# VeraCrypt tutorial: encrypting files and folders in a container, step by step URL: https://webvpn.org/encryption/veracrypt-tutorial/ Updated: 2026-09-12 A VeraCrypt tutorial for beginners: create an encrypted container, password protect a folder, mount and dismount, back up the header, plus hidden volumes and keyfiles. To encrypt files with VeraCrypt, create an encrypted file container, mount it with your password so it appears as a drive, move the files or folders you want to protect into that drive, and dismount it when done, leaving a single file of unreadable data. This tutorial walks through creating a container, choosing its size and encryption, mounting and dismounting, backing up the volume header, and then the optional features: hidden volumes for plausible deniability, PIM for adjusting key derivation, and keyfiles including hardware tokens such as a YubiKey. VeraCrypt's interface dates from an earlier era of software and asks questions most tools hide, which makes a walkthrough useful. The what-is-VeraCrypt guide on this site explains the concepts; this one is the practical sequence, illustrated on Windows and identical in substance on macOS and Linux. ## Before you start Install VeraCrypt from the official site, veracrypt.fr, and verify the download signature as the platform guides on this site describe. Decide what you want to protect and roughly how large it is, since a container has a fixed size chosen at creation. Pick a passphrase now: long, unique, memorable to you, and stored in a password manager. VeraCrypt has no recovery; a lost passphrase is lost data. ## Step one: create an encrypted file container - Open VeraCrypt and click Create Volume. - Choose Create an encrypted file container and click Next. - Choose Standard VeraCrypt volume for now. Hidden volumes come later in this tutorial. - Click Select File, navigate to where you want the container, type a file name, and click Save. Choose any name; a .hc extension associates it with VeraCrypt on Windows, and a neutral name avoids advertising the file's nature. Do not select an existing file, which would be overwritten. - On the encryption options page, leave AES and SHA-512 unless you have a reason to change them. A cascade such as AES-Twofish-Serpent is stronger in theory and slower in practice; the what-is-VeraCrypt guide discusses the trade-off. - Set the volume size. Leave room to grow, since the size is fixed. On a drive with a FAT32 file system, containers over 4 GB are not possible; use NTFS, exFAT, APFS or ext4. - Enter the passphrase twice. VeraCrypt warns below 20 characters; aim for a passphrase you would trust with everything inside. The Use keyfiles and Use PIM options are covered later; leave them off the first time. - Choose the file system for the inside of the container. NTFS for Windows-only use, exFAT for a container that will open on Windows, macOS and Linux, ext4 for Linux only. FAT limits individual files to 4 GB. - On the format page, move your mouse randomly within the window for at least 30 seconds to gather randomness, then click Format. Larger containers take longer because VeraCrypt fills them with random data. - Click Exit when it reports success. ## Step two: mount the container - In the main window, select a free drive letter or slot. - Click Select File, choose your container, and click Mount. - Enter your passphrase, and the PIM or keyfiles if you set them, and click OK. - The container appears as a drive in File Explorer, Finder or your file manager. Use it like any drive. ## Step three: move a folder into the container VeraCrypt does not encrypt folders in place. To password protect a folder, move it into the mounted volume: drag it from its current location to the new drive. Copying leaves the original behind; moving deletes it, but deletion on most systems is recoverable, so for sensitive originals use a secure deletion tool afterward or, better, understand that the safest workflow is to create files inside the container from the start. Files saved into the mounted drive by any application are encrypted as they are written. ## Step four: dismount When finished, select the mounted volume in VeraCrypt and click Dismount, or Dismount All. The drive disappears and the container is unreadable again. Set VeraCrypt's preferences to auto-dismount on screen lock, sleep or after inactivity, and to wipe cached passwords on exit. A mounted volume is an open volume; malware or another user of the machine reads it as freely as you do. ## Step five: back up the header The volume header holds the encrypted master key. If it is damaged, the whole volume is lost even with the correct passphrase. VeraCrypt keeps an embedded backup header at the end of the volume, and you should also export one: Tools, Backup Volume Header, and save the file somewhere separate from the container. Store it as carefully as the passphrase, since together they open the volume. Restore through Tools, Restore Volume Header if a container refuses to mount with a header error. Also back up the container file itself. A container is one file; a disk failure loses all of it. Copy it to another drive or to cloud storage, remembering that container files sync poorly and per-file tools suit the cloud better, as the cloud encryption guide on this site explains. ## Hidden volumes A hidden volume lives in the free space of an outer volume. Create one by choosing Hidden VeraCrypt volume in the creation wizard, which first creates or uses an outer volume, then creates the hidden volume inside its free space with a different passphrase. Fill the outer volume with plausible decoy files. Mounting with the outer passphrase shows the decoy; mounting with the hidden passphrase shows the real data. The critical rule: writing to the outer volume can overwrite the hidden one, because the outer volume's file system does not know the hidden data exists. Whenever you mount the outer volume to add decoy files, use Mount Options and tick Protect hidden volume against damage, supplying the hidden passphrase, so VeraCrypt refuses writes that would collide. Hidden volumes serve a specific threat, coercion, and add complexity; use them only when that threat is real. ## PIM: Personal Iterations Multiplier VeraCrypt derives the key from your passphrase through a large number of hash iterations, which slows brute force. PIM lets you change that number. A high PIM, such as several hundred or more, makes each mount take longer and each attacker guess proportionally more expensive. A low PIM speeds mounting and is permitted only with a passphrase of 20 characters or more, on the reasoning that a long passphrase needs less stretching. If you set a PIM, you must enter it with the passphrase every time; forgetting it is as bad as forgetting the passphrase. For most users, the default, with PIM left blank, is appropriate. ## Keyfiles and YubiKey A keyfile is a file whose contents are combined with your passphrase to derive the key. Without the keyfile, the passphrase alone does not open the volume. Any file can serve, though VeraCrypt can generate random ones, and keyfiles must never change afterward, which rules out documents you edit. Keep keyfiles on a USB stick or hardware token separate from the container. VeraCrypt supports keyfiles stored on security tokens and smart cards through the PKCS#11 interface. A YubiKey can hold a keyfile in its PIV applet configured for this purpose, so mounting requires the passphrase, the physical key, and often its PIN. Setup involves installing the token's PKCS#11 library, pointing VeraCrypt to it in Settings, Security Tokens, and importing a keyfile onto the token. This is two-factor protection for a volume and it means that losing the YubiKey without a backup keyfile locks you out permanently, so keep a copy of the keyfile in secure offline storage. The security keys guide on this site covers the hardware. ## An eight-point tutorial checklist - Install from the official site and verify the signature. - Create a container with AES, SHA-512, room to grow, and the right internal file system for your platforms. - Use a passphrase of 20 or more characters stored in a password manager. - Mount, move files in, dismount; never leave a volume mounted unattended. - Export a header backup and keep it with the passphrase. - Back up the container file itself. - Add hidden volumes, PIM or keyfiles only once the basics are routine and the threat calls for them. - Keep VeraCrypt updated. ## What the project documentation says The steps above follow VeraCrypt's own documentation. VeraCrypt's user guide describes the volume creation wizard, the choice of ciphers and hash algorithms, the random pool gathered from mouse movement, the embedded and exported header backups, and the auto-dismount and cache-wiping preferences. The documentation explains hidden volumes and the requirement to protect them when writing to the outer volume, defines PIM and the minimum passphrase length for a low PIM, and describes keyfiles and security token support through PKCS#11. The project warns that it cannot recover lost passphrases, keyfiles or PIM values, and recommends header backups and tested container backups as the user's only recourse against corruption. ## Make the container, then make it a habit Your first container takes ten minutes, most of it moving the mouse. After that, mounting it is a passphrase and a click, and everything you put inside is protected the moment you dismount. Start with the basics here, and add hidden volumes or a hardware key from this same tutorial when your situation asks for them. ## FAQ Q: How do I encrypt a folder with VeraCrypt? A: VeraCrypt does not encrypt folders in place. Create an encrypted file container large enough for the folder, mount it as a drive, move the folder into that drive, and dismount. The folder is now inside the container and protected; the original location should be securely deleted. Q: What is a VeraCrypt container? A: A single file of a fixed size that holds an encrypted file system. When mounted with the password it appears as a drive letter or mount point and you use it like any disk. When dismounted it is a file full of what looks like random data, which you can move, copy or back up. Q: What file extension does a VeraCrypt container use? A: None is required. VeraCrypt containers can have any name and extension, or no extension. Some people use .hc for convenience, which associates the file with VeraCrypt on Windows; others use a neutral name so the file does not advertise what it is. Q: What is a VeraCrypt hidden volume? A: A second encrypted volume stored in the free space of an outer volume, with its own password. Because free space is filled with random data, its existence cannot be proven. Entering the outer password shows decoy contents; entering the hidden password reveals the real data. It is for situations where you may be forced to reveal a password. Q: What is PIM in VeraCrypt? A: Personal Iterations Multiplier, a number you can set that changes how many hash iterations derive the key from your password. A higher PIM slows mounting and brute-force attacks; a lower one speeds mounting with a long password. If you set a PIM, you must enter it every time you mount, along with the password.