How to Protect Files and Folders in Windows: Passwords, Encryption and Permissions

Windows 11 does not have a built-in setting that adds a separate password to an ordinary folder. To protect a copy of a folder with its own password, put it in an encrypted 7z archive using 7-Zip. This works on Windows 11 Home and Pro, but it protects the archive, not the original folder.

If you want files to remain in a normal working folder, Windows file encryption is a different option on supported editions. It uses your Windows account and encryption key rather than asking for a new folder password each time.

Before You Start

Back up important files first and choose a long, unique password you can keep in a password manager. Losing an archive password can mean losing access to its contents. Leave your original files in place until you have verified the protected copy.

Download the current Windows installer from the official 7-Zip download page. Choose the installer for your computer’s architecture; most Windows PCs use x64, while some use ARM64. On a managed work or school computer, follow your organization’s software and data-handling rules. If you are not sure which installer fits, see how to tell whether your Windows 11 PC is x64 or ARM64.

Change NTFS File or Folder Permissions

Permissions control which Windows users or groups can access a file; they do not add an independent password or encrypt its contents. On an NTFS location you own or are authorized to manage, back up the data and record the existing permissions first. In File Explorer, right-click the intended file or folder, choose Properties > Security > Edit, and select the exact user or group. Adjust only the needed Allow permissions, such as Read for viewing or Modify for editing, then choose Apply > OK and reopen Security to inspect the result. If adding an authorized account is necessary, use Add and Check Names to verify its identity before granting access. Microsoft’s access-control overview explains these file permissions and the Security tab. Do not grant Everyone full control merely to clear an error, or change Windows/system-folder permissions as a routine fix.

Test the intended read or edit action while signed into the affected account, preserving your own recovery access. Membership in other groups and inherited entries can also affect access; grayed entries may come from the parent. Microsoft’s file-security reference explains inheritance and cautions against using broad deny entries for simple read/write restrictions. Unchecking one Allow box does not prove access is blocked through every other entry. Do not disable inheritance or take ownership blindly to force the change. Shared folders also have separate share permissions, and FAT/exFAT locations do not provide the same NTFS Security controls. If the tab or edit control is missing, or a policy governs access, identify the location and ask its administrator. Restore your recorded explicit settings to undo the intended change, then test again. Use the archive or EFS sections for encryption instead.

Create a Password-Protected Copy with 7-Zip

1. Open 7-Zip File Manager from Start. Browse to the folder’s parent location and select the folder itself.
2. Click Add to open Add to Archive.
3. Set Archive format to 7z. Use the Archive field or browse button to choose a new filename and save location outside the source folder.
4. Under Encryption, enter and reenter your password. Check that the method is AES-256, then select Encrypt file names.
5. Leave Delete files after compression unchecked. Click OK and wait for completion without errors.

The result is a file ending in .7z that contains a copy of your folder. 7-Zip documents AES-256 encryption for the 7z format. Encrypting file names also protects the names inside the archive; the archive’s own filename is still visible, so avoid a revealing name.

Protect a Folder Copy on Windows 10

The 7-Zip archive method also works on Windows 10; 7-Zip’s official site lists support for both Windows 10 and 11. Open 7-Zip File Manager, browse to the folder, select it and choose Add. Choose a new archive name/location, set Archive format: 7z, enter and confirm a strong password, select AES-256 and check Encrypt file names. Leave any Delete files after compression option unchecked, then select OK. Use Test on the archive and extract a copy into a separate test location, entering the password and checking the intended files open correctly. Follow the verification section below before considering removal of any originals. The original folder and extracted test files remain unprotected by this archive password. Later edits to the original folder do not automatically update the archive. A folder-hiding batch script is not encryption or secure password protection.

How to Password Protect One File

The same 7-Zip method works for a single file: in 7-Zip File Manager, select the document instead of a folder, choose Add, and use 7z with AES-256, a password, and Encrypt file names as described above. Use a distinct archive name and leave Delete files after compression unchecked.

Test and extract the protected copy before relying on it. The original file and any extracted copies remain unprotected. Windows’ built-in Compress to ZIP command does not offer an Add password setting. See 7-Zip’s 7z format documentation for its encryption support.

Create a Password-Protected ZIP Instead of a 7z File

In 7-Zip File Manager, select the file or folder and choose Add. Set Archive format to zip, choose a new destination outside the source folder, enter and reenter the password, and choose AES-256 under Encryption method. Leave Delete files after compression unchecked, then choose OK. These File Manager steps also work on Windows 10. 7-Zip’s official feature list confirms AES-256 support for ZIP and 7z.

ZIP does not provide the 7z Encrypt file names option, so names inside the ZIP can remain visible even though file contents require the password. Use 7z with encrypted names above when hiding those names is necessary. Windows’ built-in Compress to ZIP command does not add this password.

Use Test and extract into a separate empty folder as described below. Verify the correct password and recovered files before relying on the archive. The recipient needs an extractor compatible with AES-encrypted ZIP, such as 7-Zip; do not assume Windows’ built-in extractor will open it. Original and extracted files remain unprotected.

Verify the Archive Before Removing Originals

Close the 7-Zip windows, reopen 7-Zip File Manager, and open the newly created archive. With file-name encryption enabled, it should request the password before showing the internal file list. If you can browse it immediately, confirm that you opened the new archive and that no other open 7-Zip window already has the password.

Select the archive in its parent directory and use Test. Enter the password when requested. If the test reports errors, keep the originals and make a fresh archive after resolving the error.

Next, use Extract to a separate, empty folder. Check that the expected subfolders and files are present and open several important documents. This checks that you can actually recover usable files, rather than relying on the archive’s existence alone.

The extracted files are ordinary, unprotected copies. Creating the archive also leaves the original folder unchanged. For example, a protected archive on a USB drive does not protect the source documents still sitting on your Desktop.

After checking your backup and archive, decide which unprotected copies you still need. Review the original folder, test extraction folder, cloud storage, shared locations, and backups. Deleting a local copy does not necessarily remove synced versions or securely erase recoverable data. Follow the storage service’s retention rules or your organization’s policy for sensitive files.

Open, Share, or Update the Protected Files

Use 7-Zip or another application that supports encrypted 7z archives to extract the files. Microsoft explains that Windows’ built-in archive tools do not support encrypted archives in Windows 11 version 24H2, even though they support several unencrypted formats.

When sharing, send the encrypted archive and give the password through a separate channel. The recipient needs a compatible extractor. Avoid putting the password in the same message as the attachment.

The archive is a saved copy, not a folder that automatically tracks later edits. If you change the original documents, make and verify a new encrypted archive with a distinct filename. Keep the previous verified copy until you have checked the replacement. To remove password protection, extract the files with the correct password and store that unprotected copy in an appropriate location.

What About Windows’ Encrypt Contents Setting?

The Encrypting File System (EFS) can protect files on an NTFS drive on supported Windows editions. Microsoft states that file encryption is unavailable in Windows Home. The documented route is Properties > Advanced > Encrypt contents to secure data, followed by OK and Apply.

EFS uses an encryption certificate and private key associated with your account. An authorized signed-in user can open the files without a separate folder-password prompt. It is therefore a different choice from a portable password-protected archive.

Before relying on EFS, back up its certificate and private key to a secure location separate from the PC. Microsoft’s cipher documentation describes the certificate/key backup option. Ask your IT administrator for the organization’s recovery process on managed computers. Do not assume a Windows account reset or reinstall will preserve access.

Common Problems and Questions

I Cannot Find the 7-Zip Right-Click Menu

Open 7-Zip File Manager from Start and use its Add button instead. The procedure above does not depend on File Explorer showing a particular context menu.

There Is No Encrypt File Names Option

Check that Archive format is 7z in the Add to Archive dialog. Creating an ordinary ZIP through Windows’ Compress or Send to commands does not add a password. Our Windows ZIP and extraction guide covers that separate task.

Can Properties > Security or BitLocker Add a Folder Password?

File permissions control access by Windows users and groups; they do not create an independent folder password. BitLocker protects a drive or volume rather than adding a password prompt to one ordinary folder. Avoid changing permissions blindly, since you can interfere with your own or an application’s access.

Can I Use a Folder-Hiding Batch Script?

Renaming or hiding a folder is not encryption. A script that stores a readable password is a poor choice for protecting private documents. Use a documented encryption method and verify the recoverable copy instead.

What If the Password Does Not Work?

Confirm the exact archive, keyboard layout, and password capitalization. Try your saved password carefully. If it still fails, use your verified backup or original files; do not delete them or assume there is a password-removal option that can recover encrypted contents.

Finish by checking the correct password opens your archive, the recovered files work, and any remaining unprotected copies are stored where you intend.

Encrypt a File With EFS and Back Up Its Key

On a supported Windows edition and NTFS drive, back up the intended data, then right-click the file or folder, choose Properties > Advanced, select Encrypt contents to secure data, and choose OK > Apply. Review the offered scope: a file’s parent folder or a folder’s subfolders and files can also be included. Apply only the intended scope, wait for completion and reopen Advanced to check the encryption setting. This is EFS access tied to the Windows account and certificate, not a separate password prompt. Windows Home does not provide this EFS feature; use the archive method above when appropriate.

Back up the EFS certificate and private key before relying on encryption. Microsoft documents cipher /x. In Command Prompt under the account that encrypted the file, enter cipher /x "E:\EFS-key-backup", replacing E: with an available separate backup drive and the name with your chosen new backup name. Follow the certificate-export and password prompts, then verify the .pfx backup exists and store its password separately. This example exports the account’s current EFS key; older files may use other certificates. Do not confuse it with cipher /w, which erases free space. Losing the required private key can make encrypted data inaccessible.