Microsoft's BitLocker FAQ says standard users may switch BitLocker on and off and change its settings on removable data drives. It covers USB flash drives, SD cards and external hard disks formatted as NTFS, FAT16, FAT32 or exFAT, so you do not need to reformat first.

• Plug in the stick, open Control Panel and go to BitLocker Drive Encryption.
• Under Removable data drives BitLocker To Go, find the stick and click Turn on BitLocker.

• Tick Use a password to unlock the drive, type the password twice and click Next.

• Back up the recovery key to your Microsoft account or to a file on another drive, or print it.

• Pick Encrypt used disk space only for a new stick or Encrypt entire drive for one that has held files, choose Compatible mode and click Start encrypting.

Leave the stick connected until the progress window closes. Windows asks for the password whenever you connect it, including on other PCs running Windows Pro, Enterprise or Education.

AES-128 is strong encryption for a stick. Use a long password that you have never used elsewhere.

Microsoft's BitLocker support page says BitLocker "isn't available on Windows Home edition."

Device Encryption covers the operating system drive and fixed drives, not removable ones. The Device Encryption page describes those limits.

We make this tool, so here is exactly what it does to a stick. It does not format the drive or create a partition, and the file system stays as it was. After protection, the root of the stick shows a single file, UsbDriveEncryption.exe. Everything else moves into a hidden folder named USB Drive Encryption, where each file is stored encrypted with a .usbenc extension.

Each file gets its own key. The master key comes from your password through Argon2id, which is slow and memory-hungry. GCM mode checks integrity, so a changed file refuses to open.

The app writes each encrypted file next to the original before replacing it. The stick needs free space for its largest single file. On FAT32, a file close to 4 GB will not fit once encrypted; exFAT has no such limit. If the stick is pulled out during encryption, the app finishes the job the next time you connect it. A stick that drops files or appears as RAW needs flash drive recovery first.

The free version allows three protection runs, whether on one stick or on three. Opening, decrypting and using the recovery key are not limited. Editions and system requirements are on the encrypted USB drive software page.
For folders on the PC's own disk rather than a stick, we make a separate tool to password protect a folder.

USB Drive EncryptionLock a USB stick on Windows Home and open it on any Windows PC, no install or admin rights needed there.

 Download

Open a copy puts a temporary copy of the file on that computer. Edits to the copy do not return to the stick, and the copy is deleted when you close the opener. To edit files in place, choose Decrypt the whole drive, make the changes, then click Encrypt the drive back. If you close the window while files are still readable, the opener asks whether to encrypt them first.

The opener is a Windows program of about 2 MB. If someone deletes UsbDriveEncryption.exe from the stick, the data remains intact because the lock is in the encrypted files. Install the app on a Windows PC, connect the stick and enter the same password.
VeraCrypt's documentation says, "You need administrator privileges in order to be able to run VeraCrypt in portable mode."

Apple's Disk Utility guide gives this order:

• Copy everything you need from the stick to the Mac.
• Open Disk Utility, choose View > Show All Devices, select the stick and click Erase.
• In Format, pick an encrypted option such as APFS (Encrypted), enter and verify the password, then click Erase.

• Copy your files back to the stick.

Keep a shared exFAT stick as exFAT, which Windows and macOS both read and write, and keep the private files secure inside something both systems can open.

• An encrypted .7z archive is the lightest option. Each machine needs an archiver that reads encrypted 7z files.
• A VeraCrypt container gives you a mounted drive with normal file editing. VeraCrypt has versions for Windows, macOS and Linux, but it must be installed on both machines.
• A keypad drive skips the computer entirely, at the price of buying new hardware.

• Install VeraCrypt, click Create Volume and choose Create an encrypted file container.
• Pick Standard VeraCrypt volume, click Select File and name a new file on the USB stick.
• Keep the default encryption settings, set the container size, type a long password and click Format.
• To use it, select a free drive letter in the main window, click Select File, pick the container on the stick and click Mount.

Dismount the container before you unplug the stick, or the last changes inside it may not be written.

The 7z format page confirms AES-256 support, and 7-Zip itself is free under the LGPL. To build the archive on Windows:

• Select the files, right-click and choose 7-Zip > Add to archive.
• Set Archive format to 7z.
• Under Encryption, type the password twice and tick Encrypt file names.
• Click OK, test that the archive opens with the password, then remove the plain copies from the stick.

According to Help Net Security's coverage of the launch, the Keypad 200 has no factory PIN, so you set your own on first use. At launch it came in capacities from 8 GB to 128 GB with a three-year limited warranty.

Proton's USB encryption guide calls hardware security claims "extremely difficult to verify" and advises buying only from brands you trust. A keypad drive suits machines you cannot control or install software on. For a stick you already own, software encryption costs nothing extra, while hardware encryption means buying a new drive and trusting its security claims.

• If every PC runs Windows Pro, Enterprise or Education, use BitLocker To Go. It is free and already installed.
• If any of your PCs runs Windows Home, use USB Drive Encryption.
• If the stick only ever meets Macs, use Disk Utility.
• If it travels between Mac and Windows computers and you control both machines, a VeraCrypt container works. If you do not control them, a keypad drive does.
• If you only need to hand over a few files once, an encrypted 7z archive is enough.

• Apple Support: protect your Mac information with encryption Finder Encrypt command and the warning about lost passwords
• VeraCrypt beginner's tutorial creating a file container, with a USB stick named as a possible location
• Which?: how to password protect a USB stick BitLocker, macOS and VeraCrypt methods and the APFS format note
• Proton: USB encryption guide cross-platform limits of built-in encryption and caution on hardware drives