# Full disk encryption software compared: which tool on which platform, and how to encrypt external drives URL: https://webvpn.org/encryption/full-disk-encryption-software/ Updated: 2026-09-10 Full disk encryption software compared: BitLocker on Windows, FileVault on macOS, LUKS on Linux, VeraCrypt cross-platform, and how to encrypt an external hard drive. The main full disk encryption software options are the tools built into each operating system, BitLocker on Windows, FileVault on macOS and LUKS on Linux, plus VeraCrypt as a free, open-source, cross-platform alternative for system drives, external drives and containers. The built-in tools are the right choice for a computer's internal drive because they integrate with the hardware security chip and boot process; VeraCrypt is the choice when a drive must open on more than one operating system, when you want hidden volumes, or when you prefer an audited tool independent of the vendor. All use AES in XTS mode and all require a saved recovery key. Choosing disk encryption software is easier than it looks because the field has consolidated onto a handful of well-tested products. This guide compares them by platform, explains the difference between software and hardware encryption, covers external hard drives specifically, and offers a decision list, with links to the detailed setup guides on this site for each tool. ## The built-in options Each operating system vendor provides full disk encryption at no cost, integrated with the login and boot process. BitLocker on Windows Pro, Enterprise and Education, with a simplified Device Encryption on Home edition for supported hardware. It stores keys in the TPM chip so the disk unlocks automatically at boot and relies on the Windows login for protection, with an optional pre-boot PIN for stronger security. BitLocker To Go extends it to USB and external drives. The BitLocker guide on this site covers setup and the pitfalls around recovery keys and Microsoft accounts. FileVault on macOS, which encrypts the startup disk and ties the key to user account passwords and, on Apple silicon and T2 Macs, to the Secure Enclave. Enabling it is one checkbox, and the FileVault guide explains the recovery key choices. LUKS on Linux, the Linux Unified Key Setup, implemented by dm-crypt in the kernel and managed with cryptsetup. Distributions offer it as an installer option for the whole disk, and it supports multiple passphrases, key files and integration with the TPM. The LUKS guide covers setup on Ubuntu, Mint, Arch and Gentoo. iOS and Android encrypt by default, with keys bound to the passcode and secure hardware; the phone encryption guide on this site covers them. ## VeraCrypt: the cross-platform option VeraCrypt is free and open source, runs on Windows, macOS and Linux, and has been independently audited. It can encrypt a Windows system drive with pre-boot authentication, encrypt whole non-system drives and USB sticks, and create encrypted container files that mount as drives. Its distinguishing features are portability, since a VeraCrypt-encrypted external drive opens on any of the three systems, hidden volumes and hidden operating systems for situations involving coercion, and independence from any operating system vendor. Its limitations are that it cannot encrypt macOS or Linux system drives, that it does not use the TPM, and that it requires installing software on each machine. The VeraCrypt guides on this site cover it in depth. ## Side by side Tool Platforms System drive External drives Hardware key support Hidden volumes Open source BitLocker Windows Yes Yes (To Go) TPM No No FileVault macOS Yes Yes (Disk Utility) Secure Enclave No No LUKS Linux Yes Yes TPM optional No Yes VeraCrypt Windows, macOS, Linux Windows only Yes, cross-platform Keyfiles, some tokens Yes Yes All four encrypt with AES-256 in XTS mode by default and all are considered secure when configured with a strong passphrase and a saved recovery key. ## Software encryption versus self-encrypting drives Some SSDs and external drives advertise built-in hardware encryption, with the cipher running in the drive's controller. In principle this offloads work and protects the drive independently of the operating system. In practice, researchers have found self-encrypting drives from major manufacturers whose encryption could be bypassed entirely due to firmware flaws, and because firmware is closed, users cannot verify the implementation. Operating system vendors have responded by defaulting to software encryption even on drives that offer hardware encryption. With AES instructions in every modern processor, software encryption imposes little overhead. Prefer software encryption, or at minimum layer software encryption over any hardware encryption rather than relying on the drive alone. The encrypted USB drive guide on this site examines the hardware-encrypted drive market in more detail. ## Encrypting an external hard drive External drives are lost more often than laptops and rarely encrypted. The right tool depends on where the drive will be used. - Only on Windows. BitLocker To Go. Right-click the drive, turn on BitLocker, choose a password, save the recovery key. Readable on any Windows machine with the password. - Only on Macs. Format the drive as APFS encrypted in Disk Utility, or right-click a drive in Finder and choose to encrypt. Readable on any Mac with the password. - Only on Linux. Create a LUKS volume with cryptsetup or the Disks utility; desktop environments prompt for the passphrase when the drive is plugged in. - Across operating systems. VeraCrypt. Encrypt the whole drive or create a container on it, and install VeraCrypt on each machine that needs access. The VeraCrypt USB guide on this site walks through it. - For backups. Whichever tool matches the machine being backed up, so the backup can be restored without extra software. Keep the recovery key with your other recovery keys, not on the drive. Before encrypting a drive that already holds data, back it up. Enabling encryption on a drive in place is supported by most tools and is still the moment things go wrong. ## A seven-question decision guide - Is this the internal drive of a Windows, Mac or Linux computer? Use the built-in tool. - Does the drive need to open on more than one operating system? Use VeraCrypt. - Do you need to deny that encrypted data exists, under coercion? Only VeraCrypt's hidden volumes address this. - Do you want the disk to unlock without typing anything at boot, relying on the login password? BitLocker with TPM or FileVault; add a pre-boot PIN or passphrase if the threat is a skilled attacker with physical access. - Is the hardware old or lacking a TPM? BitLocker needs a workaround; LUKS and VeraCrypt work regardless. - Do you require open-source software? LUKS or VeraCrypt. - Is it a phone? It is already encrypted; set a strong passcode. ## Common mistakes with any tool - Not saving the recovery key, or saving it on the encrypted disk. Store it offline and separately. - Assuming a cloud-synced recovery key is private. BitLocker keys saved to a Microsoft account and FileVault keys escrowed to iCloud are accessible to those providers. - Leaving the machine asleep with the key in memory when it leaves your control. - Trusting a drive's hardware encryption without software encryption on top. - Encrypting an external drive with a tool the destination machine cannot read. - Using a short passphrase on a setup without hardware guess limiting. ## What vendors and researchers say The comparison here follows vendor documentation and independent research. Operating system vendors document their disk encryption tools as the recommended protection for data at rest on their platforms, describe their use of XTS-AES and hardware security chips, and provide recovery key mechanisms with explicit warnings that lost keys mean lost data. The VeraCrypt project documents its cross-platform support, its audit history, and its hidden volume feature, and notes that it cannot encrypt macOS or Linux system partitions. Security researchers who examined self-encrypting drives published findings that several models could be unlocked without the password due to firmware flaws, leading operating system vendors to prefer software encryption by default, and describe software full disk encryption with a strong passphrase as the reliable baseline. ## Pick the built-in tool, then cover the exceptions Enable BitLocker, FileVault or LUKS on every computer you own and confirm the recovery key is stored safely. Encrypt external drives with the matching tool, or with VeraCrypt if they travel between systems. The detailed guides for each are on this site, and once they are done the most common way data leaks, a device walking out the door, stops applying to you. ## FAQ Q: What is the best full disk encryption software? A: For most people, the tool built into the operating system: BitLocker on Windows, FileVault on macOS, LUKS on Linux. They are free, integrated with the hardware security chip and the boot process, and maintained by the vendor. VeraCrypt is the leading cross-platform alternative when you need drives that work on several systems or want hidden volumes. Q: Which Microsoft tool is used to conduct full disk encryption? A: BitLocker Drive Encryption, included in Windows Pro, Enterprise and Education editions, with a simplified version called Device Encryption on Home edition when the hardware supports it. It uses the TPM chip to store keys and can protect fixed and removable drives. Q: Which Linux tool is used to conduct full disk encryption? A: LUKS, the Linux Unified Key Setup, implemented by dm-crypt in the kernel and managed with the cryptsetup command. Every major distribution offers LUKS full disk encryption as an installer option, and most desktop tools for encrypting drives on Linux use it underneath. Q: How do I encrypt an external hard drive? A: Use BitLocker To Go on Windows, Disk Utility or Finder on macOS, cryptsetup or the Disks tool on Linux, or VeraCrypt if the drive must open on more than one operating system. Format the drive, enable encryption with a strong password, save the recovery key, and test on the machines that will use it. Q: Are hardware-encrypted drives better than software encryption? A: Not necessarily. Self-encrypting drives have shipped with flaws that allowed bypassing the encryption entirely, and you cannot inspect their firmware. Software encryption from the operating system or VeraCrypt is auditable and has a strong track record. Hardware acceleration in the processor makes software encryption fast enough for any use.