You have a folder on your computer with files you don't want anyone else to see. Tax returns. Medical records. Personal photos. Business contracts. A novel you're writing. Whatever it is, you need it locked.

The problem? Most "folder lock" methods you'll find online are security theater. They hide folders from view or set Windows permissions that any teenager with a Linux USB stick can bypass in 30 seconds. This guide covers 7 real methods, from quick-and-dirty to military-grade, so you can choose the right level of protection for your situation.

Method 1: Windows Folder Properties

This is the method most "how to lock a folder" articles recommend. It's fast, built into Windows, and requires zero downloads. It's also the weakest option by far.

Option A: Hide the Folder

1. Right-click the folder and select Properties
2. In the General tab, check Hidden
3. Click Apply, then OK

To view hidden folders again, open File Explorer, click View > Show > Hidden items. That's how easy it is to bypass. This is not security. It's obscurity.

Option B: Restrict with NTFS Permissions

1. Right-click the folder > Properties > Security tab
2. Click Edit, then select the user account you want to block
3. Check Deny for Full Control
4. Click Apply

Option C: Windows EFS (Encrypting File System)

Windows Pro editions include EFS, which encrypts individual files and folders using your Windows login credentials. Right-click the folder > Properties > Advanced > check "Encrypt contents to secure data".

EFS is better than plain permissions because it actually encrypts the data. However, it's tied to your Windows user account. If you reset your password or reinstall Windows without backing up your EFS certificate, your files are permanently lost. It's also unavailable on Windows Home.

Method 2: BitLocker Drive Encryption

BitLocker encrypts entire drives. You can't encrypt a single folder with BitLocker, you encrypt the whole partition. The workaround is to create a VHD (Virtual Hard Disk), encrypt it with BitLocker, and store your sensitive folder inside.

How to Create an Encrypted VHD with BitLocker

1. Open Disk Management (right-click Start > Disk Management)
2. Click Action > Create VHD
3. Choose a location and size (e.g., 10 GB), select VHDX and Dynamically expanding
4. Initialize the disk (GPT), create a new simple volume, and format it as NTFS
5. Right-click the new drive in File Explorer > Turn on BitLocker
6. Choose "Use a password to unlock the drive"
7. Save the recovery key (print it or save to USB, NOT to the same drive)
8. Choose AES-256 encryption and encrypt

Now you have a virtual encrypted drive. Move your sensitive folder inside. When you're done, right-click the drive in File Explorer and Eject it. To access it again, double-click the VHD file and enter your password.

Method 3: Mac Encrypted Disk Image

macOS has one of the cleanest built-in folder encryption methods of any operating system. You create an encrypted disk image (.dmg) that acts like a lockable container for your files.

Step-by-Step

1. Open Disk Utility (Spotlight > search "Disk Utility")
2. Click File > New Image > Image from Folder
3. Select the folder you want to lock
4. Choose encryption: 256-bit AES
5. Set Image Format to read/write (so you can add files later)
6. Enter a strong password. Uncheck "Remember password in my keychain" for maximum security
7. Click Save

Your folder is now inside an encrypted .dmg file. Double-click it to mount it (enter password), and eject it when done. The original unencrypted folder still exists, delete it securely after verifying your .dmg works.

Method 4: Mac FileVault

FileVault encrypts your entire startup disk. It's enabled by default on modern Macs with Apple Silicon (M1/M2/M3/M4). To check or enable it:

1. Open System Settings > Privacy & Security
2. Scroll down to FileVault
3. Click Turn On if it's not already enabled

FileVault uses XTS-AES-128 encryption. When your Mac is powered off or locked, the entire disk is encrypted. When you log in, it's transparently decrypted. This protects against theft but not against someone who has your login password or accesses your Mac while you're logged in.

FileVault vs. Encrypted Disk Image: Use FileVault to protect your whole Mac from theft. Use an encrypted .dmg (Method 3) to protect specific folders from people who share your Mac or have your password.

Method 5: Linux (LUKS & eCryptfs)

Option A: LUKS Encrypted Container

Similar to the BitLocker VHD approach, you create an encrypted container file and mount it as a virtual drive.

# Create a 1GB container file
dd if=/dev/zero of=~/encrypted-folder.img bs=1M count=1024

# Set up LUKS encryption
sudo cryptsetup luksFormat ~/encrypted-folder.img

# Open the encrypted container
sudo cryptsetup luksOpen ~/encrypted-folder.img my-secure-folder

# Create a filesystem inside
sudo mkfs.ext4 /dev/mapper/my-secure-folder

# Mount it
sudo mkdir /mnt/secure
sudo mount /dev/mapper/my-secure-folder /mnt/secure

# When done, unmount and close
sudo umount /mnt/secure
sudo cryptsetup luksClose my-secure-folder

Option B: eCryptfs (Per-Folder Encryption)

eCryptfs encrypts individual directories. It was the default for Ubuntu's encrypted home directory (before they switched to full-disk LUKS).

# Install eCryptfs
sudo apt install ecryptfs-utils

# Mount an encrypted folder
sudo mount -t ecryptfs ~/private ~/private

# You'll be prompted for:
# - Passphrase
# - Cipher (choose AES)
# - Key bytes (choose 32 for AES-256)
# - Plaintext passthrough (no)
# - Filename encryption (yes for max security)

Method 6: VeraCrypt (Cross-Platform)

VeraCrypt is the spiritual successor to TrueCrypt (which was mysteriously abandoned in 2014). It creates encrypted virtual drives that you mount and use like regular folders. It supports AES-256, Serpent, Twofish, and cascaded encryption (e.g., AES-Twofish-Serpent).

How to Create an Encrypted Volume

1. Download and install VeraCrypt
2. Click Create Volume
3. Select "Create an encrypted file container"
4. Choose Standard VeraCrypt volume
5. Pick a location and filename (e.g., my-secure-files.hc)
6. Select encryption: AES and hash: SHA-512
7. Set the volume size
8. Create a strong password (20+ characters recommended)
9. Move your mouse randomly for 30 seconds (generates entropy for key generation)
10. Click Format

To use it: open VeraCrypt, select a drive letter, click Select File, choose your volume, and click Mount. Your encrypted folder appears as a regular drive. When done, click Dismount.

VeraCrypt Hidden Volumes (Plausible Deniability)

VeraCrypt has a unique feature: hidden volumes. You create a volume within a volume, each with a different password. If forced to reveal your password, you give the outer volume password (which contains decoy files). The hidden volume with your real files remains undetectable. It's mathematically impossible to prove a hidden volume exists.

"VeraCrypt's hidden volumes provide the only credible plausible deniability system available to the public." — Electronic Frontier Foundation

Method 7: FilesLock (Browser-Based AES-256)

Every method above requires either a specific operating system, software installation, or command-line knowledge. FilesLock takes a different approach: encrypt files directly in your browser, with nothing to install.

How It Works

1. Go to FilesLock.com
2. Drag your files into the drop zone (or click "Select Files")
3. Enter a strong password
4. Click Encrypt
5. Download the encrypted .enc files

Your files never leave your device. FilesLock uses the Web Crypto API, the browser's built-in cryptographic engine, to perform AES-256-GCM encryption entirely on your machine. No data is uploaded to any server. You can verify this by turning off your internet connection before encrypting.

When to Use FilesLock vs. VeraCrypt/BitLocker

• Use FilesLock when you need to encrypt specific files quickly, before uploading to cloud storage, emailing, or sharing on a USB drive
• Use FilesLock when you're on a work or shared computer where you can't install software
• Use FilesLock on mobile devices (phones, tablets) where VeraCrypt isn't available
• Use VeraCrypt/BitLocker when you need a persistent encrypted workspace that stays mounted while you work

Encrypting an Entire Folder with FilesLock

FilesLock encrypts individual files. To encrypt a folder, first compress it into a ZIP archive, then encrypt the ZIP file. When you decrypt later, you get the ZIP back, which you can extract to recover all your files and subfolder structure.

Comparison: All 7 Methods

Method	OS	Cost	Security	Install?	Encrypts
Windows Properties	Windows	Free	Low	No	Nothing (hides only)
Windows EFS	Win Pro	$99+	Medium	No	Files/Folders
BitLocker	Win Pro	$99+	High	No	Full Drive
Mac Disk Image	macOS	Free	High	No	Folder → .dmg
FileVault	macOS	Free	High	No	Full Disk
LUKS/eCryptfs	Linux	Free	Very High	No	Disk/Folder
VeraCrypt	All	Free	Very High	Yes	Virtual Drive
FilesLock	All	Free	High	No	Individual Files

How to Choose the Right Method

Protect a folder from someone who shares your computer

Use an encrypted disk image (Mac) or VeraCrypt volume (Windows/Linux). These create a locked container that requires a password to open, even for admin accounts on the same machine.

Protect your laptop if it's stolen

Enable FileVault (Mac) or BitLocker (Windows Pro). Full-disk encryption ensures that even if someone removes your hard drive and puts it in another computer, they see only encrypted garbage.

Encrypt files before uploading to the cloud

Use FilesLock. Cloud providers like Google Drive, Dropbox, and OneDrive encrypt data in transit and at rest, but they hold the keys. Encrypting files client-side before uploading means only you can decrypt them. Read our complete Google Drive encryption guide.

Encrypt files on a phone or tablet

FilesLock is the only option on this list that works on mobile browsers. No app to install. Open the website, encrypt, done.

Maximum security with plausible deniability

VeraCrypt with hidden volumes. This is the only method that lets you credibly deny the existence of your encrypted data, even under duress.

Frequently Asked Questions

Can I lock a folder without any software?

On Windows, you can hide folders and restrict access with NTFS permissions, but this is not true encryption. Anyone with admin access or a Linux live USB can bypass it. On Mac, you can create an encrypted .dmg with Disk Utility, that's real encryption with no software to install. For a cross-platform solution without installation, FilesLock works directly in your browser.

What is the difference between locking and encrypting a folder?

Locking restricts access through the operating system (permissions, passwords). It can be bypassed by booting from a USB drive, using another admin account, or accessing the drive from another computer. Encrypting transforms the actual data into unreadable ciphertext using a mathematical algorithm (like AES-256). Without the password, the data is mathematically impossible to recover, even if someone physically removes the hard drive.

Is BitLocker free?

BitLocker is included with Windows Pro, Enterprise, and Education editions. It is NOT available on Windows Home, which is the version most consumer PCs ship with. You would need to upgrade to Pro (~$99) or use a free alternative like VeraCrypt or FilesLock.

Can police or government agencies unlock my encrypted folder?

If you use strong encryption (AES-256) with a long, random password, no one can decrypt your files without the password. The FBI famously spent 12 months trying to crack AES-256 encrypted drives in the 2008 Daniel Dantas case and failed. In 2016, the FBI paid $1.3 million to access an iPhone because they couldn't break the encryption directly. However, authorities may use legal means to compel you to provide your password (depending on your country's laws).

What happens if I forget the password?

With true encryption (AES-256), your files are permanently lost. There is no backdoor, no recovery option, no customer support that can help. This is by design, if there were a recovery mechanism, it would be a security vulnerability. Always store your encryption passwords in a password manager like Bitwarden, 1Password, or KeePass.

Can I encrypt a folder on my phone?

iOS and Android both encrypt your phone's storage by default when you set a passcode/PIN. For encrypting individual files or folders, FilesLock works in mobile browsers (Safari, Chrome). There's no app to install, just open the website, drop your files, and encrypt.

Is the .bat file method for locking folders safe?

No. You may have seen tutorials that use a Windows batch (.bat) script to "lock" a folder by renaming it with a CLSID to disguise it as a system item. This provides zero actual security. Anyone can view the script, find your folder, or simply enable "Show hidden files." It's the digital equivalent of hiding your house key under the doormat. Do not rely on this method for anything sensitive.

Does encrypting a folder slow down my computer?

Modern CPUs (Intel and AMD since ~2010) include AES-NI hardware acceleration, which means encryption and decryption happen at near disk speed. Full-disk encryption (BitLocker, FileVault, LUKS) typically has less than 5% performance impact. You won't notice it in daily use. Per-file encryption with tools like FilesLock or VeraCrypt has zero ongoing performance cost, you only spend time during the encrypt/decrypt operation itself.