Hide Files in Computer Storage (VeraCrypt Volume)
A VeraCrypt hidden volume stores files inside the free space of a regular VeraCrypt volume, with a separate password and encrypted contents. It can offer limited plausible deniability, but it cannot prove that no hidden data exists. Plan the space, protect the hidden volume when writing to the outer one, test your backups, and secure the computer itself.
It is understandable to want private files without making them easy to notice. A hidden volume can help keep selected files encrypted when a container is not mounted. The setup takes care, though: a wrong password, an unprotected write to the outer volume, or a copy saved elsewhere can undermine the plan.
I treat this as a storage and access-control setup, not a guarantee of secrecy. The steps below explain how to plan, create, test, and maintain the volumes. Menu wording may vary by VeraCrypt version, so use the official documentation for the version you install.
Plan the Volume and Threat Model
A threat model is a short list of what you want to protect and what you are protecting it from. A hidden volume can encrypt files at rest and make their presence harder to establish from the container alone. It does not protect an unlocked computer or ensure that other copies of those files are hidden.
VeraCrypt’s hidden-volume design places one encrypted volume inside the free space of another, called the outer volume. Each volume has its own password. The hidden volume can be mounted with its password, while the outer volume is accessed with the outer password.
The encryption matters, but so do the limits. VeraCrypt’s AES configuration uses XTS mode, a storage encryption mode defined by IEEE 1619. It uses two 256-bit AES keys, or 512 bits of combined key material. AES is specified in FIPS 197. This describes the encryption design, not a promise that every part of your computer is secure.
Before creating anything, decide:
- Which files belong in the hidden volume, and how much space they need.
- Which computers and operating systems must open the files.
- Who may know either password, and how you will store the passwords safely.
- What happens if the computer or storage device is lost, damaged, or compromised.
Use distinct, strong passwords for the outer and hidden volumes. If someone learns the hidden-volume password, they can identify and open that volume. Plausible deniability is limited: it is not proof that no hidden data exists, and it may not apply in every legal, technical, or investigative setting. Do not use it to defeat authorized monitoring.
Check Capacity, Filesystem, and Access
The hidden volume must fit inside the outer volume’s available space, and its size is also limited by the chosen filesystem. Decide on sizes before you format anything. Leave room for the outer volume’s intended contents, and confirm that the filesystem works on every operating system that needs access.
A VeraCrypt container is an encrypted file stored on a drive. A device-hosted volume uses a partition or supported storage device instead. A container is often easier to copy as one item, but the container file itself may be visible. Neither option hides the existence of the storage device or guarantees that a person cannot infer how it is used.
| Choice | Useful when | Check before setup |
|---|---|---|
| File container | You want one volume file on an existing drive | The drive has enough free space and is backed up |
| Partition or device | You want to encrypt a dedicated storage area | You selected the correct device and saved needed data elsewhere |
| Filesystem | Files must move between systems | The chosen format is offered and supported on each target system |
| Hidden-volume size | You need space for selected private files | It fits within the outer volume’s available space and filesystem limits |
Estimate the hidden volume from the files you will store, then allow room for reasonable growth. Do not assume that the full outer volume size is available for hidden data. The hidden volume is created within the outer volume’s available space, and the wizard’s limits depend on your layout and filesystem.
Back up important data to a separate, tested location before formatting or changing storage. A backup on the same drive is not independent protection. If files must be shared across systems, test the selected filesystem and access process with nonessential files first.
Create and Populate the Volumes
Creating the volumes means using VeraCrypt’s volume-creation wizard to make an outer volume, then placing a hidden volume inside it. The exact prompts can change between releases. Download VeraCrypt from its official distribution and follow its published instructions to verify the download before installing it.
First, confirm that the computer and storage device are trusted, updated, and backed up. Choose a container or device, then start the volume-creation wizard. Select the option for a hidden volume and follow the prompts to create the outer volume before defining the hidden one. Read each screen carefully; selecting the wrong device or location can destroy data.
During setup:
- Choose the outer volume’s location or device and its intended size.
- Set a strong outer password that is different from the hidden-volume password.
- Select a filesystem that meets your cross-platform needs.
- Complete the outer-volume creation, then set the hidden volume’s size, password, and filesystem when prompted.
- Keep a separate backup of important files and passwords, stored with care.
After creation, mount the intended volume before copying files. Use the hidden password to open the hidden volume, then copy files into its mounted path. Open a sample of the copied files to check that the copy is usable. Dismount the volume when finished, and do not leave it mounted when you no longer need access.
An easy mistake is to copy files while the outer volume is mounted, believing the hidden volume is active. Check which volume is mounted and which password was used before writing. A visible container file is not the same thing as visible files inside that encrypted container.
Verify Mounting, Protection, and Backups
Verification checks that each password opens the intended volume, that the files work, and that the hidden volume is protected before you write to the outer one. It also confirms that you can restore important data from a separate backup. Do these tests before relying on the setup for important files.
Mount the hidden volume with its password and confirm that the expected files appear. Dismount it, then mount the outer volume with its own password and verify that it opens as expected. Do not treat a successful mount as proof that the hidden volume is safe from every kind of inspection.
If you need to write to the outer volume, use VeraCrypt’s hidden-volume protection option when mounting it. This optional safeguard requires both the outer-volume password and the hidden-volume password at mount time. It helps prevent writes to the outer filesystem from overwriting hidden-volume data. Without protection enabled before writing, the outer filesystem may allocate space over hidden data and damage it.
Before any outer-volume write:
- Mount the outer volume with hidden-volume protection enabled.
- Provide both the outer and hidden passwords when prompted.
- Confirm VeraCrypt indicates that protection is active.
- Do not write to the outer volume if protection was not enabled.
Protection is not a backup. It reduces a particular risk during writes, but it does not recover overwritten files or protect against hardware failure. Keep an independent backup, test restoring a file from it, and dismount volumes before disconnecting a device. After dismounting, confirm that the mounted path no longer provides access to the files.
VeraCrypt cannot stop malware, keyloggers, or someone capturing data while the volume is unlocked. Applications may also create copies, temporary files, previews, or backups elsewhere on the computer. Check where the programs you use save files, and secure the operating system and backups as well.
Example Setups and Common Tradeoffs
These examples are illustrative, not reports of specific installations. They show how the same method can fit different storage needs. In each case, the owner must choose a suitable filesystem, test access on the intended systems, and keep a separate backup.
A person who carries private documents between two trusted computers might use a file container on removable storage. They would test the filesystem on both computers, mount the hidden volume only when needed, and dismount it before removal.
A small business might store a limited set of confidential working files in a hidden volume on a dedicated device. Staff would need a clear process for password access, hidden-volume protection before outer-volume writes, and backup restoration. A shared or managed computer also raises endpoint and policy concerns that encryption alone does not solve.
| Situation | Practical choice | Main caution |
|---|---|---|
| Files used on more than one operating system | Test a compatible filesystem on each system | Compatibility can vary by OS and VeraCrypt version |
| Outer volume needs occasional updates | Enable hidden-volume protection before writing | Protection must be active at mount time |
| Device may be lost | Keep the volume dismounted when not in use | Encryption does not secure files copied elsewhere |
| Important files need reliable recovery | Maintain and test an independent backup | A second copy on the same device is not independent |
My review checklist is simple: the right volume opens with the right password, the files open correctly, outer-volume protection works before any write, and a backup can be restored. If any check fails, stop and fix it before placing important data in the volume.
FAQ
These answers cover the most common questions about using a VeraCrypt hidden volume. The key distinction is between encrypting files inside the volume and hiding every trace of their existence. A hidden volume can do the former, with limited deniability; it cannot guarantee the latter.
What is a VeraCrypt hidden volume?
It is an encrypted volume created inside the available space of an outer VeraCrypt volume. It has its own password and filesystem.
How do I open the hidden volume?
Mount the VeraCrypt container or device using the hidden-volume password. Check that the expected files appear before working with them.
Can someone tell that a hidden volume exists?
The design offers limited plausible deniability, not proof that no hidden data exists. Someone who knows the hidden password can identify and open it.
Are the outer and hidden passwords supposed to be different?
Yes. Use distinct, strong passwords. Learning the hidden password reveals access to the hidden volume.
Can writing to the outer volume erase hidden files?
It can. Outer-volume writes made without hidden-volume protection may overwrite hidden data if the filesystem allocates space over it.
When should I enable hidden-volume protection?
Enable it when mounting the outer volume if you plan to write to that volume. The safeguard requires both passwords and must be active before the write.
Does hidden-volume protection replace backups?
No. It reduces the risk of overwriting hidden data during outer-volume writes, but it cannot recover damaged or lost files. Keep and test an independent backup.
Does VeraCrypt protect files from malware or keyloggers?
No. Malware or a keylogger may capture files or passwords while the volume is mounted. Secure the computer and avoid entering passwords on systems you do not trust.
Are files hidden after I dismount the volume?
The contents are encrypted and are no longer available through the mounted path. The container file or storage device itself may still be visible.
Can I use the same volume on different operating systems?
Often, but it depends on the filesystem, VeraCrypt version, and operating systems. Test access on every system you plan to use before storing important files.
(This article was written by one of our staff writers, Richard Montclair. Visit our Meet the Team page.)
