Jetico BestCrypt is file and folder encryption software for Windows. Its Container Encryption product keeps selected data inside encrypted container files, which open as virtual drives after authentication. This lets you work with protected documents in their usual applications while BestCrypt handles encryption as files are read and saved.
How BestCrypt containers work
A container holds its own collection of files and folders within a single encrypted file. When creating one, you choose its location, capacity and description. BestCrypt can manage several containers, so separate collections of documents can have separate storage and access credentials. Dynamic containers expand their storage allocation as data is added.
Once mounted, a container provides a drive through which applications can open, create and edit files. New and changed content is encrypted automatically when written back, without a separate encryption command for each document. Dismounting removes that virtual drive from normal access; reopening it requires authentication again.
Container files can reside on a local disk, removable storage or a network location, and can be stored through cloud services such as Dropbox. Compatible containers can also be accessed with BestCrypt software for macOS, Linux and Android. Compatibility depends on the container settings and authentication features used.
Password controls
BestCrypt offers several encryption algorithms, including AES-256. Password-based encryption can require a keyfile as well as a password. The selected file then becomes part of the credentials needed to open the container, so knowing the password alone is insufficient. Losing that keyfile also prevents access.
Advanced controls let you select a hash algorithm and adjust the number of iterations used to derive the key from a password. More iterations add work to password guessing attempts, while also increasing the time needed to mount the container. Header encryption conceals recognizable information in the container header. A separate keyboard filter operates in BestCrypt password boxes to interfere with utilities attempting to capture the typed password.
Public-key access for several users
Public-key encryption gives several people access to a container without distributing one shared container password. Each person has a public and private key pair. Their public keys can be added to the container, while each person retains the private key used to unlock access.
BestCrypt Key Manager can generate these pairs. An administrator can associate multiple recipients’ public keys with the same container, such as one kept on a shared network drive. The recipient’s private key remains necessary when opening it; receiving a copy of the container file does not by itself grant access.
Hidden containers
BestCrypt can create a hidden part within the free space of a visible container. The hidden part uses a different password, and the password entered determines which part opens. This allows a visible collection of files and a separate hidden collection to occupy the same outer container file.
More than one hidden part can be created. Existing hidden parts need validation before allocating another so that their space is accounted for. Writing additional files into the outer visible container can overwrite hidden data.
Data Shelter access policies
The included BestCrypt Data Shelter adds control over files while they are being used. It applies access policies to protected folders, allowing approved users, applications and processes to interact with the data and blocking unapproved requests.
Container editions and volume encryption
BestCrypt Container Encryption is commercial software with an evaluation trial. Standard provides container encryption for individual use. Enterprise adds centralized deployment and monitoring, user access management, and password recovery options for organizations managing multiple computers.
BestCrypt Volume Encryption is a separate product for encrypting disks and volumes. BestCrypt Suite combines container and volume encryption, so whole-drive protection belongs to that additional component rather than the standalone container product.
