Encrypt Your Laptop and Your Backups: A Step by Step Guide

Encryption protects your data in two states: at rest on a device, and in transit across a network. Most people have neither turned on by default, and that gap is what turns a lost laptop or a hostile wifi network into a real incident. This guide walks through closing both gaps using tools you already have.

1. Write down what you are defending against. A lost laptop, a stolen backup drive, a cloud provider that can read your files, and a network eavesdropper are four different problems with four different fixes. Naming them first stops you from adopting complexity you do not need and skipping the basics that actually matter.
2. Turn on full disk encryption with the tool built into your operating system. LUKS on Linux, FileVault on macOS, BitLocker on Windows. For external drives or disks you move between machines, a portable container tool such as VeraCrypt covers the same ground. Threat: anyone who gains physical possession of an unencrypted drive can read every file on it in minutes by attaching it to another computer.
3. Verify encryption is actually active, then store the recovery key offline. Check the status in your system settings rather than trusting the checkbox you clicked during setup, because some updates and hardware changes can leave protection suspended. Print or write the recovery key and keep it somewhere that is not the encrypted disk. Threat: a silently disabled encryption state, and permanent data loss if the only copy of the key lives on the machine it unlocks.
4. Encrypt files before they go to cloud storage or email. Put them in an encrypted container, or encrypt them individually with GnuPG or age, and upload only the encrypted result. Threat: provider side access, account takeover, breach dumps, and legal requests that reach the provider instead of reaching you.
5. Treat every backup as a separate copy that needs its own encryption. Encrypt the backup drive or archive, keep it disconnected when not in use, and test a restore before you depend on it. Threat: a stolen backup drive is one of the most common ways an otherwise encrypted laptop leaks, and an untested backup is not a backup.
6. Encrypt data in transit. Use HTTPS everywhere, check the padlock and the exact domain name before entering credentials, and refuse plaintext protocols such as FTP, telnet and unencrypted HTTP. On untrusted networks, a trusted VPN adds a layer between you and the local observer. Threat: passive capture on shared wifi and interception anywhere along the path.
7. Keep passphrases and keys separate from the data they protect. Use a password manager for passphrases, never reuse your disk passphrase on other services, and do not leave the container password in a note on the same machine. Threat: a single compromise cascading into every other account and device you own.

Recheck your encryption status after operating system upgrades, drive replacements and firmware updates, since these are the moments protection most often gets quietly turned off. Encryption is not a one time setup. It is a state you confirm.