How to encrypt a USB flash drive with VeraCrypt: a complete practical guide

Informatec Digital » Security » How to encrypt a USB drive with VeraCrypt: a complete practical guide

Image: Encrypt a USB flash drive with VeraCrypt

Protecting a USB drive with robust encryption is one of those security habits that makes a real difference in everyday life. With VeraCrypt, a free and established solution, you can create encrypted containers or protect entire disks with minimal hassle and modern algorithms that guarantee confidentiality.

Although TrueCrypt was the standard for years, its development ceased, and today its legacy lives on in VeraCrypt, which maintains the code, adds improvements, and is available for Windows, macOS, and Linux. If you want to protect your data from prying eyes at home, in the office, or in the cloud, here's a complete guide with step-by-step instructions, recommendations, and alternatives.

Why choose VeraCrypt today?

A decade ago, TrueCrypt was the leading tool for encrypting USB drives and hard drives, but in 2014 its developers halted the project, and the last version (7.2) only allows decryption of existing volumes, without creating new ones . From this fork emerged VeraCrypt, which has continued development, fixing bugs, auditing the code, and improving performance.

VeraCrypt is free, open source, and cross-platform (Windows, macOS, Linux). In addition to transparency, it offers true compatibility with current hardware and support for three very strong ciphers: AES, Serpent, and Twofish . Its code is accessible, which inspires confidence in those who prefer software without black boxes or potential backdoors.

Another compelling reason is performance. With modern CPUs, AES encryption is accelerated thanks to AES-NI, minimizing the performance penalty. On systems with this feature, read and write speeds can easily exceed the performance of standard drives , making the encryption virtually seamless in everyday use.

Download, installation and first setup

Download VeraCrypt from its official website: you'll find installers for Windows, macOS, Linux, and even the source code. It's a 100% free program, and if you prefer, you can choose the portable version to carry it on a USB drive and use it without installation wherever you need it.

After installation, it's advisable to set the interface to Spanish. On Windows, go to "Settings" > "Language" and choose "Spanish." This small detail makes things easier if you're going to follow the steps in the guide, and helps avoid errors when configuring encryption options or file systems.

Important caution: If you are going to encrypt an entire USB drive or create a container within it, back up your data because some procedures will format it. Before booting, wipe the drive or remove any data you wish to keep so you can later import it into the encrypted volume.

Key features and effectiveness of encryption

VeraCrypt offers multiple ways to protect your data. You can create an encrypted container file that acts as a "virtual disk," encrypt a partition or the entire device (USB, SD card, external hard drive), and even protect the system partition so that the entire operating system boots under encryption.

• Encrypted containers in a file: Ideal for easily moving data, sending it via email, or uploading it to FTP/Samba. You copy a single file, which, when mounted, behaves like any other drive.
• USB and SD card encryption: Encrypts the entire device or a partition. In Windows, you'll see a "format" prompt; don't do it. Mount with VeraCrypt using the password/key and you'll access it normally.
• System disk encryption: Similar to BitLocker, it encrypts the entire disk/SSD on your computer to protect your system, profiles, and documents.
• Real-time transparency: Encryption/decryption is done on the fly; you work as if it were a normal folder.
• Accelerated performance: If your CPU supports AES‑NI, the AES algorithm flies, improving reading and writing significantly.
• Hidden volume: An additional layer for duress scenarios; you can reveal a decoy password without exposing the sensitive area.

In terms of pure effectiveness, the combination of robust algorithms, frequent audits, and cross-platform flexibility makes VeraCrypt a highly reliable choice for both users and businesses. Its ease of use has improved over the years, while still maintaining advanced customization options to fine-tune encryption, hashing, and authentication to suit your needs.

Pros and cons: the good and what you should know

Among its advantages, it stands out for being free and open source, with Spanish support, high security, and compatibility with Windows, Linux, and macOS. It also allows you to choose different algorithms and usage modes (containers, partitions, system), giving you complete control over how to protect your data.

On the downside, it requires a bit of a learning curve, especially if you want to take advantage of features like hidden volumes or encrypting entire drives. Also, for encrypting individual files, you might find it more practical to use password-protected compression (like 7-Zip) if you only need to protect a couple of documents temporarily.

Step-by-step guide: creating an encrypted container

This method creates a file containing your encrypted data, which, when mounted, appears as a new drive on your system. It's a convenient way to get started: it's portable, simple, and avoids altering your memory's partition structure.

1. Open VeraCrypt and click on «Create volume»The creation wizard will open.
2. Choose «Create an encrypted file container» and proceed with “Next”.
3. Choose Common VeraCrypt Volume (the standard) and continues.
4. Under "Volume Location", tap "Select File", navigate to your flash drive or other folder and give it a name (for example, “encrypted_data.vc”).
5. In "Encryption Algorithm" you can leave BEA (recommended for general use) and in “Hash Algorithm” the default value (SHA‑512) or SHA‑256 if you are looking for a good security/speed balance.
6. Define the container size (for example, 300 MB, 2 GB, etc.).
7. Choose the access method: password and/or key fileA strong password is usually sufficient, but you can take things to the next level by using key files.
8. If you activate "Use key file", click on «Key Files…» and then click "Generate." Move your mouse around the window for about 30 seconds and create the key file (this increases entropy). Save this file somewhere safe and non-obvious.
9. The assistant will ask you for the File System: If you need files larger than 4 GB, use exFAT or NTFS; if not, FAT is valid.
10. Click on "Format". When you're done, confirm with "OK" and close with "Exit."

If you prefer a more detailed guide using the key-file approach, these steps are equivalent to those numbered in other guides (16-36): choose "Create an encrypted virtual disk", define path and name, confirm AES encryption, set size (for example, 300 MB), enable "use key-file" , generate the file by moving the mouse to add randomness, save it in an inconspicuous location, add it to the key-file box, choose the format (NTFS if you are handling large files) and format the container before finishing.

Mount, use, and unmount the volume

With the container created, in the main window click "Select File ," choose the container and an available drive letter. Then, click "Mount," enter the password—and the key file if you configured it—and access the volume as if it were a normal disk.

Everything you copy will be encrypted on the fly, without any extra steps. When you're finished, return to VeraCrypt and click "Unmount" or "Unmount All" to close the drive. This ensures that the volume remains inaccessible if you remove the USB drive or shut down your computer.

Hidden Volume: When and How to Use It

A hidden volume adds a layer of plausible deniability. You create an "external" volume with one password and, inside it, a "hidden" volume with a different password. If you are forced to reveal the key, you can open only the external volume as a decoy. The hidden volume is undetectable if it is configured correctly and used carefully.

1. Assistant > «Create volume» > «Create an encrypted file container».
2. Choose «Hidden VeraCrypt Volume» and “Normal Mode” to create it from scratch.
3. Create the outer volume first: define encryption, hash, size, password/key and format.
4. The wizard then creates the internal one: selects its encryption/hash, a smaller size than the external one, and sets its own password.

Important: Never fill the external volume beyond the reserved space of the hidden volume. If, for example, the external volume occupies 50 MB and the hidden volume 25 MB, it exceeds the 25 MB buffer and will corrupt the hidden area . Always maintain a buffer to avoid accidentally overwriting it.

Encrypt an entire USB flash drive (or a partition)

If you want the entire USB drive encrypted, the process is just as guided, although it will be formatted (unless you choose data preservation mode). This is useful when you're working with the entire USB drive as encrypted storage and don't want to manage individual containers.

1. Insert the USB, open VeraCrypt and choose «Create volume».
2. Choose «Encrypt secondary partition/drive» (not the system one).
3. Choose “Common VeraCrypt Volume” (or “Hidden” if needed) and continue.
4. Click on «Select device», select the partition of the pendrive (for example, E:) and accept.
5. The wizard offers two options: Create encrypted volume and format it (fast, erases everything) or “Encrypt partition while keeping data” (slower, tries not to lose files).
6. Choose encryption and hash (AES + SHA‑512/256 is a safe bet), define authentication by password and/or keyfile and press "Format".

Once the process is complete, Windows may display that the drive is "not accessible." This is normal: you must mount it from VeraCrypt using your password . When you do this, you will see two drive letters: the hardware drive letter (e.g., E:) and another for the mounted encrypted volume (e.g., F:). Always work with the drive letter mounted by VeraCrypt.

Encrypt system disk (boot under password)

For laptops or desktops with sensitive information, encrypting the Windows partition or the entire disk is a great precaution. However, be sure to create a backup beforehand and keep the rescue disk provided by the wizard, as it will allow you to regain access to your system in case of a problem.

1. Assistant > «Create volume» > «Encrypt the entire system partition/drive».
2. Choose mode Normal u Hidden (the latter creates a covert OS for coercive situations).
3. Decide whether to encrypt only the Windows partition or the entire disk.
4. If you have multiboot, specify it; if not, select "Single Boot."
5. Select encryption and hash, define your password and generate the rescue disk.
6. The wizard will run a test and, after restarting, will ask you for your password before loading Windows.

Regarding performance, with AES and AES-NI support, the penalty is minimal. In modern systems, encryption strengths are so high that even SSDs don't reach that ceiling . Therefore, AES is usually the default recommendation in most scenarios.

Alternatives on Windows: EFS, Keyed ZIP, and Utilities

If you only need to protect a local folder in Windows 10/11, the system integrates EFS ("Encrypt contents to secure data") accessible from Properties > Advanced. This option encrypts at the user level, so files open transparently when you're logged in.

For sharing one or a few password-protected files, 7-Zip is quick and easy: you create a ZIP/7z archive with AES-256 encryption and it's ready to send by email or upload to the cloud for added protection. It's not volume encryption, but for occasional use it works perfectly.

Other utilities like Anvi Folder Locker make it easy to password-protect and hide folders with a right-click. They're simple, but for truly sensitive data, a VeraCrypt volume or full disk encryption offers greater technical security.

Quick comparison: BitLocker (Windows Pro/Enterprise) is built-in and "turn it on and forget it"; it's ideal for encrypting your computer without any hassle, but it's proprietary. 7-Zip is suitable for individual packages with AES-256 encryption. VeraCrypt is the most flexible, open, and powerful option for containers and disks across multiple systems.

Protect a USB in Ubuntu with the Disks tool

If you work with Linux, Ubuntu includes the Disks utility which allows you to format and encrypt a USB drive using LUKS + Ext4 without installing anything else.

1. Connect the USB and open Discs; select your memory from the list.
2. Press the settings button and choose Format Volume.
3. Check Secure Erase if you want to overwrite with zeros (slow) and in Type select «Encrypted, Linux compatible (LUKS + Ext4)».
4. Enter a strong password (uppercase, lowercase, numbers, and symbols) and assign a label to the volume.
5. Balance "Format" and wait for it to finish. The duration depends on the size and speed of the USB.

When finished, you'll have a USB drive that, when connected to Ubuntu, will prompt for the password to mount it. This is a good alternative if your workflow is based on Linux and you want native LUKS compatibility.

When to Encrypt: Use Cases and Regulations

Encryption adds an effective barrier in many situations. If you upload documents to the cloud, hosting them encrypted beforehand reduces the impact of a potential breach on the provider. On shared computers, it prevents other users from snooping. And if malware does manage to get in, without the key it won't be able to read your sensitive information.

It's also crucial when accessing accounts: if an attacker steals credentials and accesses unencrypted files, the damage is greater. Having procedures in place to manage passwords and encryption keys limits the scope of incidents and integrates well with least privilege policies.

Legally, certain organizations must encrypt personal or particularly sensitive data (ideology, health, affiliations), comply with anti-money laundering requirements, or protect trade secrets. Historical regulations in Spain (the LOPD and subsequent developments within the framework of the GDPR) require robust measures, key management, and procedures for handling cryptographic materials . Encryption is not always mandatory at all levels, but it is usually required at the most critical levels.

Finally, if you're someone who carries information on USB drives or external hard drives, the risk of loss is real. Encrypting these drives minimizes the impact in case of loss or theft, because without the key, the data becomes inaccessible to third parties.

Limitations and risks to keep in mind

The Achilles' heel of encryption is losing the key or key file: without them, there's no way out. Use password managers and secure (and redundant) backups of recovery keys. Also consider performance: encryption consumes resources, although with AES-NI the impact is very low on modern systems.

Consider compatibility: not all systems read all formats and containers. Plan ahead if you'll be moving between Windows, macOS, and Linux, and choose appropriate file systems (exFAT/NTFS for large files). Remember that corruption of an encrypted file can render it unrecoverable , so perform regular backups.

Some solutions rely on decryption software. Keep versions accessible and periodically check that your recovery process is working. A simple check can save you trouble if, months from now, you switch computers or operating systems and need to access old files.

If you put these tips into practice, you'll have the protection you've been waiting for: from portable containers to carry in your bag to complete password-protected drives, with an excellent balance between security, performance and ease of use in everyday life.