How to Password Protect a Folder in Windows 11 (2026)

Windows 11 does not ship with a simple right-click "add a password" option for folders. Microsoft removed the old Desktop Gadgets, they never added folder password UI, and the built-in tools are scattered across different settings menus depending on which edition you have. So when you search "how to lock a folder on Windows 11" you get a confusing mix of answers — some that only work on Pro, some that encrypt a whole drive instead of a folder, and some that suggest third-party software of dubious origin.

This guide covers every method that actually works in 2026, in order from simplest to most secure, with honest notes on what each approach protects against and what it does not.

What you are actually protecting against

Before picking a method, it helps to know what you are trying to stop. Different threats require different tools:

• Someone else who uses the same PC with their own account — NTFS permissions or EFS both work.
• A family member or colleague with a local admin account — EFS or VeraCrypt. NTFS permissions alone are not enough because an admin can take ownership of any folder.
• Someone who steals or borrows your laptop — BitLocker (whole-drive) or VeraCrypt. If the drive is unencrypted and the attacker boots from USB, no folder-level protection survives.
• Archiving sensitive documents you rarely open — 7-Zip with AES-256 password is simple and very effective for this use case.
• Synced files on OneDrive you want an extra layer on — OneDrive Personal Vault adds 2FA on top of your Microsoft account.

Keep that in mind as you read through each option below.

Method 1: Encrypting File System (EFS) — Windows 11 Pro and above only

EFS is Windows' built-in folder encryption, available on Windows 11 Pro, Enterprise, and Education. It ties the encryption key to your Windows user account so the folder decrypts automatically when you are logged in — and is inaccessible to anyone else, including other admin accounts.

How to enable EFS on a folder

1. Right-click the folder you want to protect and choose Properties.
2. On the General tab, click Advanced.
3. Check Encrypt contents to secure data and click OK, then Apply.
4. Windows will ask whether to encrypt just the folder or the folder and all its contents — choose Apply changes to this folder, subfolders and files.
5. The folder name turns green in File Explorer to show encryption is active.

Critical step: back up your certificate. EFS uses a certificate tied to your user account. If you reinstall Windows without exporting this certificate first, you permanently lose access to your encrypted files. To export: press Win+R, type certmgr.msc, navigate to Personal → Certificates, right-click the certificate labelled "Encrypting File System", choose All Tasks → Export, and save the .pfx file to a USB drive or external location. Store it somewhere safe.

Limitation: Windows 11 Home does not support EFS. The checkbox will be absent or greyed out. Skip to Method 2.

Method 2: 7-Zip password-protected archive (all editions, free)

7-Zip is a free, open-source file archiver that supports AES-256 encryption — the same standard used by banks and governments. The workflow is: compress your files into an encrypted .7z archive, delete the originals, and the archive is unreadable without the password. This works on every Windows 11 edition including Home.

How to create a password-protected archive

1. Download 7-Zip from 7-zip.org (the official site; the installer is about 1.5 MB).
2. Right-click the folder or files you want to protect and choose 7-Zip → Add to archive.
3. In the Add to Archive dialog, set Archive format to 7z.
4. In the Encryption section, type your password in the Enter password field, confirm it, and make sure Encryption method is set to AES-256.
5. Optionally check Encrypt file names so the filenames inside the archive are also hidden.
6. Click OK. The encrypted archive is created.
7. Once you have verified the archive opens correctly with the password, delete the original unencrypted files (and empty the Recycle Bin).

Pros: free, works on all editions, AES-256 is extremely strong, portable across any OS with 7-Zip installed.
Cons: the archive is a static file — every time you want to add, edit, or open a file, you need to extract, modify, and re-encrypt. This friction makes it better suited for archiving than for folders you actively work in.

Method 3: OneDrive Personal Vault (all editions, free tier available)

If you use OneDrive — and on Windows 11 it comes pre-installed — the Personal Vault feature adds a second authentication layer on top of your Microsoft account. Files in the vault require a PIN, biometric scan, or email OTP to unlock, even if someone is already logged into your Windows account.

How to set up Personal Vault

1. Open File Explorer and navigate to your OneDrive folder.
2. You will see a Personal Vault entry. Click it to start the setup wizard.
3. Follow the prompts — you will verify your identity with a Microsoft Authenticator code, SMS, or email OTP.
4. Once unlocked, drag your sensitive files into the vault. The vault automatically locks itself after 20 minutes of inactivity (configurable in OneDrive settings).

Pros: no extra software, simple to use, files sync to the cloud with an extra authentication layer, Microsoft account 2FA applies.
Cons: free tier limits you to three files in the vault (a Microsoft 365 subscription removes this limit); requires a Microsoft account; files are stored in the cloud, which may not suit every privacy situation; requires internet for the initial unlock.
Who it is for: people who want a quick extra layer on a handful of specific files and already use OneDrive.

Method 4: VeraCrypt encrypted container (all editions, free, strongest option)

VeraCrypt is a free, audited, open-source encryption tool that creates a virtual encrypted disk — a container file that mounts as a drive letter in Windows. You work with files inside it like any drive, and when you dismount it, the entire container is inaccessible without the password. Unlike EFS, it is not tied to your Windows account — you can move the container to any PC with VeraCrypt installed and access it with your password.

How to create and use a VeraCrypt container

1. Download VeraCrypt from veracrypt.fr. It is free and open-source — the installer is about 35 MB.
2. Launch VeraCrypt and click Create Volume.
3. Choose Create an encrypted file container and click Next.
4. Choose Standard VeraCrypt volume and click Next.
5. Click Select File and choose where to save the container file — for example, C:\Users\YourName\Documents\secure.vc. Click Next.
6. Choose your encryption algorithm (AES is the default and perfectly adequate) and hash algorithm (SHA-512 is recommended). Click Next.
7. Set the volume size — for example, 2 GB for a folder of documents and photos. Click Next.
8. Set a strong password. Click Next.
9. Choose a file system (NTFS for files over 4 GB, exFAT for cross-platform use). Move your mouse randomly over the window for a few seconds to generate entropy, then click Format.
10. When done, click Exit to close the wizard.
11. Back in the main VeraCrypt window, select a drive letter slot, click Select File to choose your container, and click Mount. Enter your password. The container now appears as a new drive letter in File Explorer — copy your files in.
12. When finished, click Dismount in VeraCrypt. The drive disappears and the container is fully encrypted.

Pros: free, open-source, audited, cross-platform, works on all Windows editions, extremely strong encryption, no Windows account dependency.
Cons: more setup steps than other methods; requires VeraCrypt to be installed on every machine you want to access the container from; less convenient than EFS for everyday use.
Who it is for: anyone who needs the strongest protection for a sensitive folder — private keys, legal documents, financial records, anything you would not want accessed even if someone stole your laptop.

Which method should you use?

A quick decision guide:

• Windows 11 Pro, want seamless access, other users on the same PC: EFS — remember to export the certificate.
• Windows 11 Home, archiving documents you rarely open: 7-Zip with AES-256 and a strong password stored in a password manager.
• A handful of files in OneDrive, want a second auth layer: OneDrive Personal Vault.
• Maximum security, portability, works on all editions: VeraCrypt container.
• Whole laptop at risk of theft: BitLocker (Windows 11 Pro) or VeraCrypt full-disk mode — folder-level protection is not enough against a stolen drive.

The most common mistake is thinking that NTFS permissions (right-click → Security) are equivalent to encryption. They are not — a Windows admin account can take ownership of any folder, and booting from a USB drive bypasses permissions entirely. If you need genuine protection, use one of the encryption methods above.

For your everyday working environment, pairing a clean file structure with a solid File Explorer workflow and being thoughtful about what is actually on your disk goes a long way. Sensitive data in a VeraCrypt container, everyday files in a normal folder, and a password manager for your archive passwords — that setup covers the vast majority of real-world threats without requiring anything exotic.

If you are setting up a developer machine and want a broader workflow guide, see the Windows developer setup guide. For a general security and performance overview, the Windows 11 speed and cleanup guide covers the settings worth touching alongside security. And if you share a machine with family members and want to keep things separated, the virtual desktops guide covers how to keep work and personal contexts cleanly divided.

FAQ

Does Windows 11 Home support the Encrypting File System (EFS)?

No. EFS is only available on Windows 11 Pro, Enterprise, and Education editions. On Windows 11 Home, the "Encrypt contents to secure data" checkbox in Advanced Attributes is either absent or greyed out. If you are on Home, use 7-Zip with AES-256 encryption, VeraCrypt, or OneDrive Personal Vault instead.

What is the safest method to password protect a folder on Windows 11?

For most users, VeraCrypt is the strongest free option: it creates an encrypted container using AES-256 that cannot be accessed without your password — even if someone removes the hard drive. EFS is convenient but tied to your Windows user account. 7-Zip with AES-256 is very secure for archiving but produces a static file rather than a live folder. If you have sensitive work data, VeraCrypt or BitLocker (Pro editions, whole-drive encryption) are the gold standard.

If I reinstall Windows, will I lose access to my EFS-encrypted files?

Yes — unless you export your EFS certificate first. EFS uses an encryption certificate tied to your Windows user account. If you reinstall Windows without exporting the certificate, you will not be able to decrypt those files even if you use the same password. Before any reinstall, go to certmgr.msc → Personal → Certificates, right-click your EFS certificate, and export it with the private key to a safe location.

What happens if I forget my 7-Zip archive password?

7-Zip uses AES-256 encryption. There is no recovery mechanism and no backdoor. If you forget the password, the contents of the archive are permanently inaccessible. Keep your password in a password manager (Bitwarden, KeePassXC) rather than relying on memory alone.

How is VeraCrypt different from BitLocker?

BitLocker encrypts entire drives or partitions and requires Windows 11 Pro or higher. It integrates seamlessly with Windows login on devices with a TPM chip. VeraCrypt is free, open-source, and works on all Windows editions — it creates portable encrypted containers or volumes that can be moved across devices. BitLocker is more convenient for whole-drive encryption; VeraCrypt is better for a specific folder or file vault that needs to work on any machine.

Can I simply restrict a folder with Windows permissions instead of encryption?

You can set NTFS permissions to deny access to other user accounts on the same PC — right-click the folder → Properties → Security → Edit. This prevents casual browsing by other users logged in locally. However, it does NOT protect against: anyone with Administrator rights (they can take ownership), someone who boots from a live USB, or anyone who removes the drive. NTFS permissions are access control, not encryption. If you want real protection, use EFS, VeraCrypt, or 7-Zip.