One Key, Three Operating Systems: The Case for Cross-Platform Disk Encryption

If you work across operating systems, and a lot of us do, you eventually hit a wall that single-platform advice never mentions. Every system has good native full-disk encryption. None of it travels.

FileVault protects the Mac. BitLocker protects the Windows box. LUKS protects the Linux machine. All three are solid, and all three stop at the edge of the device. The moment your data has to live on an external drive, get handed to someone, or be opened tomorrow on a different machine, the native tooling has nothing to say to you.

That gap is where most people quietly give up and put the sensitive folder on a plain USB stick.

Two different problems

Getting this right starts with separating them, because most arguments about disk encryption are two people solving different problems at each other.

Problem one: the machine. Someone takes the laptop. You want the disk to be unreadable. Native full-disk encryption solves this well and you should have it on, today, on every device you own. It is integrated, hardware-accelerated, and nearly free in performance terms.

Problem two: the data in motion. An archive on an external drive. A folder you need on three different machines. Material handed to a colleague. Backups that outlive the laptop they came from. Native FDE does nothing here, because the protection belonged to the machine, not to the file.

You need both. Native encryption for the device, and something portable for the data. They are not competitors.

Why native FDE is necessary but not sufficient

Turn it on. All of it. But know what you are agreeing to:

• BitLocker commonly escrows your recovery key to your Microsoft account. That is genuinely useful when you lock yourself out, and it means a copy of the key to your disk exists on someone else’s server, reachable by legal process. Store it offline instead if that matters to you.
• FileVault offers iCloud recovery with the same trade. Choosing the local recovery key means if you lose it, the data is gone. That is the correct failure mode when the material is sensitive.
• LUKS on Linux has no vendor escrow at all, which is the cleanest position of the three, and it is Linux-only.

Each is excellent at protecting a device and useless at protecting a file that has to leave it.

The portable answer: VeraCrypt

VeraCrypt is the successor to TrueCrypt, open source, independently audited, and it fixed a number of issues in the code it inherited. For cross-platform work its important property is simple: it creates a container file that opens on Windows, macOS and Linux with the same passphrase.

That container is just a file. It sits on a USB drive, an external disk, a NAS, or a cloud folder. Mount it, and it behaves like a drive. Dismount it, and it is a single opaque blob again.

# create a container (GUI is fine too, this is the scriptable path)
veracrypt --text --create /media/usb/vault.hc \
  --size 10G --encryption AES --hash SHA-512 \
  --filesystem exFAT --volume-type normal

# mount it
veracrypt --text --mount /media/usb/vault.hc /mnt/vault

# dismount when done
veracrypt --text --dismount /mnt/vault

Choose exFAT for the internal filesystem if the container genuinely needs to open everywhere, since all three systems read it. Use a native filesystem instead if it will only ever be used on one.

There is also a portable mode, so the tool can travel on the same drive as the container rather than needing an install on every machine you touch.

The friction, stated honestly

Three things nobody mentions until you hit them.

1. macOS needs a FUSE layer. VeraCrypt on the Mac requires macFUSE or FUSE-T. On Apple Silicon, FUSE-T is the better choice, because it does not require a kernel extension and avoids the installation problems macFUSE runs into. This is real friction and it is the main reason people abandon VeraCrypt on Mac. It is worth pushing through once.

2. Performance is lower than native. VeraCrypt does its work in userspace rather than in the kernel storage path. For documents, archives and research folders you will not notice. For a working video-editing scratch disk, you will.

3. Hidden volumes are not the trick they look like. VeraCrypt supports a hidden volume inside a container, giving two passphrases and a decoy. It is clever engineering. But treat plausible deniability as a legal theory, not a technical guarantee, and understand that in some jurisdictions failing to disclose a key is itself an offence. Do not build a plan around a court agreeing with your threat model.

The alternatives, and when they are the better answer

• Cryptomator. File-level encryption designed for cloud storage, cross-platform, and it syncs sanely because it encrypts files individually instead of one giant container. If your problem is “I want Dropbox without giving Dropbox my documents,” this beats VeraCrypt.
• age or GPG. Not disk encryption at all, individual file encryption. Perfect for a handful of sensitive documents, wrong for a working folder you open every day.
• LUKS on an external drive. Cleanest option if every machine that will ever touch that drive runs Linux. Stop reading, use this.
• Encrypted archives (7-Zip AES-256). Universally supported, fine for handing someone a package. Not a working volume, and metadata leaks more than you would like.

A sane setup

For someone working across all three platforms, the arrangement that holds up:

1. Native FDE on every device. FileVault, BitLocker, LUKS. Recovery keys stored offline, not escrowed to a vendor account, when the material warrants it.
2. One VeraCrypt container for the portable working set. exFAT inside, lives on the external drive, opens identically on all three systems.
3. Individually encrypted files for the genuinely sensitive minority, inside that container. Layers, because the container being open does not mean everything in it should be readable over your shoulder.
4. Backups encrypted before they leave, never relying on the destination to protect them.
5. The passphrase memorised, and different from your login. A fingerprint can be taken from you. Something you know has to be given.

What you’ve gained

Data that is protected because of what it is, not because of which machine it happens to be sitting on. One passphrase that works on every system you use. And an archive that stays an opaque blob when it is on a shelf, in a bag, in transit, or in someone else’s hands.

Native encryption protects your laptop. This protects your work.