Disclosure: this guide contains affiliate links — see our affiliate disclosure.
If a USB drive will carry work documents, personal records, or anything you would not want a stranger to read, encryption is not optional. The question is what kind of encryption, and how much inconvenience you are willing to accept for it. Hardware-encrypted drives handle the protection on the drive itself, while software encryption relies on programs on each computer you use. Both can work, but they suit different people.
Hardware encryption is the simpler daily experience once it is set up. You unlock the drive with a password or PIN, use it normally, and lock it again when you remove it. The encryption does not depend on installing software on a borrowed or work computer, which is a real advantage when you move between machines. The trade-off is that forgetting the password usually means losing access to the data, by design, so password and recovery planning matter as much as the drive itself.
Hardware versus software encryption
Software encryption, such as an encrypted container or a fully encrypted volume created on your own computer, can be a good choice if you only ever use the drive on machines you control and you are comfortable managing the software. It costs nothing extra and can be applied to a drive you already own. Its weakness is portability: a computer without the right software, or without permission to install it, may not open the drive at all.
Hardware-encrypted drives avoid that problem, but they introduce their own rules. Some require a password of a certain length or complexity, some limit the number of wrong attempts before locking or wiping, and some offer a separate administrator password for organisations. Read those rules before you buy, not after you have loaded the drive, and test unlocking and locking on each computer you intend to use.
Encrypted drives worth considering
The Kingston IronKey Vault Privacy 50 is the hardware-encrypted drive to consider first in this guide. It is designed around password-protected hardware encryption, with a focus on protecting data if the drive is lost or stolen rather than on raw transfer speed. If your priority is confidentiality for work or personal files, that is the right priority order.
For less sensitive everyday files, a standard drive with software encryption may be enough, and a sturdy everyday drive such as the Samsung BAR Plus or the SanDisk Ultra Flair can carry an encrypted container for occasional sensitive files. That hybrid approach keeps daily use simple while still protecting the files that matter, but it only works if you actually use the container every time, not just when you remember.
A portable SSD can also be part of an encrypted setup, and the Samsung T7 is a common choice for larger encrypted libraries. Whichever form you choose, the drive is only one half of the system: the other half is a backup, because an encrypted drive that is lost, damaged, or locked out is no better than no drive at all for the files on it.
| Option | Best for | Watch out for |
|---|---|---|
| Kingston IronKey Vault Privacy 50 | Hardware-encrypted carry | Forgotten password can mean lost data |
| Samsung BAR Plus + software encryption | Occasional sensitive files | Only protects files placed in the encrypted area |
| Samsung T7 | Larger encrypted libraries | Needs a cable, larger than a flash stick |
Buying criteria for an encrypted drive
Choose a password you can remember without writing it on the drive, and store a recovery hint or recovery key somewhere separate from the drive itself, never in the same bag. If the drive offers a recovery or administrator option, decide who holds it before the drive is in daily use, and test the recovery path with non-critical files first.
Check compatibility before you commit. Confirm the drive unlocks on each operating system you use, and confirm whether unlocking needs any software on that system. A drive that works perfectly on one computer and refuses to unlock on another is a common and avoidable disappointment.
Finally, keep a second copy of anything irreplaceable, whether on another encrypted drive or in cloud storage such as pCloud or Backblaze. Encryption protects data from strangers; only a backup protects it from loss. You can identify an unknown drive with the tools on the download page, but no diagnostic tool can recover a forgotten encryption password.
Planning for a forgotten password
Every encrypted drive owner should answer one question before loading sensitive files: what happens if I forget the password? With hardware encryption, the honest answer is often that the data is gone, and that is the point of the protection. Accepting that in advance changes how you set the drive up. Choose a password you can recall reliably, practise unlocking the drive several times with non-critical files first, and store a backup of the data itself, encrypted, somewhere else.
For shared or work use, decide in advance who can reset or recover the drive, and whether an administrator password or recovery key exists. A drive that one employee alone can unlock becomes a problem when that person is away, and a drive whose recovery key is stored in the same bag as the drive is not really protected. These are organisational decisions, not technical ones, and they should be written down where the team can find them.
Encryption is not a substitute for care
An encrypted drive still needs the same care as any other drive: safe ejection, protection from heat and physical damage, and a backup. Encryption protects data from being read by someone who finds the drive; it does not protect data from being lost if the drive itself fails. Treating encryption as one layer, alongside backup and careful handling, is what makes it genuinely useful rather than a false sense of security.
Related buying guides
See also our guides to portable SSD upgrades, drives after a fake drive, and USB drives to avoid.