VeraCrypt
What it's for
The reference for local encryption: a whole disk, a partition, a USB stick, or an encrypted container (a file that mounts like a drive).
Why it matters
Nothing leaves your machine: no account, no cloud, no recovery key sent to a vendor. Free, audited, the successor of TrueCrypt. It is the local counterpart of Cryptomator, which is designed for the cloud.
For whom & when
On Windows, to replace BitLocker; everywhere, for an encrypted container or external drive. On Linux and macOS, the built-in encryption (LUKS, FileVault) is enough for the system disk.
In 2026 Microsoft is revoking the 2011 UEFI certificate authority that signed the old bootloader. If you encrypt the system disk, use version 1.26.29 or later, which ships bootloaders signed for both the 2011 and 2023 authorities.
Install & use
Download VeraCrypt from veracrypt.jp and check the file’s PGP signature or checksum.
Create a volume with the default settings (AES, SHA-512); Argon2id is offered since version 1.26.29.
- Choose a long passphrase (several random words), never reused.
- Advanced: create a hidden volume inside the volume for plausible deniability.