System tower · floor

How to password protect a folder, and what Windows has instead

The honest starting point for how to password protect a folder is that the protections Microsoft documents do not work at the level of a folder. They work at the level of a drive, and on a good number of machines one of them is already switched on.

So the first useful move is not to install anything. It is to find out what is already true about the machine in front of you, because the answer changes what you should do next — and because a recovery key attached to an account you can no longer sign into is a problem worth discovering today rather than on the morning the disk asks for it.

There are two tiers, and Microsoft is unusually clear about which editions get which.

That distinction resolves a lot of frustrated searching. If you are on Windows Home and following a guide that says to right-click the drive and choose “Turn on BitLocker”, the command is not missing because something is broken — the edition does not have it. What Home has is Device Encryption, which does the same underlying job with fewer controls, and which is switched on automatically only under the account condition quoted above.

The three failure values are worth reading as a shopping list rather than a verdict. A TPM that is present but disabled in the firmware is a setting; Secure Boot disabled is a setting; a missing recovery environment is fixable. None of the three means the machine cannot be encrypted — they mean something has to be changed first, and the message names which thing.

Now the part where the original question deserves a direct answer rather than a redirection. If what you want is that one folder be unreadable to somebody else using this computer, the documented tools sit either side of it: whole-drive encryption protects everything against somebody who has the machine but not your sign-in, and file-level passwords — the kind Office documents and PDFs support — protect one file against everyone. There is no documented middle setting that puts a password on a folder in Windows.

Which is worth knowing before adopting one of the methods that circulate for this. A folder that is hidden is not a folder that is encrypted: hiding changes what a file browser displays, and the contents remain exactly as readable to anybody who looks properly. That is not an argument about any particular trick — it is what the two words mean, and it is the question to put to any method before trusting it with something that matters.

One last thing that applies whichever route you take, and that this island has already documented elsewhere: compressing encrypted files removes the encryption. Microsoft’s own advice on zipped folders is to avoid it, “which might result in unintentional disclosure of personal or sensitive information”. Protection and transport interact, and not helpfully.

The floors below take it four ways: what is already on, turning it on properly, protecting a single file instead, and the recovery key that decides whether any of this is survivable.

What this tower will not do

It will not give you a folder password. Microsoft documents drive-level encryption and file-level passwords; there is no documented setting between them.

It will not treat hiding as protecting. A hidden folder is displayed differently and read identically.

And it will not skip the recovery key. Encryption you cannot unlock is not protection, it is deletion with extra steps. What holds instead is simple: the two encryption tiers, the edition limits, the account condition and the four support values are quoted from Microsoft’s own documentation.