Encryption is the difference between hiding your files and actually protecting them. Three free or built-in tools do it properly, and they are not interchangeable — each one guards a different shape of problem.
If you have read the other pages in this set, you know the script lock's limit: the files stay readable, only the doorway is dressed up. Encryption reverses that. The data itself becomes scrambled, and no password readable anywhere, no rename trick, and no other operating system can open it. Here are the three routes worth your time, graded without sales talk — including the honest price each one charges in convenience.
Summary panel. Pick by the shape of the problem, not by which name sounds strongest.
BitLocker encrypts an entire drive or partition, including USB sticks with BitLocker To Go. It is the right answer for a laptop that leaves the office or a backup drive full of client data: pull the drive out, plug it into any other machine, and it is still sealed. The honest costs: full management needs a Windows Pro edition (many Home PCs have a limited "device encryption" cousin instead), and you must store the recovery key somewhere safe — Microsoft account, printout or office records — because a forgotten key means a lost drive. For a folder on one PC, BitLocker is a cannon; for a whole machine, it is the correct cannon.
VeraCrypt is the closest real equivalent of what the script lock pretends to be. It creates a container — a single file that, after you mount it with your password, appears as a new drive letter where you work normally. Dismount it, and it is unreadable noise again. It is free, works on every Windows edition, and has no plain-text password stored anywhere. Honest costs: you must remember to mount and dismount; the container's size is set when you create it (though it can be expanded with effort); and if the password is lost, the data is gone — that finality is the security working as intended. For "lock this one folder properly," VeraCrypt is usually the answer.
For files you are keeping or sending rather than editing daily, a 7-Zip archive is the simplest strong lock. Create a .7z archive, set a password, choose AES-256, and tick the option to encrypt file names too, so even the list of contents stays hidden. Honest costs: it is a snapshot, not a working folder — to change a file you extract, edit and re-archive; and anyone who copies the archive can attack the password offline at their leisure, so the password must be long and unique. Within those limits it is excellent, free, and the format travels anywhere.
And the rule that decides whether any of this works: a forgotten encryption password has no recovery page. Store every password and recovery key in a password manager or a sealed record. Encryption trades the script lock's fake safety for real safety, and the price of the trade is that responsibility.
See the locking script built and tested live, then decide honestly whether it is strong enough for your folder.
▶️ Watch Full VideoVeraCrypt, for most people. It creates an encrypted container that mounts as a drive letter with your password and behaves like a normal working folder, then seals completely when dismounted. It is free and works on all Windows editions, unlike BitLocker management which needs Windows Pro.
Yes. 7-Zip uses AES-256, a standard trusted worldwide, and can encrypt the file names as well as the contents. Its weakness is not the cipher but usage: the archive is a fixed snapshot, and a copied archive can be attacked offline forever, so it needs a long, unique password.
With real encryption, the data is normally unrecoverable — there is no readable password hidden anywhere, by design. This is the sharpest difference from a script lock. Always store encryption passwords and recovery keys in a password manager or another safe record before you rely on them.