# How to encrypt files: what it means, the best way for each situation, and free software that does it right URL: https://webvpn.org/encryption/how-to-encrypt-files/ Updated: 2026-09-13 What file encryption means, how to encrypt a file with a password on any system, the best free programs to encrypt files, and choosing between archives and containers. To encrypt files with a password, use a local program that supports strong encryption, such as 7-Zip on Windows, an encrypted disk image on macOS, or gpg or age on Linux, select AES-256 where the choice exists, and enter a long unique password that the program turns into the encryption key. File encryption means transforming a file's contents so that they are unreadable without that key; the file can still be stored or sent, but reveals nothing. The best way depends on the situation: an encrypted archive for a few files to send, a VeraCrypt container for many files you use regularly, a per-file vault such as Cryptomator for cloud storage, and full disk encryption for a whole device. File encryption is the most flexible protection you can apply to data, because it travels with the file wherever it goes. It is also where people make avoidable mistakes, from weak passwords to online encryption sites. This guide explains what encrypting a file means and how it works, the three shapes encryption takes and when each fits, the best free software for each platform with links to the detailed guides on this site, and the mistakes that make encrypted files less safe than they look. ## What file encryption means A file is a sequence of bytes. Encrypting it runs those bytes through a cipher, a mathematical function that combines them with a key to produce a new sequence that looks random. Without the key, the output cannot be turned back into the original; with it, decryption reverses the transformation exactly. Modern tools use AES, described in the AES guides on this site, or ChaCha20, and both are considered unbreakable by direct attack at the key sizes in use. When you encrypt with a password, the tool does not use the password as the key directly. It derives a key from the password through a slow function designed to make guessing expensive, and encrypts the file with that derived key. This is why the password's strength determines the file's safety: the cipher cannot be broken, but a short or reused password can be guessed. Some tools instead encrypt to a public key, as PGP does, so no password travels at all; the PGP guides on this site explain that model. Encrypted files can be copied, emailed, uploaded and backed up like any file. They protect the contents, not the fact that a file exists, and not its size or, unless the tool hides it, its name. ## Three shapes of file encryption Every file encryption tool produces one of three things. An encrypted archive or single file. You take a file or folder and produce one encrypted output, such as a 7z archive, a .gpg file or an .age file. Good for sending, for archiving files you rarely open, and for backups. To edit the contents you decrypt, change and re-encrypt. An encrypted container. A file of fixed size that mounts as a virtual drive when unlocked, with VeraCrypt as the standard tool. Good for a working set of files you open and edit regularly, since applications use them normally while the container is mounted and everything is protected once it is dismounted. Poor for cloud sync. The VeraCrypt guides on this site cover it. A per-file vault. A folder in which each file is encrypted individually and transparently, with Cryptomator as the standard tool. Good for cloud storage and for phones, as the cloud encryption guide on this site explains. It combines the convenience of a container with the sync behaviour of individual files. Full disk encryption, covered in its own guide, is the fourth layer: it protects every file on a device while it is powered off, and does not replace any of the above for files that leave the device. ## How to encrypt a file with a password: the general steps - Choose the shape: archive for sending or storing, container for a working set, vault for the cloud. - Install the tool from its official source. Never use a website that offers to encrypt your file. - Generate a long password in your password manager, or a memorable passphrase of several unrelated words. Twenty characters is a reasonable floor for anything important. - Select AES-256 if the tool offers a choice, and enable file name encryption for archives if names are sensitive. - Encrypt, then verify by decrypting to a test location, especially before deleting originals. - Delete the unencrypted original if needed. Deletion is recoverable on most systems; secure erasure is difficult on SSDs and the reliable approach is to create sensitive files inside an encrypted container or on an encrypted disk from the start. - If sending, deliver the password through a different channel than the file, or encrypt to the recipient's public key so no password is needed. - Record where the password is, because encrypted files without their password are permanently lost. ## The best free software by platform All of the following are free and open source. - Windows. 7-Zip creates AES-256 encrypted archives with encrypted file names and is the standard answer for archives; VeraCrypt for containers; Cryptomator for cloud vaults; GnuPG through Gpg4win for PGP. The Windows guide on this site walks through 7-Zip and the built-in options. - macOS. Disk Utility creates encrypted disk images, the native equivalent of a container; the archive route needs a third-party tool or the command line, since Finder's compress does not encrypt; Cryptomator and VeraCrypt run natively; GPG Suite provides PGP. The Mac guide on this site covers each. - Linux. gpg and age from the command line encrypt files in one step; openssl can, with caveats; 7z and zip with AES are available; VeraCrypt and Cryptomator run on Linux; LUKS container files are a native alternative to VeraCrypt. The Linux guide on this site has the commands. - Cross-platform sending. age is small, modern and designed to avoid misconfiguration; GPG is universal; 7z archives open everywhere with free software. The PDF and email guide on this site covers documents specifically. - Phones. Cryptomator on Android and iOS; OpenKeychain on Android for PGP; the phone encryption guide lists more. Paid tools exist and some are good, but nothing on this list is missing a capability that the paid tools provide for personal use. ## What not to do - Do not use online encryption or decryption services. The site receives the plaintext, and possibly the password. - Do not rely on legacy ZIP encryption. The original ZipCrypto method is broken; choose AES-256 in 7-Zip or WinRAR, as the Windows guide explains. - Do not use office document passwords from old formats. Modern Word, Excel and PDF encryption is AES and acceptable; documents from older formats used weak schemes. - Do not send the password with the file. Same email, same chat, same cloud folder: any of these gives an interceptor both. - Do not assume deleting the original is enough. Recoverable remnants remain; encrypt at the source instead. - Do not lose the password. There is no recovery, and that is the point. - Do not trust a tool that does not name its cipher and key derivation. Reputable tools document exactly what they do. ## A seven-point checklist - Match the tool's shape to how the files are used. - Local, open-source software from the official site. - AES-256 or ChaCha20; encrypted file names when names matter. - A password of 20 or more characters, stored in a password manager. - Verify decryption before deleting originals. - Password and file travel by different channels, or use public-key encryption. - Back up the encrypted files and the password separately; both are needed and neither is recoverable. ## What security guidance and tool developers say The recommendations here follow published guidance and the tools' own documentation. Security agencies and standards bodies recommend AES-256 or equivalent for protecting stored files, recommend memory-hard or iterated key derivation for password-based encryption, and warn against legacy encryption schemes in older archive and document formats. The developers of 7-Zip, VeraCrypt, Cryptomator, GnuPG and age document their ciphers, key derivation and file name handling publicly, and each describes the situations its tool is designed for, which correspond to the archive, container and vault shapes described above. Security practitioners consistently advise against browser-based encryption services and against sending passwords alongside encrypted files, and identify weak passwords and lost passwords, rather than broken ciphers, as the practical failure modes of file encryption. ## Encrypt at the source and choose the right shape Decide whether your files are being sent, worked on or synced, pick the tool built for that shape, give it a password you would trust with everything inside, and encrypt on your own machine. The platform guides on this site turn each of these into exact steps, and once the habit forms, a file is protected before it ever leaves your device. ## FAQ Q: What does it mean to encrypt a file? A: Encrypting a file transforms its contents with a cipher and a key into data that is unreadable without that key. The file still exists and can be copied or sent, but its contents are meaningless to anyone who lacks the key, which is usually derived from a password you choose. Decrypting reverses the process. Q: How do I encrypt a file with a password? A: Use a local tool that supports strong encryption: 7-Zip on Windows, an encrypted archive or disk image on macOS, gpg or age on Linux. Choose AES-256 where offered, enter a long password, and delete or securely erase the original if it should no longer be readable. Send the password to any recipient by a different channel. Q: What is the best way to encrypt files? A: For a few files to send or store, an encrypted archive or a tool like age or GPG. For many files you work with regularly, a VeraCrypt container that mounts as a drive. For files in cloud storage, a per-file vault such as Cryptomator. For everything on a device, full disk encryption. The best way is the one that matches how the files are used. Q: What is the best free program to encrypt files? A: 7-Zip on Windows for archives, VeraCrypt on every desktop for containers, Cryptomator for cloud vaults, and GnuPG or age for single files and command-line use. All are free and open source. Built-in options such as macOS encrypted disk images and Windows BitLocker To Go are also free and adequate for many needs. Q: Is it safe to encrypt files online? A: No. A website that encrypts your file receives the unencrypted file, and you cannot verify what it does with it or the password. Encryption should happen on your own device with software you installed. The same applies to online decryption and password removal services.