Yes — you can fully encrypt a modern laptop in under fifteen minutes. On a Mac, FileVault is built in; on Windows, most editions include BitLocker device encryption, and the free open-source VeraCrypt covers everything else. Encryption converts the disk's contents to ciphertext that is unreadable without your password or a recovery key, so a stolen laptop yields hardware but not documents, photos, saved sessions, or tax returns. The one step that turns this from convenient to catastrophic-if-skipped is storing the recovery key somewhere other than the laptop itself.
What does full-disk encryption actually protect?
It protects data at rest: anything on the internal drive while the machine is off, sleeping with the screen locked on modern configurations, or in a thief's bag. Without the key, the drive's contents are indistinguishable from random noise — this is the same protection that lets airlines lose laptops without triggering breach notifications at many organizations. It does not protect data in use while you are logged in, does not stop malware you install yourself, and does not encrypt external drives unless you set that up separately. If a thief gets your laptop while it is unlocked and running, encryption is moot; the lock screen plus a strong account password is part of the same defense.
How do you turn on FileVault on a Mac?
Steps below match macOS Ventura and later; wording shifts slightly between versions.
- Open System Settings, then click Privacy & Security.
- Scroll to the FileVault section and click Turn On.
- Choose a recovery method: iCloud account unlock, or a manually generated recovery key. The iCloud option is the better default for most people — the manual key is a 24-character string that Apple cannot retrieve if lost.
- Confirm, then let the Mac run plugged in while background encryption completes. You can keep working; expect the initial pass to take from under an hour on Apple-silicon machines to several hours on older Intel models.
You will see FileVault report as on, and rebooting to the login screen before the disk unlocks becomes the normal behavior. That pre-boot password requirement is exactly the protection you wanted.
How do you turn on BitLocker on Windows?
The path differs by edition. On Windows 11 Home, device encryption is often already on; check first.
- Open Settings > Privacy & security > Device encryption (Home) or BitLocker (Pro). If the toggle reads On, you are done except for the key backup below.
- Sign in with a Microsoft account if prompted — Windows stores your recovery key in that account automatically, which is the least losable method available.
- On Pro editions without auto-encryption, select the system drive, click Turn on BitLocker, choose to save the recovery key to your Microsoft account, then run the encryption. New data is protected immediately; the full-disk pass runs in the background.
- Verify the key is retrievable: it lives at account.microsoft.com/devices/recoverykey, reachable from any browser. Visit it once now, while it is easy to fix.
BitLocker also encrypts removable drives on demand — right-click a USB drive and choose Turn on BitLocker. For files you carry on sticks and SD cards, that habit closes a common gap.
What about VeraCrypt or Linux?
Most mainstream Linux distributions offer full-disk encryption as an install-time option using LUKS, which is well regarded; enabling it after installation requires reformatting, so most users handle it during a reinstall. VeraCrypt, the successor to TrueCrypt, remains the free cross-platform choice for Windows editions without BitLocker, for encrypting individual partitions or containers, and for external drives used across operating systems. Its documentation walks through system encryption carefully; the same recovery-rule applies — print the rescue disk or key file and store it away from the machine.
What can go wrong, and how do you avoid it?
Three failure modes account for nearly all encryption disasters. First, the lost recovery key: a firmware update, motherboard repair, or forgotten password can demand the key, and without it the data is gone — not reset, gone. Back it up to your Microsoft or iCloud account and to printed paper in a drawer. Second, the unencrypted backup: encrypting the laptop while old Time Machine or File History drives sit unencrypted leaves the same data readable elsewhere; Mac and Windows both let you encrypt those backups, so switch that on. Third, the unlocked-laptop theft: set the screen to lock after a few minutes and require the password on wake and on boot, which keeps the disk sealed against the snatch-and-run scenario.
How do you know it worked?
Reboot and watch the sequence. On a Mac you should be asked for your password before the desktop appears. On BitLocker systems, the surest test is the management command line: an elevated prompt running the BitLocker status command reports protection status as on for the OS drive. If either machine boots straight to a desktop from cold without any password, encryption is either off or configured to unlock automatically — revisit the steps above until a password stands between a stranger and your files.
For more context, read How to set up a passkey and stop relying on passwords.
For more context, read hardware security key.
For more context, read email account hacked what to do.