Best Encrypted External Hard Drives of 2026

Two terabytes with hardware encryption and password protection for less than anything else on this list is a straightforward pitch, and the My Passport delivers it without drama. The password is set through WD's utility and enforced by the drive's own encryption chip, so the files on it are unreadable without the credential — you aren't depending on BitLocker being switched on or on remembering which machine you encrypted from.

The size is what makes it easy to live with: a 2.5-inch mechanism in an aluminum shell, four and a quarter inches long and a touch over four ounces, so it lives in the laptop sleeve and comes out on Sunday. The bundled software adds ransomware defense on top of the encryption, a genuinely useful extra for a backup disk that stays plugged in for hours. Expect mechanical write speeds; the first full backup runs long.

Macs are where this one gets awkward. Enrollment goes through a WD utility that has to install on the machine you set the drive up from, and a drive that simply never mounts is the outcome to watch for. On a Windows laptop this is the value pick of the group; if there's a MacBook in the house, the Ultra is the version to buy.

Five terabytes is more room than anything else here, and the Ultra carries it in a blue metal shell that looks a step nicer than the plain black drives most of us end up with. It's the same 2.5-inch formula as the cheaper My Passport, with two and a half times the capacity, a USB-C cable in the box, and a cover that stands up to being carried around.

For a photo or video library that has outgrown a laptop, this is the drive we point people to. Password protection with 256-bit AES hardware encryption works the way it does on the 2TB model — set it through WD's software and forget about it — and the USB-C cable means it plugs into a current MacBook or Ultrabook without an adapter. Five terabytes in a shell this size is the whole point.

It ships formatted for Windows, so on a Mac reformat before anything lands on it; discovering that afterward is a good way to lose an afternoon. At 4.64 ounces and under an inch thick it disappears into a bag, and the three-year warranty matches the longest on this list.

Where the Kingston puts its PIN on glass, the diskAshur2 uses a physical keypad on the face of the drive: seven to fifteen digits, and then the disk unlocks itself on Windows, macOS, Linux, Chrome, or Android with nothing installed on the host machine. That is the whole argument for choosing it, and the reason it earns a place here with less storage than anything else on the list — it is the drive we hand to someone who spends the week plugging into whatever computer a client provides.

The rest of the package is built for that life. An aluminum, glass, and ceramic enclosure rated IP56 for dust and splashing is the only one here with a stated IP rating, and at 220 grams it disappears into a bag next to the charger. Setup happens entirely on the keypad, with no first-run software and no admin account to create on the host.

Capacity is the compromise. Five hundred gigabytes fills quickly once raw photos or a couple of video projects land on it, so treat it as a working set that syncs back to a bigger drive rather than an archive. Speed is mechanical: the stated 160 MB/s read is a ceiling, and small-file work feels slower than that suggests. Neither matters if what you carry is contracts, spreadsheets, and a few folders of design files.

Four ounces, with its USB cable built into the body. The cable that can't be left in a hotel room or borrowed by a colleague is a smaller deal than encryption and a far more frequent annoyance, and it tells you what kind of drive this is: one that gets carried, plugged in, and put away again without any accessories to lose.

It is also the only drive here validated to FIPS 140-2 Level 2, with 256-bit AES XTS hardware encryption and a keypad on the face, and none of it requires software on the host. One terabyte in a four-ounce body is a good ratio. The 5400 rpm disk underneath sets the pace, so expect mechanical transfer speeds rather than SSD ones — fine for documents, contracts, and archived projects, less so for a folder of 4K footage.

Where it earns its place is the combination nothing else here offers: a validated module, a keypad, and a body light enough to forget about. If a contract, a regulator, or a client's security review names FIPS 140-2 Level 2, this is the drive that answers, and setup is done on the keypad rather than through an installer. If nobody is asking for the certificate, the diskAshur2 makes the same keypad argument with IP56 sealing and a bit more room.

Fifty-two grams and a magnet on the back: the MD600 is designed to snap onto a MagSafe iPhone and take ProRes footage straight from the camera, and at that weight it is the only drive here you forget you're carrying. The zinc alloy shell doubles as a heatsink, and the touchscreen reports speed, temperature, and remaining capacity while a transfer runs.

For anyone shooting video on a phone, that readout is worth more than another half-terabyte of space — you can see the drive warming up before it throttles, and you know how much room is left without opening an app. It's also the fastest thing in this group on paper, at up to 2,000 MB/s read and 1,800 MB/s write over USB 3.2 Gen 2x2. The encryption is hardware-based with a password, which is enough for a lost drive and not the same claim as the certified models.

The magnet is the part we treat with suspicion. With a cable in the phone's only USB-C port, the snap has to do all the holding, and a drive that lets go mid-take is worse than one that never claimed to stick. A thick case or a handset without MagSafe changes that calculation entirely.

This is the one that stays put. A 3.5-inch desktop unit at 2.1 pounds, the DT isn't going into a laptop bag and doesn't pretend otherwise: it sits on a desk, stays plugged into USB 3.0, and holds 4TB of 7200 rpm storage for the files you don't carry around.

The keypad is where Apricorn earns the money. Separate admin and user modes let you issue a working PIN without handing over the master, forced enrollment makes sure a credential exists before the drive is used at all, and programmable brute-force defense plus data recovery PINs are configured through Apricorn's tooling rather than software on the host. It works with any operating system because it doesn't ask the operating system for anything.

A stated 200 MB/s read is the best of the spinning drives here, and 7200 rpm makes a difference once you're copying a hundred gigabytes of archive rather than a folder of PDFs. Four terabytes also means the whole archive can sit on one encrypted volume instead of being split across two portables.

Where it fits is a small office or a home desk with a safe in the room. A drive that never travels needs no sleeve and makes no compromise on capacity, and the admin and user modes mean it can be shared without being handed over. That is a narrower job than the portables do, and for the right desk it's the better tool.