BitLocker suits most Windows users and businesses, because it's built into Windows Pro, Enterprise and Education, works with the device's TPM and, through Device Encryption, can switch on automatically with your recovery key saved to your Microsoft account. VeraCrypt suits people who want free, open source encryption across Windows, macOS and Linux, encrypted file containers and hidden volumes for plausible deniability. If you need cross-platform or container encryption, choose VeraCrypt; otherwise BitLocker is the simpler option.
Encrypting a laptop is one of the simplest ways to protect client data if it's lost or stolen, and these two are the usual candidates. I read Microsoft's BitLocker overview and Device Encryption support page, and VeraCrypt's home, documentation and downloads pages.
BitLocker and VeraCrypt compared
| BitLocker | VeraCrypt | |
|---|---|---|
| Who makes it | Microsoft, built into Windows | AM Crypto, based on TrueCrypt 7.1a |
| Platforms | Windows only | macOS, Linux and Windows |
| On Home editions | Device Encryption on supported devices | Runs on any supported Windows |
| Hardware tie-in | Works best with a TPM | Hardware-accelerated encryption |
| Encrypted containers | Not covered on the pages I read | Virtual encrypted disk inside a file |
| Hidden volumes | Not covered on the pages I read | Hidden volume and hidden operating system |
| Licence | Part of Windows | Free and open source |
Your recovery key may already be in your Microsoft account
Microsoft's support page explains something many people don't realise. On supported devices, Device Encryption turns BitLocker on automatically for the operating system drive and fixed drives when you first sign in with a Microsoft account or a work or school account, and the recovery key is attached to that account. If you sign in with a local account, it isn't turned on automatically. Microsoft also says full BitLocker Drive Encryption is on Windows Pro, Enterprise and Education, while Device Encryption reaches a wider range of devices, including Windows Home.
Where BitLocker shines
BitLocker encrypts entire volumes to stop data theft from lost, stolen or decommissioned devices, and Microsoft says it gives maximum protection with a Trusted Platform Module, which checks the device hasn't been tampered with while it's offline. Because it's part of Windows, IT teams can switch it on across company laptops without installing anything, and it runs in the background.
Where VeraCrypt shines
VeraCrypt's site describes free, open source disk encryption for Windows, Mac OSX and Linux, from AM Crypto and based on TrueCrypt 7.1a. It can create a virtual encrypted disk inside a file and mount it like a real drive, encrypt a partition or the whole system drive, and offer plausible deniability through hidden volumes and a hidden operating system. VeraCrypt says it strengthens key derivation over TrueCrypt, using 500000 iterations by default for standard containers where TrueCrypt used at most 2000, and it can convert old TrueCrypt volumes.
That last point matters if anyone in your business still has old TrueCrypt volumes, because VeraCrypt says it fixes many vulnerabilities and security issues found in TrueCrypt. Its documentation also covers keyfiles, security tokens and smart cards, a portable mode that runs without installing, and a Rescue Disk for system encryption, which gives it more options than most people will ever need.
Which tool for which need
- Company Windows laptops managed by IT: BitLocker.
- A Windows Home laptop with a Microsoft account: check Device Encryption first.
- A USB drive you'll open on a Mac and a PC: a VeraCrypt container.
- Files that must stay deniable under pressure: VeraCrypt hidden volumes.
- Linux servers or desktops: VeraCrypt.
Encryption is one layer of protection, so read my explainer on how ransomware works and this guide to password-protecting a Word document for smaller jobs.
My advice on BitLocker or VeraCrypt
For a business running Windows, switch on BitLocker or Device Encryption and make sure every recovery key is stored somewhere the company controls, not only in one employee's personal account. Use VeraCrypt when you need encryption that travels between Windows, Mac and Linux, or a container you can carry on a USB drive. Whichever you use, test a recovery before you need one, because an encrypted drive without its key is gone for good.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Do you make security or encryption tools? Tool makers can ask to be considered for a featured place in comparisons like this one.
Frequently asked questions
Is BitLocker available on Windows Home?
Microsoft says BitLocker Drive Encryption is on Windows Pro, Enterprise and Education, while Device Encryption is available on a wider range of devices, including Windows Home.
Where is my BitLocker recovery key?
If Device Encryption turned on when you signed in with a Microsoft account or a work or school account, Microsoft says the recovery key is attached to that account.
Is VeraCrypt free?
Yes. VeraCrypt describes itself as free, open source disk encryption software.
Does VeraCrypt work on Mac?
Yes. VeraCrypt runs on Windows, Mac OSX and Linux.
What is a VeraCrypt hidden volume?
It's a volume hidden inside another encrypted volume, which VeraCrypt says gives plausible deniability if you're forced to reveal a password.
