The goal is simple to state: a card or SSD you can carry, read and write comfortably, that is worthless to anyone who finds it. Free tools only, nothing elaborate to set up. The thing that decides everything is less obvious: **no free tool gives you read-write encrypted storage on Android, macOS and Windows at once.** Every guide that claims otherwise is quietly answering for two of the three. So the first question isn't "which tool" — it's **which device actually has to write.** ## Pick by what has to write | If writing happens on… | Use | Phone access | |---|---|---| | Mac + Windows (phone just reads occasionally) | **VeraCrypt** container on exFAT | Best-effort, via EDS Lite | | All three, and read-only on the phone is fine | **Cryptomator** vault | Free, read-only | | Rarely — it's an archive, not a working disk | **7-Zip** `.7z`, AES-256 | Free, any archiver | | Only one OS, ever | That OS's built-in tool | None | ### The default: a VeraCrypt container on an exFAT disk [VeraCrypt](https://veracrypt.io/en/Downloads.html) is free, open source, needs no account, and creates a single container file you mount as a drive. Format the disk **exFAT** and put the container on it. exFAT is not a preference, it's the only filesystem all three platforms mount natively. FAT32 caps files at 4 GB, which makes a large container impossible. NTFS is read-only on macOS without extra software. APFS and HFS+ don't exist on Windows or Android. Two setup notes that cost people an evening: - **On an Apple Silicon Mac, install the FUSE-T build**, not the macFUSE one. [FUSE-T](https://github.com/macos-fuse-t/fuse-t) runs in user space; macFUSE is a kernel extension and loading those on Apple Silicon is a fight you don't need. VeraCrypt ships both builds and recommends FUSE-T for Apple silicon. - **Make the container a fixed size, not dynamic.** A dynamic container leaks how much data is in it, and on exFAT it fragments badly. ### The Android caveat, stated honestly This is the weak leg and you should plan around it rather than discover it. Since Android 11, [scoped storage](https://developer.android.com/about/versions/11/privacy/storage) means apps reach a removable card or an OTG drive through a file-picker framework, not as a raw block device. [EDS Lite](https://play.google.com/store/apps/details?id=com.sovworks.edslite) is free, open source, and does open VeraCrypt, TrueCrypt and LUKS containers — but it is barely maintained, and mounting a container that lives on removable storage is unreliable in a way that mounting one in internal storage isn't. So: treat phone access as a bonus, not a requirement. If the phone genuinely needs to open the card every day, use the next option instead. ### If the phone matters: Cryptomator, read-only [Cryptomator](https://cryptomator.org/downloads/) is free on Windows, macOS and Linux. Since mid-2026 the Android app is [freemium](https://cryptomator.org/blog/2026/07/01/cryptomator-android-freemium/): **free gives you read-only** access — open the vault, view files — and write access is a one-time purchase (€29.99 at the time of writing). Read-only on a phone is often exactly right, and it keeps this inside your "no paid software" rule as long as you write from a laptop. The other advantage is structural: a Cryptomator vault encrypts **file by file** inside an ordinary folder, so a half-finished copy costs you a few files rather than the whole volume — which a single container cannot say. ### For cold archives: an encrypted `.7z` [7-Zip](https://www.7-zip.org/) with AES-256 works everywhere and needs nothing mounted. Fine for documents you open twice a year, miserable for a photo library you browse. One real gotcha: **use `.7z` and tick "encrypt file names".** In the `.zip` format filenames stay readable even when contents are encrypted, so a finder learns the shape of everything you own. ### What not to reach for **BitLocker To Go** can't be *created* on Windows Home, and macOS can't read it without paid third-party software — so it fails the brief twice. **Encrypted APFS** from Disk Utility is Mac-only. And the phone's own "encrypt SD card" option ties the card to that handset: it satisfies "nobody can read it" in the strongest possible way, including you, on any other device. A keypad hardware-encrypted SSD sidesteps all of this — identical behaviour on every OS, no software anywhere. It costs money as hardware, not as software, which may or may not be inside your rule. ## The part that actually keeps people out The cipher is not your weak point. AES-256 is not getting brute-forced, and your passphrase is what stands between a finder and your files. Use **five to seven random words**, not a clever short string. Don't keep it on the device, and don't keep it only in a password manager that lives on the laptop the disk is plugged into. Then the uncomfortable half: **there is no recovery.** That is the feature. Lose the passphrase and the data is gone as thoroughly as if you'd lost the card — so write it down and keep the paper somewhere physically separate. This is the step people skip, and it is the one that actually loses data. ## Three habits worth having 1. **Always eject before pulling it out.** exFAT has no journaling, so an interrupted write can take out the directory table — and with it the container file, which is to say everything. 2. **Keep a second copy.** One container file means one bad region can cost the whole volume. Encryption protects against theft, never against loss. 3. **Test the restore once, on a different machine**, before you trust the setup with anything you can't re-create. An encrypted backup you've never opened elsewhere is an assumption, not a backup. ## What I'd actually do Format the SSD exFAT, put one fixed-size VeraCrypt container on it, install VeraCrypt with FUSE-T on the Mac and the normal build on Windows, and accept that the phone reads it only occasionally through EDS Lite. If the phone turns out to matter more than expected, switch to a Cryptomator vault and keep writes on the laptops. Both are free, neither needs an account, and the decision between them is about which device has to write — not about which encryption is stronger. They're the same strength. They fail differently, and that's what to choose on.