A laptop can be lost or stolen in seconds. What happens next depends on how it was set up. This guide is part of our guide to securing your key accounts.

Why a login password is not enough

Your login password stops someone from sitting down and using your computer. But if a thief removes the drive and reads it in another machine, the password does not apply. Your files, browser data and saved logins can all be read.

Disk encryption fixes this by scrambling everything on the drive. Without the right key, the data is unreadable.

Turn on disk encryption

SystemFeatureWhere to find it
WindowsBitLocker or Device EncryptionSettings, then Privacy & security
MacFileVaultSystem Settings, then Privacy & Security
LinuxLUKSUsually chosen during install
PhonesBuilt inOn by default with a passcode

Windows Home may offer Device Encryption rather than the full BitLocker tool, depending on your computer.

Use a strong login

  • Use a passphrase of random words for your account password.
  • Windows Hello or Touch ID lets you log in with a fingerprint or face, which makes a long password less annoying.
  • Make sure the password is unique.
  • Set the screen to lock after a few minutes, and lock it manually when you step away.

Other useful settings

  1. Install updates automatically.
  2. Use a standard account for everyday work.
  3. Keep your firewall on.
  4. Turn on Find My Device or Find My Mac.
  5. Create a separate account for each family member.
  6. Back up to an external drive or an encrypted cloud service.

When you sell or dispose of a computer

Use the built-in reset option to erase it, and remove it from your accounts. With full disk encryption on, erasing the key makes the old data unreadable.

Encryption cannot stop everything

Encryption protects the drive when the computer is off. Once you log in, your files are open, so malware running on your account can read them. See keyloggers and password stealers. It also does not make storing a crypto recovery phrase on your computer a good idea.