The VeraCrypt project’s own site lists 1.26.30 as the current release and says it fixes several security issues and Windows driver stability regressions. That makes this a good week to learn the tool properly. This VeraCrypt tutorial runs 13 steps and takes about 40 minutes, and you finish with an encrypted file container, an encrypted USB drive, a hidden volume, and scripts that open the same vault on Windows 11 and Ubuntu.
One wrinkle hits the VeraCrypt download step right now. A project maintainer’s October 26 comment reportedly said only the portable Windows setup was available while the team investigated upgrade problems with the 1.26.30 installers, and we could not confirm a republished installer as of October 29. Step 3 shows how to check what the download page offers on the day you read this and how to verify whatever you grab.
This guide is hands-on. If you are still choosing between VeraCrypt, BitLocker, LUKS and FileVault, our full-disk encryption comparison covers that decision. If you already picked VeraCrypt, keep reading.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What You Will Build and Why VeraCrypt Still Earns a Place in 2026
Disk encryption has become a default feature on most laptops, so it is fair to ask why anyone still installs a separate tool. The answer is portability and control. BitLocker belongs to Windows, LUKS belongs to Linux, and FileVault belongs to macOS. VeraCrypt reads the same container file on Windows and Linux, so one encrypted file on a USB stick opens on both. It also offers something the platform tools do not: hidden volumes, a second encrypted volume that sits inside the free space of the first and cannot be proven to exist without its password.
VeraCrypt descends from TrueCrypt, and its documentation points out that it raised the key-derivation work on purpose. The official site explains that custom iteration counts arrived through the PIM (Personal Iterations Multiplier) starting in version 1.12, and that VeraCrypt uses far more iterations than TrueCrypt did for standard containers and partitions. In plain terms, guessing a stolen volume’s password costs an attacker much more time per attempt than it did in the TrueCrypt era. The 1.26.29 release added Argon2id, a memory-hard key-derivation function, for non-system volumes, according to the project’s release announcement.
By the end of this guide you will have four things on disk:
- A 4 GB encrypted file container (
vault.hc) formatted as exFAT, so Windows 11 and Ubuntu can both read it. - An encrypted whole-drive USB stick that shows up as unreadable until VeraCrypt mounts it.
- A hidden volume inside a second container, with a decoy outer volume.
- A pair of small scripts (PowerShell and Bash) that open and close the vault without ever putting your password on a command line.
The tutorial uses two systems because that is where most readers work. On the Windows side it assumes Windows 11 version 26H2, which Microsoft calls the Windows 11 2026 Update. On the Linux side it assumes Ubuntu 26.04.1 LTS or the newer Ubuntu 26.10. Nothing in the steps depends on a feature unique to those releases, so older supported builds behave the same way.
A word on expectations. Encryption protects data at rest. It does nothing for a laptop that is unlocked, infected, or in the hands of someone who watches you type the passphrase. Later sections spell out those limits so you can decide what VeraCrypt covers in your setup and what it does not.
Prerequisites and Versions
Gather the pieces below before you start. Everything is free except the USB drive, and any drive of 8 GB or more works. The drive is erased in Step 10, so use one that holds nothing you need.
| Component | Version or size | Notes |
|---|---|---|
| VeraCrypt | 1.26.30, the current release on veracrypt.fr | Free and open source. Windows, Linux and macOS builds exist |
| Windows 11 | Version 26H2 (Windows 11 2026 Update) | Microsoft says it reached all eligible devices by October 28, 2026 |
| Ubuntu | 26.04.1 LTS, or 26.10 “Stonking Stingray” | 26.10 shipped October 15, 2026 and is supported until July 2027 |
| USB drive | 8 GB or larger | Erased in Step 10. Back up anything on it first |
| Free disk space | At least 5 GB on the host machine | Holds the 4 GB container and a header backup |
| Privileges | Local administrator on Windows, sudo on Ubuntu | VeraCrypt loads a kernel driver on Windows and uses device-mapper on Linux |
| Shell tools | PowerShell 5.1 or newer, and gpg plus sha256sum on Ubuntu | All ship with the operating systems |
Two version notes help you avoid confusion. First, Ubuntu 26.04 is the current long-term-support line, while 26.10 is an interim release. Canonical’s 26.10 release notes for Landscape cover the newer release, and Canonical’s security blog says it is supported until July 2027. If you want a machine you will not touch for years, pick the LTS. Second, Windows 11 24H2 and 25H2 should run VeraCrypt the same way, since the tool’s driver model does not depend on the feature update. Microsoft’s release-health pages say 26H2 is available to all eligible devices, so check Settings, then Windows Update, before you begin.
Check your Windows build with winver and your Ubuntu release with lsb_release -a. Write both down. If something misbehaves later, the troubleshooting section asks for them first.
You also need a plan for the password. A volume protected by a weak passphrase is only as safe as that passphrase, no matter which cipher you choose. Pick five or six unrelated words or a long sentence you can type from memory, and write down nothing that links it to the file. Practice it a few times today, because the hardest part of this guide is remembering the secret in a month.
Finally, set aside a backup location. Step 2 asks you to copy anything valuable off the drive before you touch it, and Step 13 asks you to store a header backup somewhere other than the container itself. A second USB stick or a cloud folder you trust will do.
Steps 1 to 3: Plan the Layout, Back Up, and Verify the Download
Step 1: Decide what you are encrypting
VeraCrypt gives you three ways to protect data, and the choice drives every later click. Take two minutes to match your need to a format before you create anything.
| Format | Best for | Works on Windows and Linux | Main risk |
|---|---|---|---|
| File container | A folder of documents you carry or sync | Yes, same file | Someone can see the file exists and how large it is |
| Non-system partition or whole drive | An entire USB stick or external disk | Yes, if the inner file system is cross-platform | Prompts to “format” on machines without VeraCrypt can erase it |
| Hidden volume inside a container | Plausible deniability for one secret set of files | Yes | Misuse can reveal or destroy the hidden data |
| System drive encryption | Pre-boot password for the OS drive | Windows only in practice | Recovery needs a rescue disk. Skip it unless you know why you need it |
This guide builds the first three. System encryption has a different failure profile (a bad update can leave a machine unbootable), and both platforms ship their own option. Ubuntu 26.10, for example, expands TPM-backed full-disk encryption in its installer and lets you require a PIN or passphrase. If your goal is a locked laptop, use that or BitLocker and treat VeraCrypt as the tool for portable and secondary data. If you only need to protect a few documents and want the shortest path, our file encryption walkthrough may be lighter than what follows.
For the project at the end, choose the container. A container is a single ordinary file. It copies to cloud storage, sits on any USB stick regardless of its own file system, and does not alarm Windows into offering to format anything.
Step 2: Back up before you encrypt anything
Encryption tools destroy data when you misclick, and VeraCrypt gives few second chances. The wizard that encrypts a whole drive erases it by default. Before Step 10, copy everything you want to keep off the USB stick onto another disk and open a few files from the copy to confirm they work.
If you plan to encrypt a drive that already holds data in place, which VeraCrypt supports for non-system partitions, a backup matters even more. In-place encryption rewrites every sector, and a power cut or unplugged cable halfway through can leave the drive in a state the tool must repair. Our guide to cloning a hard drive to an SSD shows a reliable way to take a full image first.
A simple rule works here: you should hold two copies of anything before it enters an encrypted volume for the first time. The container then becomes your second location and not your only one. Create a folder called vault-staging on your desktop now and put a few harmless test files in it. A text file, a small PDF and a photo are enough. You will use them in Steps 6 to 9, and they keep real documents out of harm’s way while you learn.
Step 3: Download VeraCrypt and verify it
The phrase “veracrypt download” is also what people search before they land on look-alike sites, so type the address yourself: veracrypt.fr, then open the Downloads page. Download the build for your operating system from there and from nowhere else. Open the page, note which version is listed and whether the Windows row offers an installer, a portable build, or both. As of this writing the Windows installer situation for 1.26.30 was in flux, as the introduction described. If the page lists only the portable build, use that for Step 4. It runs the same program without installing the driver permanently, though it still needs administrator rights to mount a volume.
Do not fall back to 1.26.29 on reflex. The project’s release notes credit 1.26.30 with security fixes, Japanese outlet Windows Forest (窓の杜) covered the release as a fix for multiple vulnerabilities, and a third-party report says a moderate Windows vulnerability affected versions through 1.26.29. Waiting a day for a corrected 1.26.30 installer beats installing the older build.
Verify what you downloaded. On Windows, open PowerShell in your Downloads folder and compare the hash with the one published on the download page:
cd $HOME\Downloads
Get-FileHash .\VeraCrypt*Setup*.exe -Algorithm SHA256 | Format-ListThe output has this shape, and the Hash line must match the website character for character:
Algorithm : SHA256
Hash : <64 hexadecimal characters>
Path : C:\Users\you\Downloads\VeraCrypt Setup <version>.exeOn Ubuntu, check both the hash and, better, the PGP signature. The project publishes a signature file next to each installer and a public key on its site. Import the key, then verify:
cd ~/Downloads
sha256sum veracrypt-*.deb
gpg --import VeraCrypt_PGP_public_key.asc
gpg --verify veracrypt-*.deb.sig veracrypt-*.debLook for a line that says “Good signature”. A warning that the key is not certified with a trusted signature is normal for a key you imported yourself. A “BAD signature” message means you must delete the file and download it again. Never install a package that fails verification.
Steps 4 and 5: Install VeraCrypt on Windows 11 and Ubuntu
Step 4: Install on Windows 11
Run the installer you verified. Windows will show a User Account Control prompt, because VeraCrypt installs a driver that mounts encrypted volumes as drives. Check that the publisher line is what you expect and accept it. SmartScreen may add its own warning for a file with few downloads. Since you already verified the hash, choosing “Run anyway” there is reasonable.
The setup wizard asks whether to Install or Extract. Install registers the driver, adds Start menu entries and associates .hc files so you can double-click a container. Extract unpacks a portable copy to a folder. Pick Install on a machine you own. Pick Extract for a shared computer or for the portable folder in the project, and delete it afterward.
After installation, open VeraCrypt from the Start menu. You see a list of drive letters in the main window, mostly empty, plus buttons for Create Volume, Select File, Select Device, Mount and Dismount. Open Settings, then Language, if you want another interface language. Open Settings, then Preferences, and tick two boxes now: “Auto-dismount volumes when user logs off” and “Wipe cached passwords on exit”. You will return to this window in Step 9.
If a restart request appears, accept it. The driver loads at boot, and a volume may refuse to mount until you restart once. A Windows 11 machine that blocks the driver usually has Memory integrity or a similar policy enabled, and the troubleshooting section covers that case.
Step 5: Install on Ubuntu
On Ubuntu, VeraCrypt ships as a .deb package from the project’s Downloads page, with builds named for Ubuntu releases. Choose the one that matches your release. If your exact release is not listed yet, the nearest older build or the project’s AppImage (added for Linux in 1.26.24, according to the release announcement) is the fallback. Install with apt so it resolves dependencies:
sudo apt update
sudo apt install ./veracrypt-*.deb
veracrypt --versionExpect a line like this from the version command. Your number may differ if a newer build has shipped:
VeraCrypt 1.26.30The package installs two commands. veracrypt opens the graphical program and also accepts text-mode options, while a console-only variant exists for headless servers. If the GUI complains about a missing FUSE library, install libfuse2t64 (older Ubuntu releases call it libfuse2). If you plan to create exFAT file systems, install exfatprogs too:
sudo apt install libfuse2t64 exfatprogsUbuntu asks for your sudo password whenever VeraCrypt mounts or dismounts, because those operations need root. Expect two prompts when you mount from the command line: the sudo password and then the volume password. Hardening the rest of the machine pairs well with this, and our Lynis audit guide shows how to score a Linux box and fix the weakest settings.
Launch the GUI once from the Activities search to confirm it opens. It looks nearly identical to the Windows window, with numbered slots instead of drive letters.
Steps 6 to 8: Create and Format an Encrypted File Container
Step 6: Start the Create Volume wizard
This step runs on Windows, but the Ubuntu GUI wizard is nearly the same. In the main window, click Create Volume. The first screen offers three choices. Select “Create an encrypted file container” and click Next. Choose “Standard VeraCrypt volume”, since you will build the hidden variant separately in Step 11.
On the Volume Location screen, click Select File and navigate to your vault-staging folder’s parent, or better, to the USB stick you will use for the project. Type the name vault.hc. The extension is only a convention, and VeraCrypt reads any file. Some people use a bland name and extension so the container looks like a cache file. That is cosmetic. A forensic examiner can still spot a file of random-looking data. Tick “Never save history” so the path does not appear in the program’s recent list.
Click Next. You are now at the Encryption Options screen, which gets its own step because it holds the choices people most often get wrong.
Step 7: Choose the algorithm, hash, size, and passphrase
Leave the encryption algorithm at AES and the hash at SHA-512 unless you have a specific reason to change them. Modern CPUs accelerate AES in hardware, so it is both fast and conservative. The table below summarizes what the other options mean.
| Setting | Options in the wizard | Pick this | Why |
|---|---|---|---|
| Encryption algorithm | AES, Serpent, Twofish, Camellia, Kuznyechik, and cascades such as AES(Twofish) | AES | Hardware acceleration and the most scrutiny. Cascades slow every read and write |
| Hash algorithm | SHA-512, Whirlpool, SHA-256, BLAKE2s-256, Streebog | SHA-512 | The default. Only affects key derivation, not data speed |
| Key derivation for non-system volumes | Includes Argon2id since 1.26.29 | Default, unless every device you use runs 1.26.29 or newer | Builds without Argon2id support cannot open a volume that uses it |
| Volume size | KB, MB, GB | 4 GB for the project | Leave room. The file must fit on the USB stick with space to spare |
| PIM | Optional number | Leave empty at first | A custom PIM changes the iteration count. You must type it at every mount |
Click the Benchmark button on the encryption screen if you are curious. VeraCrypt tests each cipher on your CPU and ranks them by throughput. The numbers vary by machine, so treat them as a local measurement and not a universal ranking.
Set the size on the next screen. For the project use 4 GB. Remember the container will occupy 4 GB on disk immediately because VeraCrypt writes random data across it. Then comes the password screen. Type your long passphrase twice. The “Display password” box lets you see what you typed, so use it on a private screen when you want to catch typos. You can also add keyfiles, which are ordinary files that act as a second secret. For this first container, skip keyfiles and PIM so you can confirm everything works. Step 13 and the advanced section return to both.
The wizard warns you if the passphrase is shorter than 20 characters. Take that warning seriously. It reflects how fast attackers test guesses against a copy of your file.
Step 8: Format the container
The format screen asks for a file system. Choose exFAT. FAT32 caps individual files at 4 GB, and NTFS can be awkward on Linux without extra packages. exFAT reads and writes natively on Windows 11 and on current Ubuntu kernels, which is what the cross-platform project needs. Leave the cluster size at Default. Leave “Dynamic” unticked, because a sparse container reveals its real usage and slows writes.
Now the random pool. VeraCrypt asks you to move the mouse in the window for a while. The movements feed entropy into the master key and header salt. Keep moving until the bar fills, and the longer you wiggle, the better the pool. Also leave “Quick Format” unticked for this small container. A full format writes random data across the whole file, which makes used and unused space look the same. Quick format is fine for a huge container you will fill quickly, but it weakens that property.
Click Format. A progress bar fills at a speed set by your drive. A 4 GB container on a decent USB 3 stick takes a few minutes. When VeraCrypt says the volume was created, click OK and then Exit. The result is one 4 GB file that looks like random bytes. Close the wizard and move to Step 9.
Steps 9 and 10: Mount and Use the Container, Then Encrypt a Whole USB Drive
Step 9: Mount, use, and dismount the container
Back in the main window, select an unused drive letter such as V. Click Select File, pick vault.hc, and click Mount. A password box appears. Type the passphrase and press Enter. The container appears in File Explorer as a new drive labeled with the letter you chose. Copy the files from vault-staging into it, open one, edit it, and save it.
When you finish, click Dismount, or use the VeraCrypt tray icon, and confirm the drive letter disappears. This is the moment the data becomes unreadable again. Files you left open will block the dismount, and Windows will name the process holding them.
Now tune Preferences so mistakes cost less. In Settings, then Preferences, tick “Auto-dismount volumes when user logs off” and “Auto-dismount volumes when a screen saver is launched” and “Auto-dismount after no data has been read/written to it for” with a short interval such as 15 minutes. These options close the vault if you wander off. Tick “Wipe cached passwords when exiting” and “Wipe cached passwords on auto-dismount”. Cached passwords sit in driver memory so that reconnecting a favorite volume is quick, but a cache you do not need is a leak you do not need.
Test the failure mode on purpose. Dismount, then try to mount with a wrong password. VeraCrypt should say the password is incorrect or the file is not a VeraCrypt volume, and it should not tell you which. That vague message is deliberate. It is the same text you see when the container is damaged, a PIM is wrong, or a keyfile is missing.
Step 10: Encrypt a whole USB drive
A container is flexible, but sometimes you want the entire stick locked. In the wizard, choose “Encrypt a non-system partition/drive” and then “Standard VeraCrypt volume”. Click Select Device and pick the USB drive. Read the device list slowly. The wizard shows drives by size and letter, and picking the wrong one is the most expensive click in this guide.
On the next screen choose “Create encrypted volume and format it”. This erases the drive, which is why Step 2 told you to copy files off first. The alternative, “Encrypt partition in place”, keeps data and rewrites it sector by sector. It is slower and riskier, so use it only on drives you backed up. Accept AES with SHA-512, set your passphrase, move the mouse, choose exFAT, and format.
When it finishes, Windows will tell you the drive needs formatting. This is expected, and you must never click Format in that dialog. The stick holds encrypted data and no file system Windows recognizes. To use it, open VeraCrypt, click Select Device, choose the stick, and mount it under a letter. Unplugging without dismounting can corrupt the volume, so dismount first. If you plug the stick into a machine without VeraCrypt, that machine will offer to format it. A label on the stick that says “Encrypted, do not format” saves someone’s afternoon. Our comparison of an external SSD and an external hard drive helps if you are choosing hardware for this role.
For the project in this guide we still prefer the container approach, because a container file lets the outer stick stay a plain exFAT drive that both operating systems mount without help. The whole-drive method suits a disk that never leaves your own machines.
Step 11: Create and Use a Hidden Volume
A hidden volume is a second encrypted volume stored in the free space of a standard volume’s file system. Because the free space of a VeraCrypt container is filled with random data, the hidden volume’s bytes look the same as unused space. Two passwords open two different views of the same file. One password mounts the outer volume. The other mounts the hidden one. The use case is coercion. If someone forces you to hand over a password, you reveal the outer volume’s, which holds believable decoy files.
Build one in a new container so you do not disturb the project vault. In the wizard, choose “Create an encrypted file container”, then “Hidden VeraCrypt volume”. Choose “Normal mode”, which creates the outer volume and the hidden volume in one pass. Name the file decoy.hc and walk through these stages:
- Set the outer volume’s algorithm, size and file system. Make it at least 2 GB so there is room for both volumes.
- Choose a strong passphrase for the outer volume. This is the one you would surrender under pressure, so it must be different from the hidden one.
- Format the outer volume. FAT and exFAT give VeraCrypt the clearest picture of free space for the hidden volume’s maximum size.
- At “Outer Volume Contents”, open the outer volume and copy in believable decoy files. These should be real but low-sensitivity, such as old tax summaries or spare photos. Empty decoys look suspicious.
- Set the hidden volume’s algorithm, then its size, which the wizard caps at the largest contiguous free area.
- Choose a new, strong passphrase for the hidden volume, and format it.
To mount the hidden volume, mount decoy.hc as usual and type the hidden volume’s password. VeraCrypt tries the password against both headers and mounts whichever one it opens. You never choose “hidden” in a menu.
Writing to the outer volume while only the outer volume is mounted can overwrite the hidden volume’s data, since the outer file system does not know the hidden one exists. To stop that, open Mount Options when you mount the outer volume and tick “Protect hidden volume against damage caused by writing to outer volume”. Enter the hidden password too. VeraCrypt then blocks writes that would hit the hidden area. Use this whenever you add files to the decoy.
Be honest about the limits. The project’s documentation lists security requirements for hidden volumes, and they are strict. Windows can leave traces of hidden-volume use in places like recent-file lists, search indexes and the pagefile, and flash storage can retain old data through wear leveling. A hidden volume buys real protection against casual inspection and none against a skilled examiner who inspects the host system. Treat it as one layer.
Steps 12 and 13: Use VeraCrypt From the Ubuntu Command Line and Back Up the Header
Step 12: Create, mount, and dismount from the terminal
The graphical program works on Ubuntu, but the command line is where the tool pays off for scripting and servers. Creating a container from the shell takes one command. This builds a 1 GB test container with AES, SHA-512 and an exFAT file system, drawing randomness from the system pool:
mkdir -p ~/vc-test
veracrypt --text --create ~/vc-test/test.hc \
--volume-type=normal --size=1G \
--encryption=AES --hash=sha-512 \
--filesystem=exfat --pim=0 -k "" \
--random-source=/dev/urandomVeraCrypt prompts for a password twice and then writes the file. The output looks similar to this, though wording varies slightly between builds:
Enter password:
Re-enter password:
Done: 100.000% Speed: fast Left: 0 s
The VeraCrypt volume has been successfully created.Do not use the --password option for anything real. Command-line arguments appear in the process list, in shell history, and sometimes in logs. Let the prompt handle the secret. Mount the new volume at a directory you own:
mkdir -p ~/vault
veracrypt --text -k "" --pim=0 --protect-hidden=no ~/vc-test/test.hc ~/vaultExpect the sudo prompt first, then the volume password. Confirm the mount with the list command, which prints one line per mounted volume:
veracrypt --text --list1: /home/you/vc-test/test.hc /dev/mapper/veracrypt1 /home/you/vaultThe first number is the slot, then the container, the device-mapper node and the mount point. Copy a file in, then dismount by path:
veracrypt --text --dismount ~/vc-test/test.hcOn exFAT, VeraCrypt mounts the files as owned by your user. If you format the inside as ext4 instead, ownership defaults to root and you need sudo chown -R "$USER": ~/vault after mounting. Delete the test container when you are done, since the project builds its own.
Step 13: Back up the volume header and test the restore
The header is the first 128 KB of a volume (plus a backup copy near the end of the file). It stores the encrypted master key. If the header is damaged by a bad sector or an accidental overwrite, the data is gone for good, even though you know the password. Backing up the header takes a minute and removes that single point of failure.
On Windows, mount nothing, click Tools, then Backup Volume Header, pick the container and follow the prompts. VeraCrypt asks you to move the mouse again, because the backup is re-encrypted with new salt. Save the file somewhere other than the container’s own drive. On Ubuntu, the text-mode switches are --backup-headers and --restore-headers, so run veracrypt --help to confirm the argument form on your build before relying on them.
A backup you have not tested is a hope. Test it with a copy:
- Copy
vault.hcto a temporary folder. - Restore the header backup onto the copy using Tools, then Restore Volume Header.
- Mount the copy and open a file.
- Delete the copy.
Note what the header backup cannot do. It does not store your passphrase, and it cannot recover a forgotten one. If you change the passphrase later, an older header backup still opens the volume with the old passphrase. Treat old header backups as sensitive as the volume itself, and replace them whenever you change credentials.
Complete Project: A Cross-Platform USB Vault for Windows 11 and Ubuntu
Time to assemble everything. The goal is a USB stick formatted as plain exFAT, holding one container and two scripts. Plug it into Windows 11 or Ubuntu, run one script, type the passphrase, and the vault opens. Close it with the same script. The stick itself is not encrypted, which keeps it readable on any machine, while everything private sits in vault.hc.
Lay out the stick like this:
VAULTUSB (exFAT)
|-- vault.hc the 4 GB container from Steps 6 to 8
|-- vault.ps1 Windows helper
|-- vault.sh Ubuntu helper
|-- VeraCrypt\ optional portable copy for machines without itThe Windows helper locates VeraCrypt in Program Files first, then in the portable folder on the stick. It never accepts a password as a parameter, so VeraCrypt’s own dialog collects it:
param(
[ValidateSet("open","close","status")]
[string]$Action = "status",
[string]$Letter = "V"
)
$container = Join-Path $PSScriptRoot "vault.hc"
$vc = Join-Path $env:ProgramFiles "VeraCrypt\VeraCrypt.exe"
if (-not (Test-Path $vc)) {
$vc = Join-Path $PSScriptRoot "VeraCrypt\VeraCrypt.exe"
}
if (-not (Test-Path $vc)) {
Write-Error "VeraCrypt.exe not found. Install it or copy the portable build to the VeraCrypt folder."
exit 1
}
if ($Action -eq "open") {
Start-Process -FilePath $vc -ArgumentList "/v `"$container`" /l $Letter /a /q /e" -Wait
} elseif ($Action -eq "close") {
Start-Process -FilePath $vc -ArgumentList "/d $Letter /q" -Wait
}
if (Test-Path "${Letter}:\") {
Write-Host "Vault is OPEN on ${Letter}:"
} else {
Write-Host "Vault is CLOSED"
}Run it from PowerShell on the stick with .\vault.ps1 open. If execution policy blocks it, run powershell -ExecutionPolicy Bypass -File .\vault.ps1 open once instead of loosening the policy system-wide.
The Ubuntu helper does the same with the text-mode client. It uses the stick’s own directory, so it works wherever the drive mounts:
#!/usr/bin/env bash
set -euo pipefail
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
CONTAINER="${HERE}/vault.hc"
MOUNT_POINT="${HOME}/vault"
ACTION="${1:-status}"
if [ "$ACTION" = "open" ]; then
mkdir -p "$MOUNT_POINT"
veracrypt --text -k "" --pim=0 --protect-hidden=no "$CONTAINER" "$MOUNT_POINT"
echo "Vault is OPEN at $MOUNT_POINT"
elif [ "$ACTION" = "close" ]; then
veracrypt --text --dismount "$CONTAINER"
echo "Vault is CLOSED"
elif mountpoint -q "$MOUNT_POINT"; then
echo "Vault is OPEN at $MOUNT_POINT"
else
echo "Vault is CLOSED"
fiMake it executable and test the full loop:
chmod +x vault.sh
./vault.sh open
cp ~/Documents/notes.txt ~/vault/
./vault.sh status
./vault.sh closeThat loop is how to use VeraCrypt day to day. A successful run prints these three lines in order:
Vault is OPEN at /home/you/vault
Vault is OPEN at /home/you/vault
Vault is CLOSEDFinish with a cross-platform check. Create a file on Ubuntu, close the vault, move the stick to Windows 11, open it with vault.ps1, and confirm the file is there with the right contents. Then reverse the direction. If both directions work, the project is done. Keep the header backup from Step 13 off the stick, in a different place from the container.
If your Ubuntu and Windows copies differ in version, remember Argon2id. A container created with a build that supports it cannot be opened by an older build, so keep both machines on 1.26.29 or newer, or stay on the default key derivation.
Common Pitfalls That Lock People Out or Leak Data
Most VeraCrypt disasters come from habits and not from software bugs. These eight show up again and again.
- A short or reused passphrase. An attacker who copies your container can guess offline at hardware speed. Use a long passphrase that appears nowhere else. Check whether an old password appeared in a leak with our Have I Been Pwned setup guide, and retire any that did.
- Typing the password on the command line. The
--passwordoption and the Windows/pswitch put the secret in shell history and the process list. Use the interactive prompt. - No header backup. One damaged sector can destroy a volume you could otherwise open. Do Step 13 the same day you create the volume.
- Leaving the volume mounted. A mounted volume is plain text to any program running as you, including malware. Dismount when you finish, and set the auto-dismount rules from Step 9.
- Syncing a mounted container to the cloud. Services like Dropbox and OneDrive upload the whole file every time one byte changes, and a sync during a mounted session can capture a half-written state. Dismount before the sync runs, or keep the container out of synced folders.
- Clicking Format on an encrypted drive. Windows and Ubuntu both offer to format drives they cannot read. Label the stick and tell anyone you lend it to.
- Trusting hidden volumes too much. They protect against casual inspection, not against forensic review of the host machine. Never store anything whose exposure would ruin you on the strength of deniability alone.
- Ignoring hibernation and sleep. Keys live in RAM while a volume is mounted, and hibernation writes RAM to disk. Dismount before closing the lid on a laptop that hibernates.
One more habit helps: keep one test container with throwaway data and run every new setting against it first. A clean test beats a surprise on the real vault.
Troubleshooting: 10 Problems and Fixes
Work down this list in order, because the early items cause the most reports.
1. “Incorrect password or not a VeraCrypt volume.” This one message covers many causes. Check Caps Lock and the keyboard layout (a layout mismatch between Windows and Ubuntu changes symbols). Check whether you set a PIM, since you must enter it at every mount. Check keyfile order and the right container. If the volume contains a hidden one, check that you did not type the outer password when you meant the hidden one.
2. Mount fails on Windows with an access or driver error. Run VeraCrypt as administrator and restart once after installing. If the driver will not load, check Windows Security, then Device security, then Core isolation. Memory integrity can block drivers it considers incompatible. Update to the current VeraCrypt build before you touch that setting. The project’s announcement says 1.26.30 fixes Windows driver stability regressions found in 1.26.29.
3. The Windows installer for 1.26.30 is missing. Reports say the installers were pulled while the project investigated upgrade problems. Use the portable build, or wait for a republished installer. Verify the hash either way.
4. Ubuntu says it cannot find FUSE. Install libfuse2t64 on current releases or libfuse2 on older ones, then retry.
5. “Unknown file system type exfat” on Ubuntu. Install exfatprogs. If mounting still fails, recreate the container with --filesystem=FAT for small data or ext4 for Linux-only use.
6. Dismount fails because the volume is in use. Close file managers, terminals sitting inside the mount, and editors with open files. On Ubuntu, lsof +D ~/vault lists the culprits. As a last resort, veracrypt --text --dismount --force works but risks losing unsaved data.
7. Windows asks to format the USB stick. The drive is encrypted and Windows cannot read it. Cancel, then mount it through VeraCrypt with Select Device.
8. The hidden volume reports no free space or corrupted data. You probably wrote to the outer volume without hidden-volume protection. Always tick the protection option when the outer volume is open for writing.
9. Mounting is slow or the system lags. Cascaded ciphers cost speed on every access. Recreate the volume with plain AES and check the Benchmark tool. Spinning disks and old USB 2 ports also cap throughput regardless of cipher.
10. macOS shares of the same vault misbehave. A GitHub security advisory reported that decrypted volumes on the FUSE-T build of 1.26.29 for macOS stayed accessible after dismount, and listed no fixed release as of October 14. The macFUSE build was reported as unaffected. Prefer macFUSE if you move the vault to a Mac.
If none of these match, collect your VeraCrypt version, Windows build or Ubuntu release, the file system inside the container, and the exact message. Those four details resolve most support threads on the first reply.
Advanced Tips for Daily Use
Once the basics work, a few additions raise protection without much effort.
Add keyfiles. A keyfile is any file whose contents are mixed into the key. Without it, the right passphrase fails. Keep the keyfile on a different device than the container, such as a second USB stick or a hardware token you carry separately. Generate one in VeraCrypt with Tools, then Keyfile Generator, which uses random data. Lose the keyfile and you lose the volume, so back it up the same way you back up the header.
Raise the cost of guessing with a PIM. A custom PIM changes the number of key-derivation iterations. A higher value slows every mount slightly and slows an attacker’s guesses by the same factor. Because you must remember it, treat the PIM as part of the passphrase and record how you store it.
Try Argon2id where every device supports it. The 1.26.29 release added Argon2id for non-system volumes. A memory-hard function makes guessing expensive on GPUs, which is the common attacker platform. Check the key-derivation options in the wizard on both operating systems before choosing it, since older builds cannot open such a volume.
Use a read-only mount for sensitive copies. In Mount Options, tick “Mount volume as read-only”. Malware or an accidental drag cannot change what is inside. This suits archives you only read.
Mount as removable media on Windows. The “Mount volume as removable medium” option stops Windows from creating a Recycle Bin and system volume information folder inside the volume, which cuts down on stray metadata.
Set hotkeys for panic. Settings, then Hot Keys, lets you assign a key combination to dismount all volumes and wipe the cache. Practice it, because a hotkey you have never pressed will not help in a hurry.
Keep the program current. VeraCrypt has no auto-updater. The project’s release announcements list security fixes and regressions, and the 1.26.30 announcement is a recent example. Check the Downloads page when you set a monthly reminder, and verify every installer the same way you did in Step 3.
Script mounts for servers. On a headless Ubuntu box, run the console variant, create containers with the flags from Step 12, and avoid storing passphrases in unit files. Prompt interactively, or use keyfiles that live on a separate mounted device.
What VeraCrypt Does Not Protect: Honest Limits
VeraCrypt solves one problem well: unreadable data when a drive, laptop or file falls into the wrong hands while the volume is dismounted. Past that boundary, other tools take over. The table below maps common threats to what actually helps.
| Threat | Does VeraCrypt help? | What to do |
|---|---|---|
| Lost or stolen USB stick | Yes, if dismounted | Strong passphrase, dismount before unplugging |
| Thief copies a laptop’s hard drive | Yes for containers and encrypted partitions | Add system-drive encryption (BitLocker, or Ubuntu’s TPM-backed option) |
| Malware or keylogger on a running PC | No | Keep the OS patched, use endpoint protection, avoid untrusted installers |
| Someone watches you type the passphrase | No | Use keyfiles, a PIM, and private screens |
| Forced disclosure of a password | Partly, via a hidden volume | Understand that hidden volumes have documented limits |
| Cloud sync exposing a file copy | Yes, the file is ciphertext | Dismount before sync runs, and keep header backups elsewhere |
| Forgotten passphrase | No | No recovery exists. Keep a sealed written copy in a safe place |
Treat the container as one layer inside a plan. Patch your operating system, enable your platform’s full-disk encryption, and keep sensitive work on a machine you control. Canonical’s 26.10 notes describe a TPM-backed encrypted installation with an optional PIN, and Windows 11 ships BitLocker on supported editions. Those cover the boot drive, and VeraCrypt covers portable and secondary data. The two do not compete. For deeper reading on threats and defenses, the cybersecurity section collects our guides.
If you manage this for a team, write down who holds each passphrase, where the header backups live, and how a departing employee’s containers get re-keyed. Encryption without a recovery and handover plan simply moves the risk from theft to forgetfulness.
FAQ
Is VeraCrypt still safe to use in 2026?
The project remains open source and actively maintained, and its site lists 1.26.30 as the current release with security fixes. Safety depends on staying current and on your passphrase, so update when the project ships a security fix.
Where should I get the VeraCrypt download?
Use the Downloads page on veracrypt.fr and nowhere else. Compare the SHA-256 hash or check the PGP signature before running anything. Look-alike sites exist for popular security tools.
Can I open the same container on Windows 11 and Ubuntu?
Yes. A container is one file, and both platforms read it. Format the inside as exFAT so both operating systems mount it without extra drivers, and keep both machines on a build that supports whatever key-derivation function you chose.
What is a hidden volume and do I need one?
A hidden volume is a second encrypted volume stored in the free space of the first, opened by a different password. Most people do not need one. It matters mainly if you could be compelled to reveal a password, and it has documented limits on hosts that keep traces.
What happens if I forget the password?
The data is gone. VeraCrypt has no recovery path, and a header backup does not store your passphrase. Write the passphrase down and store it sealed somewhere safe, or use a password manager protected by a different secret.
Can I encrypt a USB drive that already has files on it?
You can, using in-place encryption for non-system partitions, but back the files up first. The safer route is to copy the files off, create the encrypted volume, and copy them back.
Does VeraCrypt work on macOS?
Yes, with a FUSE layer. A GitHub advisory reported a dismount problem on the FUSE-T build of 1.26.29 and listed no fix as of October 14, 2026, while the macFUSE build was reported unaffected.
Should I use VeraCrypt or BitLocker?
They solve different jobs. BitLocker protects a Windows boot drive with tight OS integration, while VeraCrypt gives you portable containers and hidden volumes that work across platforms. Many people run both.
