What we accept

We don't ask which tool you used, and we don't sell or supply one. We check one thing only: the result. The drive must show nothing — no files, no filenames, nothing readable — until it is unlocked with your password. Mainstream full-disk encryption all qualifies: the encryption built into Windows and macOS, and long-standing open-source encryption tools alike. Picking the tool and using it correctly sits on your side of the line; the custody sits on ours.

What customers actually do

Some customers simply switch on the full-disk encryption their computer already has, set a password, and are done. Others use a well-known open-source tool — one whose code has been public for years, readable by anyone, and which has passed independent professional security audits; its standing in the security community is a matter of record, and you can check that record yourself before deciding anything. We point at no single name, because both roads end at the same place: a drive we cannot open. Here is one customer's route, written out step by step, as an example of what 'done properly' looks like.

One customer's route

The tool he used is called VeraCrypt — his choice, mentioned here only because his steps refer to it. His route:

  1. He downloaded it from the tool's official website, and only there — copies floating around download portals were, in his words, not worth the risk. He installed it and plugged in an empty drive.
  2. He chose to encrypt a whole non-system drive, as a standard volume.
  3. Before formatting, he checked the drive's name and size twice — that step erases the drive completely.
  4. He left the encryption settings at the defaults — AES, with SHA-512 — and set his password: five unrelated words strung into a passphrase of well over twenty characters. He ticked 'show password' and read back exactly what he had typed.
  5. He moved his mouse around the window to generate the keys, formatted the drive, and waited for it to finish.
  6. He then opened the drive with his password — mounted it — copied his files in, and closed it again.
  7. Last, he tested it the way a stranger would: mounted it again from scratch and opened a file. Only when that worked did he call it done.

Two things he mentioned afterwards. When the drive wasn't mounted, his computer offered to 'format' what looked like a blank drive — that is what a properly encrypted drive looks like, and the correct answer is always no. And he made his second copy the same way, same password, and tested that one too: two identical copies, kept apart, are what turn a lost drive from a disaster into an errand.

Going further — what some customers add

Standard encryption with a long password is already beyond any realistic brute-force attack. Everything below solves a special problem — and each adds a new way to lock yourself out. Adopt them for a reason, not for a feeling.

  1. Hidden volume. One customer created a second volume hidden inside the first: one password opens a set of decoy files, another opens the real ones. His own caution came with it — writing to the outer volume without protecting the hidden one can destroy it. This answers coercion, not everyday caution.
  2. Keyfiles. Another customer adds keyfiles: opening then takes the password plus a specific file, kept separately and permanently. Lose that file and the volume is a brick — which is exactly the protection, and exactly the risk.
  3. Split the password. Some split the password itself: two halves in two places, or Shamir's Secret Sharing (for example the ssss tool) making 2-of-3 shares — so a future recipient can one day open a time capsule without anyone holding the whole secret today.
  4. Header backup. One customer backs up the volume's header and stores that small file apart, guarded like a key. If a header is ever corrupted, the correct password alone will not save the data; the header backup is the way back.
  5. A higher PIM. A few raise the tool's iteration count, making each password guess costlier for an attacker and mounting a little slower for themselves. Optional — the defaults are already sound.

Before you seal the mailer

  • Both copies opened by your own hand, at least once.
  • The password stored separately, in at least one safe place — paper in a sealed envelope ages better than a notes app.
  • Nothing written on the drive or the mailer that describes the contents.
  • Never send the password to us — not by email, not by note in the package, not ever. We will never ask for it. Anyone who does is not us.