Encrypted USB Drive: A Simple, Safe Backup You Control

An encrypted USB drive is the right home for the handful of files you cannot afford to lose and cannot afford anyone else to find. Seed phrases. A password database. Scans of your passport, your licence, your Medicare card. The things that are painful to replace and worse to have taken.

The trouble is that a USB stick is small, and small things go missing. It falls out of a bag. It sits in a drawer in a house you moved out of two years ago. It goes to the op shop in a box with the old laptop, and nobody thinks about it again until something turns up in someone else's hands.

So the question is not really whether the drive is encrypted. Most drives can be. The question is who can unlock it when it turns up somewhere you did not leave it.

What belongs on the drive, and what does not

An encrypted USB drive works best when it holds a small number of things very well, rather than everything you own badly. Ours are set up with that in mind, and the list is shorter than most people expect.

• Your KeePassXC database, the one file that holds every other password you have.
• Recovery phrases and wallet exports, written down once and kept off the internet entirely.
• Identity documents. Passport, licence, birth certificate, visa paperwork. The scans you need twice a decade and cannot replace in a hurry.
• Anything that exists in only one place. If losing it would genuinely hurt, it belongs here.

KeePassXC and an encrypted drive work as a pair. The database puts every password behind one passphrase, and the drive keeps that database somewhere that is neither the internet nor the machine it normally lives on. If your computer dies tonight, that pairing is what gets you back.

What does not belong on it is the work in progress. Files you touch every day should live on your computer, where they are quick to reach, and a backup drive that you are plugging in six times a day is a drive that is unlocked six times a day. The point of this one is that it spends almost all of its life locked and in a drawer.

One more thing, and it is the part people skip. A single backup is not a backup. Drives fail, houses flood, and things get left in hotel rooms. Two drives, kept in different places, is the smallest arrangement that actually protects anything.

How to encrypt a USB drive, the four real choices

Strip away the marketing and there are only four tools most people will ever meet.

• LUKS. Built into Linux. No extra software, no account, no company involved.
• VeraCrypt. A free program you install. Works on Windows, Mac and Linux.
• BitLocker. Microsoft's tool, built into Windows.
• FileVault. Apple's tool, built into a Mac.

Two of those are decided for you by the computer you already own. So the real decision, for anyone choosing rather than accepting a default, is between the first two.

LUKS vs VeraCrypt

Both are free. Both are open source. Neither has a company sitting behind it holding a key to your files. So the choice between them is not about which one is stronger, and anyone who tells you it is has skipped the part that matters.

LUKS is built into Linux itself. There is nothing to install and nothing to download, because it is already there. Plug the drive into a Linux Mint machine, click it in the file manager, type your passphrase, and it opens. That is the whole process, on any Linux machine, including one you have never used before.

VeraCrypt is a separate program. You install it, and then you can open your drive on Windows, on a Mac and on Linux. For a drive that has to move between all three, that is a real advantage and we are not going to pretend otherwise.

The catch is the word install. You need to be allowed to install software, and able to. A work laptop will usually refuse. A library computer will refuse. A friend's machine will let you, and now there is a copy of an encryption tool sitting on their computer with your name on the reason it got there. So VeraCrypt travels further than LUKS, but only to machines where you have that permission.

VeraCrypt also does one thing LUKS has no answer to. Its documentation describes hidden volumes, where one container holds a second, concealed volume, and where an unopened VeraCrypt volume looks like nothing but random data with no marking to identify it. The purpose is to give you something to hand over if you are ever forced to hand something over. LUKS cannot do this and does not try. A LUKS drive announces what it is to anyone who looks at it properly.

If that is the situation you are planning for, use VeraCrypt. We would rather send you to the right tool than sell you the wrong one.

For everyone else, and that is almost everyone, the daily reality decides it. A backup drive earns its keep by opening quickly, on the machine in front of you, without a download, an installer or an account. That is LUKS, and it is why our drives use it.

We are not the only ones who landed there. Writing in 2022, in a chapter of UnRedacted Magazine given over to Linux, the privacy researcher Michael Bazzell described moving his own external drives from VeraCrypt containers across to LUKS. He was careful to say the VeraCrypt advice still stood. His reason for the change was that LUKS needs no third party software to open a drive. The drawback he named was the same one we have just described, that you need a recent Linux machine to unlock it. He set his up through the Disks application, which is the same way we set up yours, and he noted that plenty of people keep both tools around.

Our call. For a drive that lives on Linux, LUKS is what we use and why we use it. If yours has to open on Windows or a Mac as well, VeraCrypt is the better tool, and we would rather tell you that than sell you the wrong one.

What Windows and Mac do with your key

Windows and Mac both encrypt drives, and both do it competently. The encryption is not the problem. Where the key ends up is.

For a lot of people those are sensible defaults. Forget your password and the key is waiting for you. It also means the key to your drive lives inside an account, and an account can be phished, breached, locked or closed. Whoever gets into the account can unlock the drive.

To be fair to both, neither hides the alternative. On Windows you can save the key to a file, to a USB stick, or print it on paper, and Microsoft support cannot retrieve or recreate a lost key for you, which tells you they take it seriously. On a Mac you can decline iCloud and hold the key yourself. The point is not that the option is missing. The point is which option happens by default, while most people click through.

None of this is a scandal and we are not going to dress it up as one. Microsoft and Apple are solving a real problem. People forget passwords and lose everything, and a key held in an account they can sign back into rescues them. For a lot of households that is a fair trade. It is just not the trade our customers came to us to make.

Why we encrypt the whole drive

Linux can encrypt a single folder rather than a whole drive, and on a computer that is a sensible thing to do. Your home folder sits behind your login, and everything inside it is protected while the machine is off. It is the right tool for that job.

A backup drive is a different job. Encrypting one folder leaves the rest of the drive open, so a file can be dropped in the wrong place and sit there unprotected without anyone noticing. On the encrypted USB drive we send out, the encryption covers the whole drive, so there is no wrong place to put a file.

How we set up your encrypted USB drive

Every drive is set up by hand before it is posted, and the process is the same one every time.

The whole drive is encrypted, not a folder on it, so there is no unprotected corner where a file can be dropped by accident. Inside, two folders are waiting. One for your KeePassXC database, one for documents. A copy of the written guide sits alongside them, and so does the small script that closes the drive down properly when you have finished with it.

The drive arrives with a starting passphrase, and the guide walks you through changing it to one only you know. That step takes about a minute and it is done through the Disks application, by pointing and clicking. There is no terminal and there are no commands to type. We tell you to change it because a passphrase we chose is a passphrase somebody else knows, and the whole point of the drive is that nobody else does.

The drive we configure and post is the encrypted LUKS USB drive, in two capacities.

There is an upside to that, and it is worth knowing. To someone who finds your drive and plugs it into a Windows machine, it looks like a blank or broken stick rather than something worth prying into. Most people would reformat it or throw it out, and either way your files are gone rather than read. That is not invisibility and we will not dress it up as such, because anyone examining the drive properly can tell it is encrypted. But the person who finds a USB stick in a car park is not examining anything.

Using it without thinking about it

Using an encrypted USB drive should take under a minute, and the routine is short on purpose. A backup you find annoying is a backup you stop making.

Three habits are worth building around that. Keep a second drive somewhere other than your house, because a fire does not care how good your encryption is. Never store the passphrase in email or in cloud storage, which is the one mistake that undoes everything else. And plug the drive in every few months just to confirm it still opens, because the worst time to discover a dead drive is the day you need it. If you ever think someone has had access to the drive, switch it out. Copy the files onto a fresh one and retire the old drive.

FreedomTech · The Privacy Experts · freedomtech.com.au