2026-08-04

Should you encrypt files before copying them to a USB drive or external SSD?

Copying a folder of files onto a USB stick or a portable SSD feels like the safe, offline alternative to leaving them in the cloud. It usually isn't, for a simple physical reason: a small drive that fits in a pocket is also small enough to leave on a train, a bar counter, or the back seat of a car. The question worth asking before anything gets copied over isn't whether the drive is convenient — it's what actually happens to the data inside it on the day the drive itself goes missing, because that day is common enough that real, dated cases answer it directly.

"Encrypt the drive" can mean two different things

Tools like BitLocker To Go (Windows) and FileVault-encrypted external volumes (macOS) encrypt the drive itself — the whole volume is unreadable without the disk password, but only for as long as the data stays on that specific, encrypted volume. The moment a file is copied off it — attached to an email, dragged into a cloud folder, moved onto a second, unencrypted drive to make a backup of the backup — it leaves as an ordinary, readable file. The protection lived on the volume, not in the file. File-level encryption works the opposite way: the file itself becomes unreadable ciphertext before it's copied anywhere, so it's still protected on the USB drive, still protected after it's emailed, still protected if it ends up on a second drive with no encryption of its own. Which one you actually need depends on what you're protecting against — but only one of the two survives the file leaving the drive it started on.

Three real losses, three different outcomes

The gap between those two approaches isn't theoretical. A 2009 study by the Ponemon Institute, sponsored by Intel and based on 138 actual lost-laptop cases across 28 US companies, put the average total cost of a single lost laptop at $49,246 — and found that a lost laptop with encryption cost a company about $40,000 on average, against roughly $60,000 for one without, according to The Register's reporting on the study. That's an old number, and it's presented here as exactly that — a widely-cited, specifically dated figure, not a claim about today's prices — but the direction it points hasn't needed updating: an unencrypted device costs meaningfully more once it goes missing, mostly because "missing" so often becomes "breach." A concrete, later example: on September 2, 2012, an employee of the Feinstein Institute for Medical Research had an unencrypted laptop stolen from a car, exposing 13,000 research participants' names, birth dates, Social Security numbers, and medical data. The resulting HHS settlement, reported by HIPAA Journal, cost the institute $3.9 million, and the government's own finding was specific: "the failure to encrypt data or use another reasonable security measure to safeguard ePHI, together with a lack of documentation supporting the decision not to encrypt." Compare both of those to what happened in Amagasaki, Japan, where a contractor lost a bag containing a USB drive holding personal data on essentially the entire city — about 460,000 residents' names, addresses, birthdays, tax records, and some residents' bank details — after a night out on June 20, 2022. According to CBS News's reporting, the city's own statement was that "the data was encrypted and the USB locked with a password," and officials said there was no sign the information had ever been accessed. Same category of event — a small piece of portable storage, gone, in someone else's hands for hours to weeks — with an outcome that split entirely on whether the data itself, not just the device, was protected.

A hardware feature is tied to one drive; a passphrase isn't

Some higher-end USB drives ship with their own hardware encryption — a built-in keypad, a companion app, a PIN. That's real protection, but it's protection scoped to that specific piece of hardware: replace the drive, and whatever files weren't separately backed up somewhere readable are gone along with it; lose the drive's companion app or its manufacturer stops supporting it, and recovering your own files can get harder, not easier. Encrypting the files themselves, with a passphrase only you hold, doesn't depend on any particular drive still existing or any vendor still supporting its software years later. The same encrypted file can sit on this USB drive, get copied to a replacement one next year, or get emailed to someone else entirely, and the same passphrase still opens it every time — the protection belongs to the file, not to whichever piece of hardware it currently happens to be sitting on.

Before anything gets copied to a drive

The practical version of all this is short: encrypt sensitive files before they touch the drive, not after, since a drive that's already been dropped somewhere can't be retroactively protected. Encrypt the actual documents — tax records, scanned IDs, medical files, anything with someone's name attached to financial or health information — rather than relying on whatever encryption feature the drive's manufacturer bundled in, since that protection stops the moment a file leaves the drive. And keep the passphrase somewhere other than a sticky note on the drive itself or a text file saved next to the encrypted files — the Amagasaki drive being both encrypted and locked separately with a password is part of why it held up; a passphrase traveling with the files it protects defeats the point entirely.

Where NearSeal fits into this

NearSeal encrypts files, not drives — which is exactly the layer of protection that travels with a file once it leaves whatever USB stick or SSD it started on. Drop in one file or a whole folder's worth at once, and each gets encrypted individually in the browser — nothing is uploaded anywhere — then bundled into a single .zip for download if there's more than one, ready to copy onto a drive as a batch. By default it derives an AES-256-GCM key from your passphrase via PBKDF2-SHA256 at 2²⁰ iterations; if you'd rather the files also open with the official age or rage CLI on some other machine years from now, not just this site, there's an opt-in age-encryption.org format instead (scrypt for key derivation, ChaCha20-Poly1305 for encryption). What NearSeal can't do is encrypt a drive's filesystem itself — there's no volume or full-disk mode here — or stop a USB stick from getting left somewhere. What it can do is make sure that when a small drive predictably does what small drives do, what's on it needs a passphrase nobody but you ever typed in, not a device's built-in feature that stops working the moment the file goes anywhere else.