A stolen laptop can be replaced; a stranger reading your documents, correspondence and passwords is much worse. Here is what each protection measure really does, what it doesn’t, and how to combine them.
- A Windows password guards only sign-in. The disk can be read in another PC or after booting from a USB stick.
- UEFI (BIOS) password: free, locks the boot settings.
- Boot password: Disk Password Protection stops Windows from starting, but encrypts nothing.
- Encryption protects the data itself: BitLocker for the system disk, Cryptic Disk for data partitions and external drives. Combine all three.
Why a Windows password is not enough
In each of these cases Windows doesn’t even start, so its password makes no difference:
1. UEFI (BIOS) password and no booting from USB
Free. In the laptop’s UEFI (BIOS) settings:
- set an administrator (supervisor) password;
- disable booting from USB and other external devices, or put the internal disk first in the boot order;
- keep Secure Boot turned on.
Without the password, nobody can change these settings.
2. A password before the operating system starts
Disk Password Protection asks for a password before the operating system starts (how to set it up).
- Windows won't boot without the correct password
- Also when the disk boots in another computer, and after the program is uninstalled
- Stealth mode: no prompt, the PC looks frozen
- Hides partitions until you remove the protection with the password
- BIOS and UEFI, MBR and GPT, x86, x64 and ARM64; UEFI modules signed with Microsoft UEFI CA 2023
- Encrypts nothing
- Booting from a USB stick skips the prompt
- The disk is readable in another PC
- Data recovery tools find hidden partitions
So combine the boot password with a UEFI password (step 1) and encryption (step 3).
3. Data encryption
Without the password or key, the disk looks like random bytes, even in another computer. Full comparison: encryption software for Windows.
BitLocker
- Built into Windows Pro, Enterprise and Education
- Encrypts the system disk and is fast
- Windows Home has only a simplified "Device encryption": compatible PCs, almost no settings (details)
- Without the recovery key, a hardware change or firmware update can lock you out
VeraCrypt
Free, open source, encrypts the system disk too. Harder to set up; beginners easily make mistakes.
Cryptic Disk
Cryptic Disk encrypts data partitions, external drives, USB sticks and container files.
- Transparent: mount with the password, use like any disk
- Hidden volumes hide that the data exists at all
- Key files and security tokens, instead of or with a password
- Hardware AES acceleration
- Portable mode: no installation, no traces in the system
- Can't encrypt the system partition
- Runs only on Windows
Keep important data on a separate partition or in a container, and encrypt the system disk with BitLocker if needed.
How to combine them
No single measure stops every threat. For most laptops:
Short checklist
Set a password and disable booting from external devices.
The BitLocker recovery key and the Cryptic Disk header backup belong in a safe place, not on this laptop. The header backup opens with the password valid when you saved it.
When travelling: in sleep mode encrypted disks stay mounted and the keys stay in memory. More on travelling with a laptop.
No limitations during the trial. Windows 11, 10, 8.1, 8, 7, Vista and XP.
Free Trial Pricing & Buy