VeraCrypt is a free, open-source disk encryption program for Windows, macOS and Linux. It creates encrypted volumes that behave like ordinary drives once opened, and it can encrypt a whole partition, a USB stick or the Windows system drive. VeraCrypt grew out of the TrueCrypt code base and uses heavier key derivation settings by default.
How encrypted volumes work
Everything VeraCrypt protects lives in a volume, which stays encrypted at rest. You mount it with its password and any keyfiles, and it appears as a drive letter on Windows or a mount directory on Linux and macOS. VeraCrypt encrypts files just before writing them and decrypts them right after reading them. Other programs can therefore use them normally.
Decryption happens in RAM, one portion at a time. VeraCrypt does not write decrypted data back to disk. Encryption covers the whole file system, including file names, metadata and free space. Unmounting, restarting or a power loss closes the volume again.
Containers, partitions and devices
The VeraCrypt Volume Creation Wizard offers three targets:
- File container: a single file of a chosen size that mounts as a virtual disk and can be copied or backed up like any other file.
- Non-system partition or drive: a whole partition or device, such as an external disk or USB stick.
- System partition or drive: the partition Windows boots from.
You then pick an encryption and hash algorithm, set a password and choose a file system. Moving the mouse inside the wizard window feeds randomness into the generator that produces the keys. Windows offers FAT, exFAT, NTFS and ReFS, while Linux adds Btrfs and macOS adds APFS. A full format fills every sector with random data, so the amount of stored data cannot be seen.
The algorithm is fixed once the volume exists. VeraCrypt offers AES, Serpent, Twofish, Camellia and Kuznyechik, plus cascades that pass data through two or three ciphers in sequence, all in XTS mode. VeraCrypt spreads work across all processor cores, and AES uses the processor’s hardware instructions where available.
Encrypting the Windows system drive
System encryption covers the partition or drive where Windows is installed, including the temporary, paging and hibernation files Windows writes on its own. The VeraCrypt Boot Loader asks for the password before Windows starts. Encryption runs in place while you keep working. You can pause it and resume it after a restart. This feature is limited to 64-bit Windows on x64 hardware; elsewhere VeraCrypt handles non-system volumes only.
A VeraCrypt Rescue Disk uses USB for EFI systems or CD/DVD for older MBR systems. It can restore a damaged boot loader or key data and permanently decrypt the drive if Windows no longer starts.
Hidden volumes and deniability
A hidden volume sits inside the free space of another VeraCrypt volume, the outer volume. Because free space is filled with random data, the hidden volume looks like unused space. Each volume has its own password. The password you type decides which one opens: VeraCrypt tries the standard header first, then the area where a hidden header would be. You can disclose the outer password under pressure while sensitive files stay hidden.
Writing to the outer volume could overwrite hidden data. With hidden volume protection, you enter both passwords. VeraCrypt then blocks any write that would land in the hidden area, making the whole volume read-only until it is unmounted.
On Windows the same idea extends to a hidden operating system. The wizard clones the running system into a hidden volume and has you install a decoy system on the original partition. At the boot screen, one password starts the decoy and another starts the hidden system.
Keyfiles, tokens and PIM
VeraCrypt can also require keyfiles, which are any files whose first megabyte is combined with the password. A built-in generator creates random keyfiles. You can store keyfiles on PKCS #11 security tokens and smart cards protected by a PIN. You can add keyfiles to or remove them from an existing volume without affecting its data.
The Personal Iterations Multiplier (PIM) sets how much work goes into deriving the header key. A higher PIM makes guessing attacks slower but also slows mounting and booting. Values below the default are allowed only with passwords of at least 20 characters. A wrong PIM stops the volume from opening, so it works as a second secret.
Mounting and favorites
The main window lists drive letters and offers Select File, Select Device, Mount and Unmount. Auto-Mount Devices scans attached partitions for VeraCrypt volumes. Mount options include read-only access and using the backup header stored at the end of every volume if the main header is damaged. You can cache passwords and clear them with Wipe Cache.
Favorite volumes keep a volume’s drive letter, label and options. This lets the volume mount at Windows logon or when its USB drive is connected. VeraCrypt can also run in portable mode on Windows without installation, though administrator rights are still required. On Linux and macOS, a text-mode interface creates, mounts and lists volumes from the terminal.
