How do I make sure a lost laptop or phone cannot be read?

A sign-in password stops someone using the computer. It does nothing at all to stop them taking the drive out and reading it in another machine, which takes minutes. Encryption is the difference between a lost laptop and a data breach.

Step by step

1. Set a passcode on every phone and tablet.On modern phones, encryption is tied to the passcode being set. Six digits or more is the sensible minimum; a four-digit code is guessable in a queue.
2. Check whether your laptop's drive is encrypted.Look for BitLocker or device encryption in Windows settings, or FileVault in a Mac's privacy and security settings. Some Windows editions and older machines have it off by default.
3. Turn it on and let it finish.The initial encryption can take an hour or more on a large drive. Keep the machine plugged in and let it complete before shutting down.
4. Save the recovery key properly.Both systems issue one. Print it, or store it in a password manager, or save it to your account — but not on the encrypted drive itself, which is the one place it is useless.
5. Set the device to lock quickly.Encryption only protects a device that is off or locked. A laptop left unlocked in a cafe is unprotected regardless. One or two minutes of inactivity is a reasonable setting.
6. Encrypt external drives and memory sticks too.This is where documents most often leave the house unprotected. Both operating systems can encrypt a portable drive, and the option is worth using for anything holding personal or financial records.
7. Turn on find-my-device.It adds remote locking and wiping, and on phones it also enables the activation lock that makes a stolen device worthless to resell.
8. Know what to do if it is lost.Mark it lost remotely, change the passwords for anything signed in on it, and report a theft to the police for the crime reference. Encryption means the data is safe; the accounts still need attention.

Tips

• Encryption has essentially no performance cost on modern hardware. There is no practical reason to leave it off.
• A work laptop is usually encrypted and managed by the employer. Check rather than assume, particularly on a personal machine used for work.
• Backing up is more important than ever once a device is encrypted: a forgotten passcode and a lost recovery key means the data is genuinely unrecoverable.

Common mistakes

• Storing the recovery key on the encrypted device — It exists precisely for the case where you cannot get into that device. Keep it on paper or in an account you can reach from elsewhere.
• Assuming a sign-in password is encryption — It is not. Anyone can remove an unencrypted drive and read every file in it on another computer without knowing the password.

If it doesn't work

Questions people ask