How to Encrypt Files and Folders with EFS in Windows
Windows 10 · Windows 11 · EFS Certificate Backup

What Is EFS in Windows and When Should You Use It?

Encrypting File System (EFS) is a built-in Windows feature that encrypts individual files and folders on NTFS-formatted drives. Unlike BitLocker, which protects an entire drive, EFS is designed for selective file-level encryption: you choose exactly which documents, folders, or project files should be protected.

EFS is tied to your Windows user account and its encryption certificate. When you are signed in as the correct user, encrypted files open normally. Other users on the same PC, users who boot another operating system, or people who copy the encrypted files without the certificate cannot read the original contents.

Best use cases for EFS encryption

• Protecting private documents on a shared Windows PC.
• Encrypting work folders without encrypting the entire drive.
• Keeping sensitive files unreadable from other local user accounts.
• Adding file-level protection on an internal NTFS drive.

When EFS is not the best choice

• For removable drives that must work on many computers, because the EFS certificate must also be available.
• For full-device protection against theft, where BitLocker is usually more suitable.
• For files that must be shared widely with people who do not have EFS certificates.
• For cloud backup folders unless you fully understand how your backup software handles encrypted files.

Before You Encrypt Files with EFS in Windows 10 or Windows 11

EFS is simple to enable, but there are several important requirements and risks. The most important rule is this: back up your EFS certificate and private key immediately after encrypting your first file. Without that certificate, you may lose access to your encrypted data after reinstalling Windows, resetting the PC, deleting the user profile, or moving the files to another computer.

Check whether the drive uses NTFS

1. Open File Explorer.
2. Right-click the drive where the files are stored.
3. Select Properties.
4. Look at File system. It should show NTFS.

How to Encrypt a Folder with EFS in Windows File Explorer

The easiest way to use EFS is through the folder properties window. This method works well when you want all new files inside a folder to be encrypted automatically.

1. Open File Explorer.
2. Right-click the folder you want to protect.
3. Choose Properties.
4. On the General tab, click Advanced.
5. Enable Encrypt contents to secure data.
6. Click OK, then click Apply.
7. When Windows asks how to apply the change, choose Apply changes to this folder, subfolders and files if you want to encrypt everything already inside the folder.
8. Click OK and wait for Windows to finish encrypting the data.

After encryption is enabled, Windows may display file and folder names in green in File Explorer. This indicates that the items are encrypted with EFS.

How to Encrypt a Single File with EFS in Windows

You can also encrypt one file without encrypting the whole folder. However, Windows may recommend encrypting the parent folder as well. That recommendation exists because some applications create temporary copies while editing files. If the folder is not encrypted, temporary data may be written unencrypted.

1. Right-click the file you want to encrypt.
2. Select Properties.
3. On the General tab, click Advanced.
4. Check Encrypt contents to secure data.
5. Click OK.
6. Click Apply.
7. If prompted, choose whether to encrypt only the file or the file and its parent folder.

Should you encrypt the parent folder too?

In most cases, yes. Encrypting the whole folder gives better protection because temporary files, newly saved versions, and copied files inside that folder can remain protected automatically. Encrypting only one file is useful for quick protection, but it is less reliable as a long-term workflow.

How to Back Up Your EFS Encryption Certificate and Private Key

The EFS certificate is the key to your encrypted data. If Windows asks you to back up your file encryption certificate, do it immediately. You can also start the export manually from Certificate Manager.

Method 1: Back up the EFS certificate from the Windows notification

1. After encrypting your first file or folder, look for the Back up your file encryption certificate and key notification.
2. Click the notification.
3. Select Back up now.
4. Follow the Certificate Export Wizard.
5. Choose to export the private key.
6. Select the Personal Information Exchange (.PFX) format.
7. Set a strong password for the exported certificate file.
8. Save the .PFX file to a secure location, such as an encrypted external drive.

Method 2: Export the EFS certificate manually

1. Press Win + R.
2. Type certmgr.msc and press Enter.
3. Go to Personal → Certificates.
4. Find the certificate that lists Encrypting File System under its intended purposes.
5. Right-click the certificate and choose All Tasks → Export.
6. In the wizard, select Yes, export the private key.
7. Choose .PFX, set a password, and save the file.

How to Use the Cipher Command to Encrypt Files with EFS

Advanced users can manage EFS from Command Prompt or Windows Terminal with the cipher command. This is useful for scripting, checking encryption status, or encrypting many files at once.

Encrypt a folder and its existing files

cipher /e /s:"C:\Users\YourName\Documents\Private"

This command enables EFS encryption for the selected folder and processes files in subfolders.

Decrypt a folder and its files

cipher /d /s:"C:\Users\YourName\Documents\Private"

Show encryption status

cipher "C:\Users\YourName\Documents\Private"

Back up the current EFS certificate from the command line

cipher /x "%USERPROFILE%\Desktop\EFS-Backup.pfx"

Windows will prompt you to protect the exported certificate with a password. Move the .PFX file from the desktop to a secure backup location after export.

How to Decrypt EFS Files and Folders in Windows

Decryption is done from the same Advanced Attributes window used for encryption. You must be signed in as a user who has access to the EFS private key.

1. Right-click the encrypted file or folder.
2. Select Properties.
3. Click Advanced on the General tab.
4. Clear Encrypt contents to secure data.
5. Click OK, then Apply.
6. If you are decrypting a folder, choose whether to apply the change to the folder only or to all subfolders and files.

Decrypt using Command Prompt

cipher /d "C:\Users\YourName\Documents\Private\file.docx"

For a whole folder tree, use the /s option:

cipher /d /s:"C:\Users\YourName\Documents\Private"

How to Share Access to EFS-Encrypted Files with Another User

EFS can allow additional Windows users to access an encrypted file, but this is not the same as normal folder sharing. The other user must have a suitable EFS certificate, and access must be added to the encrypted file.

1. Right-click the encrypted file.
2. Open Properties.
3. Click Advanced.
4. Click Details next to the encryption option.
5. Click Add.
6. Select the user certificate that should be allowed to access the file.
7. Apply the changes.

EFS Troubleshooting: Common Problems and Solutions

The “Encrypt contents to secure data” option is grayed out

This usually happens because the file is not on an NTFS drive, the Windows edition does not support EFS encryption, the file is marked as compressed, or encryption has been disabled by policy.

• Check that the drive uses NTFS.
• Move the file to an internal NTFS drive and try again.
• Disable NTFS compression for the file or folder.
• Check whether your organization has disabled EFS through Group Policy.

You cannot open encrypted files after reinstalling Windows

Import the previously exported .PFX certificate into the current user account:

1. Double-click the .PFX backup file.
2. Use the Certificate Import Wizard.
3. Import it into the Current User certificate store.
4. Enter the password you used when exporting the certificate.
5. Try opening the encrypted files again.

Encrypted files lose encryption after copying

EFS behavior depends on the destination. Copying files to a non-NTFS drive, uploading them through some apps, or saving them inside an archive may remove EFS protection. If you need portable encryption, use a password-protected encrypted container or archive instead.

Files are encrypted but the folder name is not green

File Explorer color display can be disabled. To check the real status, open the file properties or run the cipher command against the folder.

Frequently Asked Questions About EFS Encryption in Windows