File system encryption protects data at the level of individual files or folders, often giving each one its own key, rather than locking an entire drive behind a single secret. It powers much of the storage protection on modern phones and offers flexible options on desktop systems for people who share devices or need finer control.
This article explains how file-based encryption works, where it appears in Android, iOS, macOS, Windows, and Linux, how it compares with whole-drive protection, and what information it can still leave visible. Understanding those details helps you decide whether it fits your needs alone or alongside full disk encryption.
Encryption With a Finer Brush
Full disk encryption treats a whole volume as one sealed block. File system encryption works with a finer brush. The file system, which is the part of the operating system that organizes data into files and folders, encrypts each file’s contents separately, usually with a unique key for each file.
Those per-file keys are themselves protected by higher-level keys linked to a user, a folder policy, or a device state. When the right user signs in, the system can release that user’s keys while leaving other users’ files sealed. This separation is the main practical advantage of the approach.
Because encryption happens inside the file system, the operating system can make smarter decisions. It can keep certain system files available before anyone signs in, while keeping personal files locked until the owner authenticates. Whole-drive encryption, by contrast, generally opens everything at once.
How Per-File Keys Are Organized
Most file-based designs use a hierarchy of keys. At the bottom, each file gets its own content key. Above that, a policy or class key protects groups of files. At the top, a key derived from the user’s passcode or credentials, often combined with a hardware-protected secret, protects the class keys.
This structure has useful consequences. Deleting a single file’s key makes that file unreadable even if its encrypted contents linger on the drive. Changing a passcode only requires re-wrapping the higher-level keys, not re-encrypting every file. Different folders can follow different policies.
Hardware support strengthens the hierarchy. Phones and many recent computers include secure processors that hold keys and enforce limits on passcode guessing. When the user key depends on both a passcode and a device-bound secret, copying the encrypted storage to another machine does not allow fast offline guessing.
Revoking access also becomes more precise. An administrator can remove one user’s keys or retire one folder’s policy without re-encrypting the whole drive, which matters on shared systems where people join and leave over time.
Where File-Based Encryption Appears Today
File-level protection is more common than many people realize. It often runs automatically, especially on mobile devices, and desktop operating systems provide optional versions that administrators and power users can enable.
- Android file-based encryption: separates device-encrypted storage, available after boot, from credential-encrypted storage, available only after the user enters a PIN, pattern, or password.
- iOS Data Protection: assigns files to protection classes that determine when their keys are available, such as only while the screen lock is off or after the first successful sign-in.
- APFS on macOS: supports per-file keys within the Apple File System, working with FileVault and the Mac’s security hardware.
- Windows Encrypting File System: known as EFS, it encrypts selected files and folders tied to a user account on supported editions.
- Linux fscrypt: native encryption for ext4, F2FS, and some other file systems, applied to chosen directories, including home folders.
Each implementation has its own rules and limitations, and settings change between releases. Some are fully automatic, while others require deliberate configuration and careful key backup. Check the vendor or distribution documentation for the version you run before relying on any specific behavior.
File System Encryption Versus Full Disk Encryption
The two approaches are complementary rather than competing. Full disk encryption excels at protecting a powered-off device with one strong startup secret. File system encryption excels at separating data between users and controlling which files are available in different device states.
On a shared family computer, whole-drive encryption alone leaves every account’s files decrypted at the storage layer once the machine is running. File-level encryption keeps each person’s data sealed with keys tied to their own sign-in, so other accounts cannot simply read them while that person is signed out, though a malicious administrator remains a risk.
On phones, file-based encryption enables features such as receiving calls and alarms after a reboot before the owner first enters the passcode, while personal data stays protected. Many desktop privacy setups combine both: full disk encryption for the device, plus file-level or per-user encryption for sensitive folders.
What Encrypted File Systems Can Still Reveal
File system encryption protects contents, but it does not always hide everything about your files. Some information, known as metadata, may remain visible or partly visible to anyone who can read the raw storage, depending on the implementation in use.
File Names and Folder Structure
Some systems encrypt file names, while others leave them readable. Linux fscrypt encrypts names within protected directories, for example, but the shape of the directory tree may still be inferred. A visible file name such as a medical appointment letter can reveal more than its encrypted contents ever would.
Choosing neutral names for sensitive files and folders reduces this risk on systems that leave names readable, and checking your tool’s documentation tells you which behavior applies.
Sizes and Timestamps
File sizes and modification times are often visible or can be estimated. An observer might see that a large file changed at a particular time each night, suggesting a backup or a recording. These hints rarely expose content directly, but they can support inferences about routines and activity.
For most households this level of leakage is acceptable, but people facing targeted threats should remember that activity patterns can be visible even when every file’s contents remain sealed.
Unencrypted Locations
Encryption applies only where the policy covers. Copies of data saved to temporary folders, swap space, or unencrypted external drives sit outside the protected area. Applications sometimes create cache or thumbnail files in unexpected places, which is one reason many privacy setups add full disk encryption underneath.
A useful test is to search for recently opened sensitive documents by name and see where copies, previews, or thumbnails appear outside the protected folder.
Practical Uses on Desktops and Laptops
For individuals, file-level encryption is most useful when you need extra protection for specific data, such as client files, legal documents, or research notes, beyond what the device-wide encryption already provides. Keeping these in a protected directory limits exposure if someone accesses your signed-in account.
For households with shared computers, per-user encryption can keep each person’s files private from the others. This works best when every person has a separate account with a strong password, rather than sharing a single login that opens everything for anyone who sits down.
For IT teams, file-level policies can protect home directories on systems where several people sign in, such as lab machines or shared workstations. Administrators should plan key recovery carefully, because a lost user credential can make protected files permanently unreadable without an approved recovery mechanism.
Removable drives need separate attention. Copying a file from an encrypted folder to a USB drive usually produces a plain copy on that drive. Encrypting the removable drive, or keeping sensitive files off it, avoids this common leak.
Setting Up File-Level Protection Safely
Enabling file system encryption on a desktop is more hands-on than turning on full disk encryption. Mistakes in key handling can lock you out of your own data, so preparation matters. A short sequence covers the essentials for most setups.
- Back up the files you plan to encrypt and confirm the backup opens on another device.
- Read the current documentation for your operating system’s file encryption tool and its limits.
- Apply encryption to a new, empty folder first, then move data into it, if the tool supports this approach.
- Export or record any recovery key or certificate the system creates, and store it offline.
- Test access after signing out, restarting, and changing your password.
Windows EFS deserves particular care. Its keys are tied to the user account and certificate, so resetting a password through certain methods or reinstalling Windows can leave files unreadable. Exporting the EFS certificate to a secure location is an essential step that many users skip.
Common Mistakes With File-Based Encryption
A frequent mistake is assuming that encrypting one folder protects everything related to it. Applications may keep recent file lists, previews, or autosaved drafts elsewhere. Reviewing where your main applications store temporary data reveals gaps that file-level policies alone do not cover.
Another mistake is sharing an account. File system encryption separates data by user keys, so when several people use the same login, everyone gains access to everything that account protects. Separate accounts, each with its own credentials, are the foundation that makes per-user encryption meaningful.
A third mistake is neglecting recovery. Because file keys depend on credentials, forgotten passwords and broken profiles can make data unrecoverable. Keep backups of important encrypted folders, record recovery keys where the tool provides them, and periodically confirm that restoring from backup actually works.
Backups are easy to overlook as well. A backup made from a decrypted view of your files holds plain copies, so the backup destination needs its own encryption and access controls to keep that data protected.
How Mobile Devices Rely on File Encryption
On modern Android and iOS devices, file-based encryption is enabled by default and tightly integrated with the lock screen. The passcode you choose is not just an access barrier; it contributes to the keys that protect your files, so a stronger passcode directly strengthens storage protection.
Both platforms distinguish between the period after a restart and the period after the first successful sign-in. Before that first sign-in, much personal data remains sealed. After that first sign-in, more keys stay available in memory, even while the screen is locked, so that apps can receive messages and sync in the background.
This is why restarting a phone can strengthen its protection in risky situations, such as before leaving a phone unattended or when it may be lost during travel. Privacy-focused Android variants such as GrapheneOS add options like automatic restarts after inactivity, returning the device to its more protected state.
Choosing the Right Layer for Your Data
Start by identifying what you most need to protect and from whom. If the main risk is theft of a powered-off laptop, full disk encryption is the essential first layer. If you share devices or handle especially sensitive files, add file-level protection where your operating system supports it well.
On phones, the most important step is choosing a strong passcode, since it underpins file-based encryption. On desktops, review whether your operating system offers per-user or per-folder encryption, and test it on a small set of files before relying on it for important records.
Looking ahead, operating systems continue to shift toward finer-grained, hardware-backed encryption that keeps more data sealed until it is actually needed. Understanding how file system encryption works lets you take advantage of these protections deliberately, instead of trusting a lock icon you never fully checked.
IT teams should document which devices use file-level encryption, where recovery material is held, and who may access it. Clear records prevent the situation where a departing employee leaves behind encrypted files nobody can open.