How to encrypt a USB flash drive with VeraCrypt: a complete practical guide

Informatec Digital » Security » How to encrypt a USB flash drive with VeraCrypt: a complete practical guide

Image: Encrypt a USB flash drive with VeraCrypt

Protecting a flash drive with strong encryption is one of those security habits that makes a difference in your daily life. With VeraCrypt, a free and veteran solution, you can create encrypted containers or protect entire drives with minimal hassle and with modern algorithms that guarantee confidentiality.

Although TrueCrypt was the benchmark for years, its development was halted and today its legacy lives on in VeraCrypt, which maintains the code, adds improvements and is available for Windows, macOS and Linux. If you want to protect your data from prying eyes at home, in the office or in the cloud, here is a complete guide with step by step, recommendations and alternatives.

Why choose VeraCrypt today?

A decade ago, TrueCrypt was the star tool for encrypting pendrives and disks, but in 2014 its authors stopped the project and the latest version (7.2) only allows decipher old volumes, without creating new onesFrom that fork, VeraCrypt was born, and development has continued, fixing bugs, auditing the code, and improving performance.

VeraCrypt is free, open, and cross-platform (Windows, macOS, Linux). In addition to transparency, it offers true compatibility with current devices and support for three very strong ciphers: AES, Serpent and TwofishIts code is accessible, which gives confidence to those who prefer software without black boxes or potential backdoors.

Another important reason is performance. With modern CPUs, AES encryption is accelerated thanks to AES-NI, which minimizes the penalty. On computers with this feature, read and write speeds can be much faster. easily exceed the performance of common units, so the encryption is virtually transparent in everyday use.

Download, installation and first setup

Download VeraCrypt from its official website: you'll find installers for Windows, macOS, Linux, and even the source code. It's 100% free, and if you prefer, you can opt for the portable version to carry it on your USB drive. use it without installation wherever you need it.

After installing it, it's a good idea to set the interface to Spanish. In Windows, go to "Settings" > "Language" and select "Spanish." This small detail makes things easier if you follow the steps in the guide and helps avoid configuration errors. encryption options or file systems.

Important Caution: If you're going to encrypt an entire USB drive or create a container within it, back up your data because some procedures cause formatting. Before booting, wipe the drive or remove anything you want to keep for later. import it into the encrypted volume.

Key features and effectiveness of encryption

VeraCrypt offers multiple ways to protect your information. You can create an encrypted container file that acts as a "virtual disk," encrypt a partition or the entire device (USB, SD card, external drive), and even protect the system partition so that the entire OS boots under encryption.

• Encrypted containers in a file: Ideal for easily moving data, sending it via email, or uploading it to FTP/Samba. You copy a single file, which, when mounted, behaves like any other drive.
• USB and SD card encryption: Encrypts the entire device or a partition. In Windows, you'll see a "format" prompt; don't do it. Mount with VeraCrypt using the password/key and you'll access it normally.
• System disk encryption: Similar to BitLocker, it encrypts the entire disk/SSD on your computer to protect your system, profiles, and documents.
• Real-time transparency: Encryption/decryption is done on the fly; you work as if it were a normal folder.
• Accelerated performance: If your CPU supports AES‑NI, the AES algorithm flies, improving reading and writing significantly.
• Hidden volume: An additional layer for duress scenarios; you can reveal a decoy password without exposing the sensitive area.

In pure efficiency, the combination of robust algorithms, frequent audits, and cross-platform flexibility make VeraCrypt a very reliable choice for users and businesses. Its ease of use has improved over the years, while maintaining advanced customization options for adjust encryption, hashing, and authentication according to your needs.

Pros and cons: the good and what you should know

Among its advantages, it stands out that it is free and open source, with support in Spanish, high security, and compatibility with Windows, Linux, and macOS. It also allows you to choose different algorithms and usage modes (containers, partitions, system), giving you the option to use them in a variety of ways. complete control over how to protect your data.

On the downside, it requires a bit of learning curve, especially if you want to take advantage of options like hidden volumes or encrypting entire drives. Additionally, for encrypting individual files, you may find it more practical to use password-protected compression (e.g., 7-Zip) if you're looking for more secure encryption. protect a couple of documents punctually.

Step-by-step guide: creating an encrypted container

This method creates a file containing your encrypted data, which, when mounted, appears as a new drive on your system. It's a convenient way to get started: it's portable, simple, and touch-free. the partition structure of memory.

1. Open VeraCrypt and click on «Create volume»The creation wizard will open.
2. Choose «Create an encrypted file container» and proceed with “Next”.
3. Choose Common VeraCrypt Volume (the standard) and continues.
4. Under "Volume Location", tap "Select File", navigate to your flash drive or other folder and give it a name (for example, “encrypted_data.vc”).
5. In "Encryption Algorithm" you can leave BEA (recommended for general use) and in “Hash Algorithm” the default value (SHA‑512) or SHA‑256 if you are looking for a good security/speed balance.
6. Define the container size (for example, 300 MB, 2 GB, etc.).
7. Choose the access method: password and/or key fileA strong password is usually sufficient, but you can take things to the next level by using key files.
8. If you activate "Use key file", click on «Key Files…» and then click "Generate." Move your mouse around the window for about 30 seconds and create the key file (this increases entropy). Save this file somewhere safe and non-obvious.
9. The assistant will ask you for the File System: If you need files larger than 4 GB, use exFAT or NTFS; if not, FAT is valid.
10. Click on "Format". When you're done, confirm with "OK" and close with "Exit."

If you prefer a more in-depth guide using the key-file approach, these steps are equivalent to those you'll see numbered in other guides (16-36): choose "Create an encrypted virtual disk", set path and name, confirm AES encryption, set size (e.g., 300 MB), enable «use key file», generate said file by moving the mouse to add randomness, save it in an unobvious location, add it to the key-files box, choose the format (NTFS if you are going to handle large files) and format the container before finishing.

Mount, use, and unmount the volume

With the container created, in the main window click "Select File", choose the container and an available drive letter. Then, click "Mount," enter the password—and the key file if you set one—and access the volume as if it were a normal disk.

Everything you copy inside will be encrypted on the fly, without any extra steps. When you're done, return to VeraCrypt and press "Dismount" or "Dismount all" to close the drive. This ensures that the volume remains inaccessible if you remove the flash drive or turn off your computer.

Hidden Volume: When and How to Use It

A hidden volume adds a layer of plausible deniability. You create an "outer" volume with one password, and inside it, a "hidden" volume with a different password. If you're forced to reveal the password, you can open just the outer one as a decoy. The hidden volume isn't detectable if it's been compromised. configured correctly and used with care.

1. Assistant > «Create volume» > «Create an encrypted file container».
2. Choose «Hidden VeraCrypt Volume» and “Normal Mode” to create it from scratch.
3. Create the outer volume first: define encryption, hash, size, password/key and format.
4. The wizard then creates the internal one: selects its encryption/hash, a smaller size than the external one, and sets its own password.

Important: Never fill the external volume to the extent that it exceeds the reserved space of the hidden volume. If the external volume takes up, for example, 50 MB and the hidden volume 25 MB, exceed the 25 MB buffer and you will corrupt the hidden areaAlways keep a buffer so you don't accidentally overwrite it.

Encrypt an entire USB flash drive (or a partition)

If you want the entire USB drive to be encrypted, the process is similarly guided, although it is formatted here (unless you choose data preservation mode). This is useful when you are working with the entire USB drive as encrypted storage and you don't want to handle loose containers.

1. Insert the USB, open VeraCrypt and choose «Create volume».
2. Choose «Encrypt secondary partition/drive» (not the system one).
3. Choose “Common VeraCrypt Volume” (or “Hidden” if needed) and continue.
4. Click on «Select device», select the partition of the pendrive (for example, E:) and accept.
5. The wizard offers two options: Create encrypted volume and format it (fast, erases everything) or “Encrypt partition while keeping data” (slower, tries not to lose files).
6. Choose encryption and hash (AES + SHA‑512/256 is a safe bet), define authentication by password and/or keyfile and press "Format".

Once the process is complete, Windows may show that the drive is "not accessible." This is normal: you should mount it from VeraCrypt with your password. When you do this, you'll see two letters: the hardware letter (e.g., E:) and the letter for the mounted encrypted volume (e.g., F:). Always work from the letter mounted by VeraCrypt.

Encrypt system disk (boot under password)

For laptops or desktops with sensitive information, encrypting the Windows partition or the entire disk is a great option. Make sure to create a backup beforehand and save the rescue disk suggested by the wizard, because in case of a problem, you can will allow you to regain access to the system.

1. Assistant > «Create volume» > «Encrypt the entire system partition/drive».
2. Choose mode Normal u Hidden (the latter creates a covert OS for coercive situations).
3. Decide whether to encrypt only the Windows partition or the entire disk.
4. If you have multiboot, specify it; if not, select "Single Boot."
5. Select encryption and hash, define your password and generate the rescue disk.
6. The wizard will run a test and, after restarting, will ask you for your password before loading Windows.

Regarding performance, with AES and AES-NI support, the penalty is minimal. On modern equipment, the encryption rates can be so high that not even SSDs saturate that ceiling. Therefore, AES is usually the default recommendation in most scenarios.

Alternatives on Windows: EFS, Keyed ZIP, and Utilities

If you only need to protect a local folder in Windows 10/11, the system integrates EFS ("Encrypt contents to protect data") accessible from Properties > Advanced. This option encrypts at the user level, so when you are logged in, the files are encrypted. open transparently.

To share one or a few files with a password, 7-Zip is fast and convenient: you create a ZIP/7z with AES‑256 and ready to be emailed or uploaded to the cloud with extra protection. It's not volume encryption, but for occasional uses, it works wonders.

Other utilities like Anvi Folder Locker make it easy to set passwords and hide folders with a right-click. They're simple, though for truly sensitive data, a VeraCrypt volume or full-disk encryption is a great option. provides more technical guarantees.

Quick comparison: BitLocker (Windows Pro/Enterprise) is built-in and "set it and forget it"; it's great for simple computer encryption, but it's proprietary. 7-Zip works for loose packages with AES-256. VeraCrypt is the most flexible, open, and secure option. powerful for containers and disks in various systems.

Protect a USB in Ubuntu with the Disks tool

If you're running Linux, Ubuntu includes the Disks utility that lets you format and encrypt a pendrive using LUKS + Ext4 without installing anything else.

1. Connect the USB and open Discs; select your memory from the list.
2. Press the settings button and choose Format Volume.
3. Check Secure Erase if you want to overwrite with zeros (slow) and in Type select «Encrypted, Linux compatible (LUKS + Ext4)».
4. Enter a strong password (uppercase, lowercase, numbers, and symbols) and assign a label to the volume.
5. press "Format" and wait for it to finish. The duration depends on the size and speed of the USB.

When you're done, you'll have a flash drive that, when plugged into Ubuntu, will prompt you for the mount key. This is a good option if your workflow is Linux-based and you want to native support for LUKS.

When to Encrypt: Use Cases and Regulations

Encryption adds an effective barrier in multiple situations. If you upload documentation to the cloud, hosting it pre-encrypted reduces the impact of a potential breach on the provider. On shared computers, it prevents other users from snooping. And if malware does get in, it won't be able to do so without the key. read your sensitive information.

It's also key when it comes to account access: if an attacker steals credentials and accesses unencrypted files, the damage is greater. Having procedures for managing passwords and encryption keys limits the scope of incidents and integrates well with least privilege policies.

At a legal level, certain organizations must encrypt personal or especially sensitive data (ideology, health, affiliations), comply with anti-money laundering requirements, or protect trade secrets. Historical regulations in Spain (LOPD and subsequent developments within the framework of the GDPR) require robust measures, key management, and procedures for manage cryptographic materialEncryption isn't always mandatory at all levels, but it usually is at the most critical levels.

Finally, if you carry information on USB drives or external drives, the risk of loss is real. Encrypting these drives minimizes the impact in the event of loss or theft, because without the key, the data remains hidden. inaccessible to third parties.

Limitations and risks to keep in mind

The Achilles heel of encryption is losing the key or keyfile: without them, there's no shortcut. Use password managers and secure (and redundant) copies of recovery keys. Also consider performance: encryption consumes resources, although with AES-NI the impact is minimal. very low in current equipment.

Consider compatibility: Not all systems support all formats and containers. Plan ahead if you'll be moving between Windows, macOS, and Linux and choose appropriate file systems (exFAT/NTFS for large files). Remember that corruption of an encrypted file can leave it beyond recovery, so make regular backups.

Some solutions rely on decryption software. Keep versions accessible and periodically check that your recovery process is working. A simple check can save you trouble if you change your computer or system months from now. and you need to open old files.

If you put these tips into practice, you will have the protection you expected at your fingertips: from portable containers to carry in your bag to complete disks under password, with an excellent balance between security, performance and ease of use in everyday life.