How to encrypt your devices, and delete files for good (updated for today)

Full-disk encryption scrambles everything stored on a device. Without your password, a lost, stolen or seized device is just random data. In 2014, privacy guides had to explain how to set it up by hand. Today it is built into almost everything; you just have to make sure it is on, and that it is protected by a good password.

Phones

GrapheneOS and other modern Android phones are encrypted by default. Your data is protected by your PIN or password together with the phone's secure chip. Use a 6-digit PIN or longer, or a passphrase. See how to harden your GrapheneOS settings.
iPhones are encrypted as soon as a passcode is set. Use a longer passcode than 4 digits.
Phones are best protected when they have just been restarted and not unlocked yet. GrapheneOS can restart itself automatically after a set time (Settings > Security > Auto reboot).

Computers

Windows: turn on BitLocker (Windows Pro) or Device encryption (Windows Home): Settings > Privacy & security > Device encryption. Save the recovery key somewhere safe and offline, not in a Microsoft account if you want to keep it private.
Mac: turn on FileVault: System Settings > Privacy & Security > FileVault. Choose a recovery key rather than iCloud if you want it to stay only with you.
Linux: choose Encrypt the disk (LUKS) when installing. Most installers offer it on the first screens.
USB sticks and external drives: use VeraCrypt (Windows, Mac, Linux) to make an encrypted drive or an encrypted container file. For cloud storage, use Cryptomator.

Passwords: the part that really protects you

Encryption is only as strong as the password. Use a long passphrase, for example 6 random words from our password generator. Never write it down on or near the device. If you forget it, there is no way back in, by design.

Why shredding files does not work anymore

Old guides recommend "shredding": overwriting a file 3, 7 or even 35 times before deleting it. That made sense for old spinning hard drives. On SSDs, phones, USB sticks and memory cards, it does not reliably work: the device spreads data across its memory chips and keeps spare copies you cannot reach, so overwriting a file often leaves the original behind.

The modern answer is encryption from the start. If the whole device is encrypted, deleted files are only ever stored as scrambled data. To wipe the whole device, use its built-in reset, which destroys the encryption key and makes everything on it unreadable in seconds:

Phone: factory reset (GrapheneOS: Settings > System > Reset options > Erase all data).
Computer: use the manufacturer's secure erase or reinstall with encryption on.
For a single file on an encrypted device, normal deletion plus emptying the bin is usually enough. Tools like BleachBit are still useful for clearing traces apps leave behind.

Back up your encrypted data

An encrypted drive that fails or is lost takes everything with it. Keep at least one backup, encrypted too, somewhere else: for example an encrypted external drive at home and an encrypted cloud copy. See how to back up your GrapheneOS phone.