VeraCrypt review — encrypted containers and disk encryption

VeraCrypt review

Who is this for? Anyone who wants to encrypt sensitive files on Windows, macOS or Linux — in a container or on a full drive. System disk encryption is already covered for most users by BitLocker or FileVault; VeraCrypt adds value for standalone containers, USB drives and hidden volumes.

VeraCrypt is the standard for file encryption and disk encryption on Windows, macOS, and Linux. It creates encrypted containers — files that are mounted as a drive — or encrypts complete partitions and USB drives. Open-source, independently audited, and free.

---

Two use cases

Encrypted container (recommended for beginners): VeraCrypt creates a file on your drive — say documents.vc. That file is an encrypted vault. You open it with VeraCrypt, enter your password, and it appears as a regular drive in your file explorer. Everything you store in it is automatically encrypted. Close the container, and the files are inaccessible without the password.

Full disk encryption: VeraCrypt can also encrypt a complete partition or external storage medium (USB drive, external disk). Useful for external drives with sensitive data that you travel with.

Note: for system disk encryption on Windows, built-in alternatives also exist — see comparison table below.

---

Comparison with built-in encryption

	VeraCrypt	BitLocker (Windows)	LUKS (Linux)	FileVault (macOS)
Open-source	Yes	No	Yes	No
Independently audited	Yes	No	Partially	No
Hidden volumes	Yes	No	No	No
Containers (loose files)	Yes	No	No	No
Cross-platform	Yes	Limited	Linux/macOS	macOS only
Built-in	No	Windows Pro/Enterprise	Most distros	macOS

BitLocker caveat: BitLocker is closed source and often integrates with Microsoft-account or enterprise recovery flows. For higher-risk use, many people therefore prefer VeraCrypt or LUKS.

---

Hidden volumes

VeraCrypt supports hidden volumes: one container with two passwords. Password A shows innocent files. Password B shows the actually sensitive files. A third party cannot prove a hidden volume exists.

This is relevant for journalists and activists or people storing sensitive information in jurisdictions with compelled decryption laws.

---

Audit

VeraCrypt 1.18 and its bootloaders were independently audited in 2016 by QuarksLab, funded by the Open Source Technology Improvement Fund (OSTIF). The audit found 8 critical, 3 medium and 15 low/informational issues — including keystrokes not being wiped after authentication, an AES implementation vulnerable to cache-timing attacks, and cryptographically unsound keyfile mixing. VeraCrypt 1.19 shipped shortly after and fixed the great majority of them, including all the critical ones.

That remains the last comprehensive independent audit. Since then the project has kept fixing issues as they are reported — most recently a hidden-volume weakness in versions 1.26.6–1.26.28, fixed in 1.26.29 (June 2026). The point is not that VeraCrypt is flawless, but that it is open-source, has been through a real public audit, and responds to findings — more than any closed-source alternative here can show.

---

Installation and use

VeraCrypt is available for Windows, macOS, and Linux (also as Flatpak). Download from the official site or the signed releases on GitHub. (The site moved from veracrypt.fr to veracrypt.io / veracrypt.jp after the lead developer relocated; the old address redirects.)

Creating a container:

1. Start VeraCrypt → “Create Volume”
2. Choose “Create an encrypted file container”
3. Set location and size (from 1 MB to hundreds of GB)
4. Choose encryption algorithm (default AES is fine)
5. Set a strong password
6. Random mouse movements for entropy
7. Container created — mount via VeraCrypt to use it

---

Caveats

Windows: forensic traces. If a VeraCrypt container has been mounted on Windows, registry and prefetch files may leave traces that the file was opened. For maximum protection: use on a live OS like Tails.

Forget password = lose data. Zero-knowledge also means: no recovery option. Store passwords in KeePassXC or another offline password manager.

Large password, slow mount. VeraCrypt intentionally uses slow key derivation (PBKDF2 with high iteration counts, and optionally Argon2id for non-system volumes since 1.26.29) to hamper brute force. Mounting takes a few seconds — this is a feature, not a bug.

Hidden volumes need a current release. A hidden-volume security issue in versions 1.26.6–1.26.28 was fixed in 1.26.29. If you created a hidden volume with an older version and rely on its deniability, recreate it on a current release and securely erase the old container.

---

Pros and cons

Pros

• Hidden volumes with two passwords — plausible deniability if compelled to decrypt
• Cross-platform: encrypted containers open on Windows, macOS, and Linux
• Open-source and independently audited (QuarksLab / OSTIF, 2016) — the critical findings from that audit were fixed in the next release
• Containers are just files — easy to back up, move, or store anywhere without special tools
• Intentionally slow key derivation (PBKDF2 high iterations) makes brute-force impractical

Cons

• Windows registry and prefetch files may leave forensic traces that a container was mounted — use Tails for maximum protection
• Forgetting the password means permanent data loss — no recovery option
• System disk encryption on Windows leaves BitLocker as a simpler alternative for most users who don’t need cross-platform or hidden volumes

Conclusion

For sensitive files stored on an external drive or that you want to protect against disk seizure: VeraCrypt is the standard. Open-source, audited, cross-platform. The learning curve is low if you only use containers.

Use VeraCrypt for files you want to store locally encrypted. Use Proton Drive for encrypted cloud storage.

---

Getting started

The step-by-step guide for creating a container is already in the Installation and use section above. Short summary: start VeraCrypt → Create Volume → Create an encrypted file container → choose location and size → AES + SHA-512 are good default settings → set a strong password (store it in KeePassXC) → move the mouse for entropy → container ready.

To open the container: start VeraCrypt, click Select File, choose your container file, click Mount and enter your password. The container appears as a regular drive.

---

Next step

Chosen VeraCrypt?

• KeePassXC review — store your VeraCrypt password offline; without this you lose the container if you forget it

Similar options

• Proton Drive review — zero-knowledge cloud storage as an alternative to local encryption
• iStorage datAshur Pro review — hardware-encrypted USB without software

Want to go further?

• Secure laptop guide — VeraCrypt as part of a secure desktop environment