Turn on your computer’s built-in disk encryption first (FileVault on a Mac, BitLocker or Device Encryption on Windows, LUKS on Linux). Then encrypt every copy that leaves the computer: use an encrypted external drive or a VeraCrypt container for backups, and gpg --symmetric or age -p for single files bound for the cloud.
Store the passwords and recovery keys in two safe places. Lose them and the files are gone for good.
Why genome files deserve encryption
Most personal files lose their sensitivity over time. A genome doesn’t. It can’t be changed like a password, it says something about your parents, siblings and children as well as you, and a whole-genome download usually lands in your Downloads folder as a handful of large, plainly named files. If a laptop is stolen, an external drive is lost, or a cloud account is breached, unencrypted files are simply readable.
Encryption fixes that by making the files unreadable without a password or key. There are four practical layers, and most people only need two of them: encrypt the computer’s own disk, and encrypt any copy that leaves it.
The options at a glance
| Approach | What it protects | Terminal needed? | Works across Mac, Windows, Linux? |
|---|---|---|---|
| Full-disk encryption (FileVault, BitLocker or Device Encryption, LUKS) | Everything on the computer when it is off or locked | No | Each is tied to its own system |
| Encrypted external drive | A backup drive if it is lost or stolen | No | Built-in options are mostly single-platform |
| Encrypted container (VeraCrypt, Mac disk image) | A folder-like vault you can copy anywhere | No | VeraCrypt: yes |
| File-level encryption (gpg, age) | One file, for sending or cloud upload | Yes | Yes |
Step one: encrypt the computer’s disk
This is the base layer. It protects your genome files along with everything else, and you set it up once through ordinary settings.
Mac: FileVault
Open System Settings, go to Privacy & Security, and turn on FileVault (you need an administrator account). Apple asks how you want to recover access if you forget your password: through your iCloud account, or with a recovery key you store yourself. Apple’s FileVault guide is blunt about the alternative: without your password or a recovery method, your files are lost for good.
Windows: BitLocker or Device Encryption
BitLocker Drive Encryption is available on Windows Pro, Enterprise and Education. Windows Home doesn’t include BitLocker, but many devices support Device Encryption, which you can find under Settings > Privacy & security > Device encryption if your device supports it. Device Encryption is tied to signing in with a Microsoft account or a work or school account, which is where the recovery key is backed up; it isn’t switched on automatically with a local account.
Linux: LUKS
LUKS is the standard disk-encryption format on Linux, and many distributions offer it as an option during installation. Adding it to a system that is already installed is a more involved job, so the easy moment is the next fresh install.
What full-disk encryption doesn’t do: it protects data on a computer that is off or locked. Once you are logged in, files are readable as normal, and any copy you move to a USB stick, email or cloud folder leaves that protection behind. That is what the next layers are for.
Encrypted external drives for backups
A backup drive is the copy most likely to be lost. Encrypting it with the built-in tools means erasing it first, so do this before you copy your files on.
- Mac: in Disk Utility, choose View > Show All Devices, select the drive, click Erase, pick GUID Partition Map and an encrypted format, then set a password (Apple’s steps). Choose APFS (Encrypted): Apple has said that encrypted Mac OS Extended volumes won’t be supported in macOS 28 and later.
- Windows Pro, Enterprise or Education: in the BitLocker settings, USB and external drives are listed under BitLocker To Go and can be encrypted there. Device Encryption on Windows Home covers the computer’s own drives, not removable ones.
- Linux: the Disks utility (GNOME Disks) can format a drive with the “Password protect volume (LUKS)” option. Windows and macOS can’t open such a drive without extra software.
- Mixed computers: if the drive has to work on more than one operating system, a VeraCrypt volume is the usual answer.
Encrypted containers: a portable vault
A container is a single file that behaves like a locked drive. Enter the password and it appears as a disk; eject it and it is just an unreadable file you can copy to a backup drive or cloud folder.
VeraCrypt is free, open-source and runs on Windows, macOS and Linux. Its beginner’s tutorial walks through creating a container inside a file and mounting it as a virtual disk. On a Mac you can also make an encrypted disk image without extra software: in Disk Utility choose File > New Image > Blank Image, pick an encryption option and a password. Either way, size the container generously; whole-genome files are large.
File-level encryption with gpg or age
This route needs a terminal, and it suits one specific job: encrypting a single file before you upload or send it. Both tools below use a passphrase, so there are no keys to manage.
GnuPG (gpg)
GnuPG is already part of common Linux distributions; on Windows and Mac you install it first, and the GnuPG download page lists installers such as Gpg4win. Then:
# encrypt (asks for a passphrase twice)
gpg --output genome.vcf.gz.gpg --symmetric genome.vcf.gz
# decrypt
gpg --output genome.vcf.gz --decrypt genome.vcf.gz.gpgThe GnuPG manual says current versions use AES-256 for symmetric encryption by default.
age
age is a smaller, newer tool with simpler commands. It installs through Homebrew on a Mac, winget on Windows, or the package manager on recent Debian, Ubuntu, Fedora and Arch.
# encrypt with a passphrase
age -p -o genome.vcf.gz.age genome.vcf.gz
# decrypt (age detects that a passphrase was used)
age -d -o genome.vcf.gz genome.vcf.gz.ageBoth tools leave your original file untouched. Encrypting a copy does nothing for the unencrypted original, which is one more reason the full-disk layer comes first.
Passwords, recovery keys and losing access forever
Strong encryption has no back door. If you lose the password, nobody can help: Microsoft says its support can’t retrieve or recreate a lost BitLocker recovery key, and the Linux cryptsetup manual puts it as “Mathematics can’t be bribed.” Your genome is irreplaceable unless you pay to sequence it again, so treat the keys as part of the data.
- Use a long passphrase you don’t use anywhere else, and keep it in a password manager.
- Store each recovery key (FileVault, BitLocker) somewhere other than the encrypted disk itself, plus a printed copy somewhere safe.
- Tell one trusted person where the recovery details are kept, if you would want your data to outlive a lost password.
- Test the restore: decrypt or mount a backup on another day and confirm the files open. Checking the decrypted file against its checksum proves it came back intact.
- For LUKS drives, the cryptsetup manual warns that a damaged header means the data is lost unless you backed the header up with
cryptsetup luksHeaderBackup.
Cloud backups: encrypt before you upload
Unless a service is end-to-end encrypted, the provider can read what you store, and so can anyone who gets into your account. For genome files, encrypt on your own computer first, so the cloud only ever stores an unreadable blob. Practical ways to do that:
- Upload a VeraCrypt container or a gpg/age-encrypted file rather than the raw files.
- If you script backups with rclone, its crypt remote encrypts before upload. Keep its password and config safe; without them the backup can’t be decrypted.
- If you use iCloud, Apple’s optional Advanced Data Protection extends end-to-end encryption to more of your data, and Apple can’t recover it for you if you lose your recovery methods.
Our genome storage and backup guide covers how many copies to keep and where.
A sensible plan for most people
- Turn on FileVault, BitLocker or Device Encryption, or LUKS on your next Linux install.
- Download your files and verify their checksums.
- Keep the backup on an encrypted external drive, or inside a VeraCrypt container if you use more than one operating system.
- Encrypt anything bound for the cloud before it leaves your computer.
- Store passwords and recovery keys in two separate places, and test a restore.
Encryption is one part of protecting genetic data; who you share it with matters as much. Our genetic privacy checklist covers the rest, and the raw file inspector reads files in your browser without uploading them, so it works with files you have decrypted locally.
Common questions
Is full-disk encryption enough on its own?
It protects files on a computer that is off or locked, which covers theft of the machine. It does not protect copies you move to a USB drive, email or a cloud folder, so encrypt those separately.
Can I use BitLocker on Windows Home?
BitLocker Drive Encryption is offered on Windows Pro, Enterprise and Education. Many Windows Home devices support Device Encryption instead, and VeraCrypt is a free cross-platform option for containers and external drives.
Do I need the command line to encrypt genome files?
No. FileVault, BitLocker, Device Encryption, Disk Utility, GNOME Disks and VeraCrypt all work through ordinary windows. Only file-level tools like gpg and age need a terminal.
What happens if I forget my encryption password?
Without the password or a recovery key, the data cannot be recovered. Microsoft says it can’t retrieve a lost BitLocker recovery key, and Apple warns that FileVault data is lost for good without a recovery method. Keep recovery details in a password manager and on paper in a safe place.
Which should I use for cloud backups, gpg or age?
Either is fine for a passphrase-encrypted file. age has fewer options and simpler commands; gpg is more widely installed, especially on Linux. A VeraCrypt container is the no-terminal alternative.
Keep going
Sources
Checked in October 2026: FileVault setup and recovery wording and Disk Utility steps from Apple Support, including Apple’s notice on encrypted Mac OS Extended volumes in macOS 28; BitLocker edition availability, Device Encryption and recovery-key policy from Microsoft; LUKS description and header warnings from the cryptsetup manual; GNOME Disks LUKS option from University of Edinburgh computing help; VeraCrypt container steps from its tutorial; gpg syntax and default cipher from the GnuPG manual and handbook; age syntax and install methods from its official repository; rclone crypt behaviour from rclone’s docs. We left out whether Windows Home can open BitLocker-encrypted removable drives and specific encryption strengths of Disk Utility’s options, because official pages we checked didn’t state them.
- Apple Support: Protect data on your Mac with FileVault
- Microsoft Support: Device encryption in Windows
- cryptsetup(8) manual page
- VeraCrypt Beginner’s Tutorial
- GnuPG manual: Operational GPG commands
- age: official repository and usage
Educational content, not medical advice. A genetic result is information, not a diagnosis; for anything medically important, talk to a qualified clinician or genetic counselor. Some outbound links are affiliate links; see the disclosure.