Windows also ships with real encryption tools built in, so a third-party app isn't strictly required. What changes the picture is which edition of Windows you're running: on some editions there's no built-in folder-level option at all. Here's what's actually built in, and where it runs out.

Option 1: BitLocker (Whole Drive, Pro and Enterprise Only)

BitLocker, found in Settings > Privacy & security > Device encryption (or Control Panel > BitLocker Drive Encryption on Pro editions), encrypts an entire drive using AES, with either 128-bit or 256-bit keys in XTS-AES mode on modern Windows versions. It's built into Windows and free to use, but only on Windows Pro, Enterprise, and Education. Windows Home doesn't include BitLocker at all; it ships with a scaled-down Device Encryption instead, which only turns on automatically on hardware that meets specific requirements (a TPM chip and modern standby support), and only once you sign in with a Microsoft account.

Like FileVault on a Mac (see How to Encrypt a Folder on Mac for the Apple side of this same tradeoff), BitLocker only protects a drive at rest, while the PC is off or before you sign in. Once you're signed in, BitLocker-protected files are fully readable like any other file, because the whole drive decrypts together at sign-in, not folder by folder.

Option 2: EFS (Folder-Level, Also Pro and Enterprise Only)

For folder or file-level encryption specifically, Windows has the Encrypting File System (EFS) built into NTFS:

  1. Right-click the folder or file you want to encrypt, then choose Properties.
  2. On the General tab, click Advanced…
  3. Check Encrypt contents to secure data, then OK, then Apply.
  4. Choose whether to apply the change to the folder only, or to the folder, its subfolders, and files.

The result is genuine, on-disk AES encryption tied to your Windows user account: the file's contents are unreadable to anyone signed in as a different user, the same category of protection described in AES-256 Explained Simply.

The catch: EFS is a Pro, Enterprise, and Education feature too. Windows Home doesn't ship with EFS at all; there's no built-in folder-level encryption option on Home edition, only the whole-drive Device Encryption described above, and only on hardware that qualifies.

Where the Built-In Method Runs Out

  • Edition-gated. Both BitLocker and EFS are missing entirely from Windows Home, a large share of consumer PCs.
  • No mobile access. An EFS-encrypted file only decrypts normally when opened by the same Windows account on the same machine; it doesn't travel to a phone.
  • Recovery is account-bound. Lose access to the Windows account that encrypted the file (a reinstall, a new PC, a corrupted profile) and the file becomes unreadable without a certificate backup almost nobody makes; there's no separate recovery phrase.
  • No situational features. There's no equivalent to a decoy vault for a moment when showing something harmless matters more than refusing to unlock anything at all.
  • Single point of entry per file. There's no way to group a set of sensitive files behind their own separate PIN, distinct from the Windows login itself.

None of this makes BitLocker or EFS bad; where they're available, they're genuinely solid, free, and use real encryption. They just don't cover every edition, and they don't travel.

When a Dedicated Vault App Is Worth It Instead

A purpose-built vault app like Vaultine uses the same category of encryption (AES-256, generated on-device) but works the same way regardless of which Windows edition it's running on: its own PIN separate from the Windows login, a built-in viewer, the same vault reachable on iPhone, Mac, and Android too, and a Decoy Vault and Duress Vault for situations where being asked to unlock something is itself the risk.

The tradeoff is honest: on Pro, Enterprise, or Education editions with the right hardware, BitLocker and EFS are free and already there. On Windows Home, or for anything that needs to move between devices, a dedicated vault fills a gap the operating system doesn't cover at all.

The Short Version

On Windows Pro, Enterprise, or Education, BitLocker (whole drive) and EFS (folder-level) are real, free, built-in AES encryption, genuinely solid within their edition. On Windows Home, neither exists as a folder-level option, and that gap, plus the lack of cross-device access either way, is what a dedicated vault app actually fills: not a stronger lock, a more portable one.

Try the dedicated version, 10 files free, at vaultine.app.