The recovery key, not the cipher, decides whether disk encryption works

BitLocker, FileVault, LUKS2 and VeraCrypt all protect data on lost or stolen devices, but their effectiveness depends on how organisations configure, store and test recovery access.

Full disk encryption remains one of the most useful controls for stolen or lost devices, but its real value depends on how the keys are handled. The four mainstream options in 2026 are BitLocker for Windows, FileVault for macOS, LUKS2 through cryptsetup for Linux, and VeraCrypt across Windows, macOS and Linux. The strongest choice is usually not the one with the hardest cipher; it is the one that fits the operating system, the recovery process and the way an organisation manages access.

The basic security model is simple. Full disk encryption scrambles the contents of a drive so that a powered-off machine reveals nothing useful if the storage is removed, cloned or booted from elsewhere. Apple’s documentation describes this directly for FileVault, and the same principle applies to the other tools. The important limitation is equally clear: once the computer is unlocked and running, encryption at rest no longer protects data from malware, a hostile session or a user who has already been tricked into granting access.

That is why the practical differences between the four products centre on keys rather than algorithms. BitLocker and FileVault are tightly integrated with their operating systems and can be managed centrally, which makes them the natural default in corporate fleets. LUKS2 offers the most flexible keyslot model on Linux, while VeraCrypt is the most portable option when a single encrypted volume must work across different operating systems. Each tool also has its own trade-off between convenience and control.

Microsoft continues to position BitLocker as a Windows feature rather than a standalone product. On supported editions, manual BitLocker Drive Encryption is available on Pro, Enterprise and Education, while Windows Home can use Device encryption if the hardware qualifies. Microsoft’s documentation also distinguishes between automatic device-level protection and the more configurable enterprise mode. For higher-risk laptops, the key operational choice is whether to rely on TPM-only unlocking or to add a startup PIN, because the PIN creates an extra barrier before the TPM releases the key.

Recovery handling is the other major issue. Microsoft now shows a Microsoft account hint on the BitLocker recovery screen in Windows 11 24H2, which makes account security part of the encryption story for consumer devices. In managed environments, recovery keys are usually escrowed in directory services instead. The lesson is the same in either case: if someone else can reach the recovery secret, they can reach the data without breaking the encryption itself.

VeraCrypt remains the most independent option, but it asks the most of the user. Its appeal is that no vendor account is required and no central recovery copy is held by a platform provider. It also supports hidden volumes, which still matter for users who need plausible deniability. The price of that independence is operational discipline. If the password is forgotten, there is no safety net from Microsoft, Apple or a Linux distribution to restore access. Recent project notes also show that the software continues to evolve quickly, with security fixes and compatibility work landing in the latest release.

On Linux, LUKS2 remains the standard answer. The format stores metadata separately from the encrypted payload and supports multiple keyslots, which makes it suitable for passphrases, recovery secrets and hardware-backed unlock methods. That flexibility is especially useful on servers and shared workstations, where administrators need to add or revoke access without re-encrypting the disk. It also means that header backups matter. If the header is lost or damaged, the volume may be unrecoverable even when the data itself is intact.

FileVault is the most seamless choice on Macs, and Apple has pushed it closer to being automatic. According to Apple’s documentation, signing in with an Apple Account during Setup Assistant on macOS 26.4 or later turns FileVault on automatically. Apple also says the feature uses a 24-character recovery key and that internal storage on Apple silicon Macs and Macs with the T2 Security Chip benefits from hardware assistance. That makes FileVault easy to deploy, but it also means organisations need to know exactly where recovery keys are stored and who can retrieve them.

For most readers, the recommendation is straightforward. Use the encryption tool built into the operating system you already run, then configure it properly. That means BitLocker with a startup PIN on Windows, FileVault on macOS and LUKS2 on Linux. VeraCrypt is the better choice when cross-platform portability or deniability matters more than automation. In every case, the real control point is the recovery process: if that is not tested, documented and protected, encryption is only half deployed.