• Device encryption is crucial to protecting personal data on Windows 11 devices in the event of loss or theft.

• Most new Windows 11 PCs have device encryption enabled by default, but older machines must enable it manually.

• Encrypting external drives with BitLocker or VeraCrypt protects sensitive data on the go.

Laptops and tablets allow you to work in parks, cafes and even on airplanes. The downside of this freedom is the increased risk of loss or theft of mobile devices. This makes device encryption an absolute necessity, so here’s how to make sure it’s enabled on your Windows 11 PC.

Why you should encrypt your Windows devices

Think about the information stored on your laptop or tablet: banking details, private conversations, personal photos, connected social media accounts. If someone with bad intentions gets ahold of this, they may steal your money, try to blackmail you, or try to scam your friends by pretending to be you online. The damage that can be done by accessing your entire digital life is only limited by the creativity of whoever found or stole your computer.

Device encryption prevents this. In simple words, it scrambles all the data on your device so that it cannot be read without a decryption key. This key can be something you enter when your PC starts up, or it can be encrypted on the device itself and linked to your user account. This means that only authorized users of your PC can use it or access the data on it, even if they physically remove the hard drive.

This additional protection also has a side effect: broader data encryption and features such as locking a device remotely are adopted, the less attractive mobile devices are to thieves.

How to enable device encryption in Windows 11

Most Windows 11 PCs now come with device encryption enabled by default, which is ideal for anyone purchasing a new machine.

However, if you have an older machine that shipped before this change or if you built your own PC, you will need to enable encryption yourself.

To do this, log in to your Windows 11 device as administrator, then right-click the Start button and click “Settings” (the gear icon). Next, open “Privacy & Security” from the left navigation menu and select “Device Encryption”. From there, you can enable “Device Encryption” to enable it.

Note that even if devices shipped with Windows 11 should supports Device Encryption functionality, it may not be available if specific hardware requirements are not met, such as presence of a TPM.

An alternative is to use BitLocker (available in Pro versions of Windows 11 and Windows 10). It’s not as user-friendly, but still secures your data, allowing you to decrypt it and access your PC by manually entering a password at startup.

Encrypting removable drives with BitLocker and VeraCrypt

If you regularly take your removable drives (like external hard drives or USB sticks) with you when you leave your home or office, you should also encrypt them if they contain sensitive business or personal data.

BitLocker can also be used for this if you only use Windows devices that support BitLocker.

If you also use your USB storage on MacOS or Linux machines, an alternative is to use VeraCrypt. Veracrypt is also free, which means you can use it on any version of Windows.

You should back up your Windows devices for complete protection

If one of your Windows 11 devices is lost or stolen, you also need a backup copy of your data stored on a separate device, stored in a safe place so that it is not irretrievably lost. It’s also a good idea to keep a third backup in the cloud as additional insurance against disasters.

With Windows 11 device encryption and an effective backup plan in place, you can travel securely knowing your data is protected, and if you lose your device, you can simply restore your backup to a new device and continue to work where you left off (even if a little less good for the experience).