Your game library, save files, and mods deserve better protection than a laptop bag zipper. If you carry a portable SSD between a desktop, a laptop, and a friend’s LAN party rig, anyone who picks up that drive can read everything on it unless it’s encrypted. This guide walks you through encrypting a portable SSD on Windows using BitLocker (built into Windows Pro, Enterprise, and Education) or VeraCrypt (free, works on Windows Home), how to verify the encryption took, and the mistakes that most often lock people out of their own drives. By the end, your drive will require a password or PIN before a single byte can be read, and it will still mount normally on any PC you trust.
Prerequisites: a Windows 10 or Windows 11 PC, your portable SSD, and roughly 20 to 45 minutes depending on drive size and whether you’re encrypting used space or the entire disk. Encryption does not delete data, but you should still back up the drive before starting — power loss mid-encryption is rare, but not worth gambling a Steam library on.
Before You Start
| What you need | Why | Optional? |
|---|---|---|
| Windows 10/11 Pro, Enterprise, or Education | BitLocker full-disk encryption is only included in these editions | No — unless you use VeraCrypt instead |
| Windows 10/11 Home users: VeraCrypt (free, from veracrypt.fr) | Provides equivalent AES-256 encryption with a password prompt on every mount | No — Home cannot run BitLocker on removable drives |
| A backup of anything important on the drive | Encryption is safe, but a backup removes all risk from the process | Strongly recommended |
| ExFAT or NTFS formatting on the drive | BitLocker-to-Go and VeraCrypt both work with either; FAT32 works but caps files at 4 GB, which breaks modern game installs | No |
| A Microsoft account or a printed recovery key location | BitLocker generates a 48-digit recovery key you must store somewhere that is NOT the drive itself | No |
| Steady power — a laptop plugged in, or a desktop during stable power | Interrupting the initial encryption at the wrong moment can force a lengthy repair or reformat | No |
| A USB flash drive or cloud storage for the recovery key | Gives you a second recovery path if your Microsoft account is unreachable | Yes, but wise |
Not sure which edition you have? Press Win + I, go to System → About, and read the “Windows specifications” section. If it says “Home,” plan on the VeraCrypt route in Step 3.
Step-by-Step
Step 1: Back up and format the drive (10–15 minutes)
Copy anything you want to keep to another location. Then press Win + X and choose Disk Management. Right-click the partition on your portable SSD, choose Delete Volume, right-click the unallocated space, and choose New Simple Volume. Format as exFAT (best if you also use the drive on macOS or consoles) or NTFS (best for Windows-only use and large game libraries). Use the default allocation unit size.
Undo: Formatting is the destructive step — restore your files from backup afterward. Double-check the drive letter in Disk Management before deleting; portable SSDs and SD cards look similar at a glance.
Step 2: Encrypt with BitLocker (Windows Pro and up, 15–30 minutes)
Open File Explorer, right-click your portable SSD under “This PC,” and choose Turn on BitLocker. If you don’t see that option, open Control Panel → System and Security → BitLocker Drive Encryption and click Turn on BitLocker next to the removable drive.
In the wizard:
- Choose how you want to unlock this drive: select “Use a password to unlock the drive.” Use a password of at least 12 characters; a four-word passphrase is easier to type on a couch or at a LAN.
- Back up your recovery key: choose “Save to your Microsoft account,” “Save to a file” (store it somewhere off this drive, such as
C:\Users\YourName\Documents\recovery-keys\), or “Print.” Do not skip this — this is the single most important click in the whole process. - Choose how much of your drive to encrypt: pick “Encrypt used disk space only” for a new or nearly empty drive (much faster); pick “Encrypt entire drive” if the drive ever held sensitive data you deleted.
- Choose which encryption mode: for a drive that moves between PCs, select New encryption mode (XTS-AES 256-bit) — the compatible fixed-disk mode matters less on removable media, and 256-bit costs little performance on modern CPUs.
- Click Start encrypting and leave the drive plugged in until it finishes. A 1 TB SSD typically completes in 15–30 minutes on used-space-only mode.
Undo: Right-click the drive in File Explorer and choose Manage BitLocker → Turn off BitLocker. The drive decrypts in place; no reformat needed.
Step 3: Encrypt with VeraCrypt (Windows Home, 20–35 minutes)
Download and install VeraCrypt, then plug in the SSD and make sure it’s mounted with a letter. In VeraCrypt, click Create Volume, choose Encrypt a non-system partition/drive, click Next, then choose Standard VeraCrypt volume.
- On the Volume Location screen, click Select Device, expand the list, and pick the partition entry for your portable SSD — verify the device name and size match your drive before continuing.
- On the Format Options screen, choose AES with SHA-512 as the hash algorithm. Set the filesystem to exFAT or NTFS to match Step 1. This formats the volume, which is why the backup mattered.
- Set a volume password of 12+ characters. Move your mouse randomly inside the window for at least 30 seconds to feed the random pool, then click Format.
- When formatting completes, mount it: select a drive letter in the main window, click Select Device, pick your SSD, click Mount, and enter your password.
The encrypted volume appears as a normal drive letter and behaves like any other disk until you dismount it. Click Dismount (or Dismount All) before unplugging.
Undo: In the Volume Creation Wizard, choose Encrypt a non-system partition/drive → Permanently decrypt a non-system partition/drive, select the device, and confirm. The drive is decrypted and reformatted in place.
Step 4: Enable auto-unlock on your own PC (2 minutes, BitLocker only)
Typing the password every time on your gaming desktop gets old. Plug in the drive, open an elevated PowerShell (Win + X → Terminal (Admin)) and run:
Enable-BitLockerAutoUnlock -MountPoint "E:"
(Substitute your drive letter.) The drive now unlocks automatically on this PC only; every other machine still demands the password.
Undo: Disable-BitLockerAutoUnlock -MountPoint "E:"
Verify It Worked
For BitLocker: open Settings → Privacy & security → Device encryption (or Control Panel → System and Security → BitLocker Drive Encryption) and confirm the removable drive shows “BitLocker on.” Then eject the drive, unplug it, and plug it back in — File Explorer should show a padlock icon on the drive and prompt for the password before any files are visible. Open the drive on a second PC to confirm the prompt appears there too.
For VeraCrypt: dismount the volume, then open the drive letter’s underlying device in File Explorer — you should see no recognizable files. If Windows ever offers to format the “raw” drive when it’s not mounted, that’s expected and correct; decline.
Finally, test your recovery key once: in BitLocker, choose “I forgot my password” at the unlock prompt and enter the 48-digit key. Finding out the key file is readable now beats finding out during an emergency.
Mistakes to Avoid
Storing the recovery key on the drive it protects. What causes it: the wizard makes “Save to a file” easy, and the default save location can end up on the mounted removable drive. How to check: open your saved key file and look at its full path. What to do: move it to an internal-drive folder or print it. How to undo: delete the copy on the SSD after relocating it.
Unplugging during initial encryption. What causes it: treating encryption like a background copy job and pulling the drive at 60 percent. How to check: BitLocker shows a percentage in the notification area; wait for “Encryption in progress” to disappear. What to do: if interrupted, leave the drive plugged in — BitLocker resumes on its own. If it won’t mount at all, use the recovery key. How to undo: worst case, reformat and restore from backup.
Formatting the wrong disk in Disk Management. What causes it: a 1 TB portable SSD and a 1 TB internal HDD can look identical in the volume list. How to check: right-click the volume → Properties, and compare the “Location” or capacity against the label on the physical drive. What to do: close Disk Management and reconnect only the target drive before proceeding. How to undo: deleted partitions are recoverable with test tools, but treat any accidental delete as a restore-from-backup event.
Forgetting the password because auto-unlock hid it. What causes it: auto-unlock works for months, the password fades from memory, then the drive goes to a friend’s PC. How to check: can you type the password from memory right now, without a hint sheet? What to do: test it on a second machine once a month. How to undo: if lost, the recovery key is your only path — which is why Step 2’s backup screen exists.
Assuming Home edition BitLocker will appear. What causes it: most tutorials assume Pro. How to check: no “Turn on BitLocker” option in File Explorer or Control Panel. What to do: use the VeraCrypt path in Step 3 rather than paying for an edition upgrade just for this. How to undo: not applicable — just pick the right tool the first time.
FAQ
Will encryption slow down my game load times?
Modern CPUs include AES hardware acceleration, so the overhead on a USB 3.2 or Thunderbolt portable SSD is typically small — a few percent at most in everyday use. You should not notice a difference loading games or moving files. If you’re on very old hardware without AES-NI, you may see reduced sequential speeds, but load times in games are dominated by seek patterns that SSDs handle regardless.
Can I use the encrypted drive on macOS, Linux, or a console?
A VeraCrypt volume can be read on macOS and Linux using the free VeraCrypt clients for those platforms. BitLocker-protected drives can be read read-only on recent macOS versions with third-party tools, and Linux can often mount BitLocker volumes via dislocker. Consoles cannot read either format — keep an unencrypted exFAT drive for Xbox or PlayStation media transfers.
What’s the difference between “encrypt used space only” and “encrypt entire drive”?
Used-space-only encrypts just the sectors holding current data, so it finishes in minutes on a fresh drive but leaves remnants of previously deleted files in the free space. Encrypting the entire drive covers every sector and takes much longer, but scrubs any old data. Choose used-space-only for a newly formatted drive; choose full-disk if the drive previously held files you’ve deleted.
I lost my BitLocker password and my recovery key. Can I get my files back?
No. BitLocker’s whole purpose is that the data is unrecoverable without one of the two. This is why the guide insists on backing up the recovery key to your Microsoft account and a second location before encryption begins. If both are truly gone, the only option is to reformat the drive and restore from whatever backup you made beforehand.
