who do not hold the key, so check where the recovery key goes. On Windows device encryption, Microsoft states that the recovery key is uploaded to the online Microsoft account, or backed up to Microsoft Entra ID or Active Directory on work devices; with only local accounts the device stays unprotected even though the data is encrypted. FileVault lets you choose between unlocking with your iCloud account or a recovery key you keep yourself.
The open source tools in the list keep keys on your device. Cryptomator says it needs no accounts and shares no data with any online service. If you want to understand who can read a message on the way, our guide to end-to-end encryption explains the difference to encryption in transit, and hashing vs encryption vs encoding sorts out three terms that are often mixed up.
What our tools add
Our tools run in your browser and do not upload what you enter:
- Text encryption encrypts a short message with a password using AES-GCM, for a note you paste into a chat or email.
- Password generator creates a long random password for a container or vault; our guide on how long a password should be explains the length.
- Hash generator computes the SHA-256 of a file, so you can compare it with a checksum a project publishes for its download.
- Protect PDF adds a password with AES-256 encryption to a single PDF.
- Create ZIP packs files and folders, but without a password; for an encrypted archive, use 7-Zip with AES-256.
Before you upload a vault, see the free cloud storage list; for sending an encrypted file, the free file transfer list.
Frequently asked questions
Is BitLocker free on Windows Home?
Microsoft's edition table lists BitLocker for Windows Pro, Enterprise, Pro Education/SE and Education, not Home. Device encryption, which turns on BitLocker automatically, is available on all Windows versions on devices that meet its requirements. It encrypts the system drive and fixed drives but not external or USB drives.
What happens if I forget the password?
With most tools the data is gone. VeraCrypt says it does not allow decryption without the correct password or key. Cryptomator cannot reset a vault password, but its recovery key lets you set a new one, and FileVault offers an iCloud account or a recovery key. Keep the recovery key somewhere other than the encrypted disk.
How do I encrypt files before I upload them to the cloud?
Cryptomator creates vaults inside your synced folder and encrypts every file and its name before the sync service uploads it. Its desktop app is free on Windows, macOS and Linux; the iOS and Android apps are free to read, and writing needs a one-time purchase. On Linux, gocryptfs works on the same principle from the command line.
Which free encryption tools have been audited?
VeraCrypt's FAQ names an audit by Quarkslab and says version 1.19 fixed the issues found. The gocryptfs README states an audit from March 2017 and links the report. Cryptomator's home page says it is audited by security researchers and links its audits.
Is a password-protected ZIP file secure?
It depends on the method. The ZIP specification calls the traditional ZIP encryption weak by today's standards. 7-Zip offers AES-256 encryption in 7z and ZIP archives, which is the option to choose.
Can I use these tools at work?
Gpg4win says it is free of charge for all commercial and non-commercial purposes, and 7-Zip says it can be used on any computer, including one in a commercial organization. The VeraCrypt FAQ says a company can install and run it free of charge under its license terms. For the others, read the license named in the list.