Nothing but a terminal and about five minutes. You do not need VeraCrypt installed to do the practical at the bottom of this page — it uses GnuPG, which ships with macOS and most Linux systems, and installs on Windows with Gpg4win from gpg4win.org.
You need no prior encryption knowledge. If you have never opened a terminal, that is fine: every command below is typed exactly as written, and the first step tells you which terminal to open.
🔴 Use a throwaway passphrase for the lab. You will deliberately type it wrong in step 4, and there is no recovery from a forgotten one — that is the whole point of the exercise. Do not practise with a passphrase protecting anything real.
What is VeraCrypt?
VeraCrypt is a free, open-source disk encryption tool. It creates encrypted containers (virtual encrypted disks) or encrypts entire partitions and drives. Your data is protected with strong encryption algorithms, accessible only with your password.
VeraCrypt is the successor to TrueCrypt and is available for Windows, macOS, and Linux.
VeraCrypt is ideal for protecting sensitive files on your computer, USB drives, or external hard drives. If your device is lost or stolen, encrypted data remains inaccessible.
Installing VeraCrypt
Windows
Linux (Ubuntu/Debian)
# Download the latest .deb package from veracrypt.fr, then:
sudo dpkg -i veracrypt-*.deb
sudo apt-get install -f # Fix any dependency issuesCreating an Encrypted Container
An encrypted container is a file that acts as a virtual encrypted disk. This is the easiest way to start with VeraCrypt.
my_vault)
There is no password recovery for VeraCrypt. If you forget your password, your data is permanently inaccessible. Store a backup of your password in a secure password manager.
Mounting and Using Your Container
To access your encrypted files:
The container now appears as a regular drive. You can copy files in and out normally.
When finished, always dismount the volume by selecting it and clicking "Dismount." This locks the container and protects your data.
Best Practices
- Always dismount when you are done working with encrypted files
- Back up your container file regularly (it is just a file you can copy)
- Use a strong, unique password that you store in a password manager
- Keep VeraCrypt updated for the latest security fixes
- Do not store the container on cloud storage without additional precautions, as partial syncs can corrupt it
Now Do It Yourself: Encrypt a File and Watch It Refuse the Wrong Key
VeraCrypt's container is a polished version of one idea: data that is unreadable without a passphrase. You can hold that idea in your hands in about five minutes, using a tool already on most machines — no installer, no reboot, nothing to undo. Do this first and VeraCrypt's wizard stops being a sequence of buttons and becomes a set of choices you understand.
Every output below was produced by running these exact commands on Linux. The VeraCrypt GUI steps earlier on this page are from its documented wizard and were not re-run for this page — treat them as a map, and this lab as the ground.
A note for anyone re-checking this page with an automated runner: it cannot drive this lab,
and that is expected rather than a defect. gpg asks for a passphrase on a terminal, so
a script with no tty gets Inappropriate ioctl for device; and every step assumes you
stayed in the folder you made in step 1, which a fresh shell per block does not. The
transcripts here were captured by hand, interactively, exactly as written.
Go: open a terminal. On Windows use PowerShell; on macOS or Linux use Terminal.
Do: create a folder and put two real-looking secrets in a file. Type these three lines, pressing Enter after each:
mkdir vaultlab
cd vaultlab
printf 'Bank: 1234-5678\nRecovery phrase: correct horse battery staple\n' > secrets.txtThen look at what you made:
cat secrets.txtYou should see: your two lines printed back, in plain readable text:
Bank: 1234-5678
Recovery phrase: correct horse battery stapleAnyone who opens this file — or steals the laptop it sits on — reads it instantly. That is the problem the rest of this lab solves.
If not: cat is not a Windows command. In PowerShell use Get-Content secrets.txt. If printf is not found on Windows either, create the file in Notepad instead — and in the Save dialog set Save as type to All Files, or Notepad silently saves it as secrets.txt.txt.
Go: the same folder.
Do: encrypt the file. This uses GnuPG, which ships with macOS and most Linux systems and installs on Windows with Gpg4win. It will ask for a passphrase twice — type something you will remember for the next five minutes:
gpg --symmetric --cipher-algo AES256 secrets.txtThen list the folder:
ls -l secrets.txt secrets.txt.gpgYou should see: a second file appeared, secrets.txt.gpg. Both files still exist — encrypting did not remove the original:
62 secrets.txt
141 secrets.txt.gpgSizes on your machine will differ slightly; the point is that both files are there.
If not: gpg: command not found means GnuPG is not installed. On Debian or Ubuntu: sudo apt install gnupg. On macOS with Homebrew: brew install gnupg. On Windows install Gpg4win from gpg4win.org. On a first run GnuPG prints lines about creating a .gnupg directory — that is setup noise, not an error.
Go: the same folder.
Do: print the first 60 bytes of the encrypted file as octal and characters, so binary data cannot scramble your terminal:
head -c 60 secrets.txt.gpg | od -c | head -4You should see: noise. No bank number, no recovery phrase, no English at all:
0000000 214 \r 004 \t 003 \n 005 334 313 9 024 252 q h 377 322
0000020 | 001 376 ' a 022 331 215 276 \t 314 201 j 240 L R
0000040 H " 236 276 356 357 v T 265 313 304 341 362 270 205 315Your bytes will be completely different from these — every encryption uses a fresh random salt, so the same file encrypted twice never produces the same ciphertext. That is by design.
If not: if you see readable words, you printed the wrong file. Check for the .gpg on the end. On Windows use Format-Hex -Path secrets.txt.gpg -Count 60 instead of od.
Go: the same folder.
Do: attempt to decrypt, and deliberately type a passphrase that is not the one you chose:
gpg -d secrets.txt.gpgYou should see: it refuses. There is no partial answer and no hint about how close you were:
gpg: encrypted with 1 passphrase
gpg: decryption failed: Bad session keyThis is the step most people skip, and it is the one that matters. There is no recovery. No support line, no reset link, no back door. Forget the passphrase and the file is gone — which is the same property that protects it from a thief.
If not: if it decrypted anyway, you typed the right passphrase by accident. Run it again and type deliberate nonsense. If your terminal shows no prompt at all, GnuPG is asking in a separate pinentry window — check for one behind your terminal.
Go: the same folder.
Do: decrypt with the correct passphrase:
gpg -d secrets.txt.gpgNow make a much larger file, encrypt it too, and compare the two encrypted sizes:
head -c 5000 /dev/urandom | base64 > big.txt
gpg --symmetric --cipher-algo AES256 big.txt
ls -l secrets.txt.gpg big.txt.gpgYou should see: your secrets printed back exactly, and then two encrypted files of very different sizes:
Bank: 1234-5678
Recovery phrase: correct horse battery staple
141 secrets.txt.gpg
5242 big.txt.gpg🔴 That size difference is the lesson. Encryption hides the contents of a file. It does not hide that the file exists, when you last touched it, or roughly how big it is. Someone who watches your encrypted folder learns that you keep something small and something large, and when each changed. This is exactly why VeraCrypt containers are a fixed size you choose up front — a container that never changes size leaks nothing when its contents do.
If not: /dev/urandom does not exist on Windows; use any large file you already have instead, such as a photo. If base64 is missing, skip it and encrypt the photo directly — the size comparison is the point, not the contents.
You encrypt a 2 GB video and a one-line note, then store both in the same folder. What can someone who steals that folder still learn without your passphrase? Answer: That you have two files, roughly 2 GB and roughly one line, and when each was last modified. Encryption protects the contents, not the existence, size or timing — which is why a fixed-size container hides more than a folder of encrypted files.
Now do it without the page: encrypt a folder rather than a single file: tar -czf notes.tar.gz notes/ then gpg --symmetric notes.tar.gz. Delete the plain .tar.gz, then recover the folder from the encrypted copy alone. If you can do that from memory tomorrow, you can use any container tool.
Summary
In this tutorial, you learned:
- What VeraCrypt is and when to use it
- How to install VeraCrypt on Windows and Linux
- Creating an encrypted file container step by step
- Mounting, using, and dismounting encrypted volumes
- Best practices for keeping your encrypted data safe
VeraCrypt earns its place when a drive has to open on Windows, macOS and Linux alike. If the drive will only ever be used on Linux, the system already has native encryption built into the kernel and there is nothing to install — see Encrypt a USB Drive with LUKS on Linux Mint for that route, command by command.
Even if someone gains physical access to your computer or drive, your VeraCrypt container remains locked without the password.