Answers/The problem queries
Why 'Encrypt contents to secure data' in Windows isn't the protection you think it is
The Windows 'Encrypt contents to secure data' checkbox uses EFS — the Encrypting File System. It sounds like exactly what you want. In practice, it ties the encryption key to your Windows user account, which means anyone who can reset your Windows password or log in as you can read the files. That is not the threat model most people have in mind.
What EFS actually does
EFS encrypts files using a key derived from your Windows profile. When you log in, the files are transparently decrypted. When another user on the machine tries to open them, they can't — unless they've been added as authorized users, or unless they have admin rights and reset your password.
Where it falls short
Password reset by an admin. Booting from an external drive and reading the disk (unless BitLocker is also on). Home editions of Windows sometimes not exposing the feature. No visible indicator that a folder is EFS-protected. And, more subtle: EFS is not designed for portable backups — copy an EFS file to a USB stick and it decrypts on the way out.
What to reach for
For real folder-level protection, use a file vault that does not depend on your Windows account. Elba is one HTML file — the passphrase is yours, not the OS's. Reset your Windows password all you like; the sealed folder does not care.
Questions people actually ask
- Is EFS useless?
- No — it is fine as a light layer, especially combined with BitLocker. It just is not the strong 'password-only' protection people assume.
- Does Elba need admin rights?
- No. Any user account can open the HTML file in a browser.
Take the island
Elba is one HTML file. It runs locally in a Chromium browser, seals a folder with AES-256-GCM, never phones home, and becomes open source on 1 January 2030.
- €49MMXXVI· now ·
- €39MMXXVII2027
- €29MMXXVIII2028
- €19MMXXIX2029
- FreeMMXXX2030
the price falls each year · free to all 1 jan 2030
pay once · no account · nothing leavesRelated answers
- Alternatives to BitLocker when you only want to encrypt one folder, not the whole drive
BitLocker protects the whole disk. For a single folder inside your Documents, you want something with a smaller scope and no admin requirement.
- How to password-protect a folder on a laptop you might lose
Disk encryption handles the stolen-laptop case only if it is enabled. A layered approach: FileVault or BitLocker plus a sealed folder.