Best Encrypted Flash Drives of 2026

Some computers will not let you run anything on them: a client's locked-down laptop, a shared desk at a co-working space, a lab machine with a strict software policy. That is the situation a keypad solves, and the IronKey Keypad 200 is the one we like best of the keypad drives here.

The PIN goes into the drive's own alphanumeric keypad, so the code never touches the host computer — no driver, no unlock utility, no operating system in the loop. It accepts up to 15 characters, which lets you set something closer to a password than a four-digit code, and it holds separate admin and user PINs so you can give someone access without handing over control of the drive. Global or session read-only modes cover the rest.

Sixty-four gigabytes and a 145 MB/s read, 115 MB/s write put it ahead of the Apricorn 3 NX on both capacity and speed for about the same money. What it does not have is a finished certificate: the listing carries FIPS 140-3 Level 3 as pending, where Apricorn's drive is validated. We paid attention to that wording because it is where these drives genuinely separate — pending is a promise, and a policy that names a validated standard is not asking for a promise.

Two smaller things. Three years of warranty is a step down from the five on our top pick, and the buttons are small enough that every press has to be deliberate — programming a 15-character PIN is the moment you notice, so do it sitting down rather than in a parking lot.

One word separates this drive from most of the others here: validated. The Aegis Secure Key 3 NX carries FIPS 140-2 Level 3 as a completed validation — not an algorithm certificate, not a pending application. If an IT department, a client or an insurer asks for a specific certification by name, this is the drive that answers the question.

It is also the best-established drive in this set, and what stands out is what should: the lock, the build, and software-free operation on anything with a USB port. There is nothing to install and nothing to run on the host, which is why these turn up in embedded systems and thin-client setups where installing anything is out of the question — and why we keep it on the shortlist for anyone whose IT rules are strict.

Two features deserve more attention than they get. Separate admin and user modes let you issue a drive and keep control: the user sets their own PIN and you retain the ability to reset it. And the data recovery PINs are the detail nobody thinks about until the day it matters — you set them up in advance, so a forgotten user code does not turn a locked drive into a paperweight.

Where it stops being the answer is a card offload. This is a documents drive: contracts, scans, tax records, a folder of client files. A photographer dumping cards will find the drives above save more time than the certificate is worth, and that is a fair trade to make in either direction — just make it deliberately.

USB-C laptops arrive with two ports and a photographer's habit of filling both. This is the drive for that machine: a keypad-locked Apricorn with a native USB-C plug, nothing to install, and 128 GB — the most capacity in this roundup. For shooting to cards on a modern laptop, it is the pick.

Underneath it is the same formula as the 32 GB version: FIPS 140-2 Level 3 validated, 256-bit AES-XTS hardware encryption, separate admin and user modes. The drive also carries its own battery, which is how a keypad model takes a PIN before it is connected — you can unlock it in your hand and only then plug it in, which keeps the code out of whatever computer you are about to trust.

The connector is the catch as well as the point. USB-C only means anything with a USB-A port needs an adapter, and that is one more small object to lose. It is also a long stick — about three and a quarter inches — so on a laptop with ports packed tightly it may crowd the socket beside it. Worth looking at your machine before you commit.

What you are buying is room. 128 GB takes a full day of card dumps without a second drive, which for a wedding or a two-camera shoot is the difference between one device in the bag and three. We will take the one, especially on a job where nobody wants to be swapping drives in a hurry.

This is the cheapest way into hardware encryption on this list, and it is not close. If budget is the deciding factor, start here — but read the next two paragraphs before you decide what to keep on it.

What the money buys is genuine: 256-bit hardware encryption certified to FIPS 197, a case with a hardened inner shell and a water-resistance claim, and an auto-lock that fires when you pull the drive or when the host's screensaver kicks in. Transfers run at 130 MB/s read and 100 MB/s write over USB 3.0, which is quick enough for the document jobs this drive is for.

We paid close attention to the failed-attempt policy, because it changes what the drive is for. Six wrong passwords and it destroys its data and its encryption key — the sternest anti-tamper response in this set, and a genuine way to lose a project. Treat the password as the only way in, because it is. This is the drive for a code you type every week, not the one for an archive you open twice a year, and the hint field is worth filling with something that actually jogs your memory.

The rest of the compromise is capacity and control. Sixteen gigabytes holds a document folder and a couple of card dumps, and there are no admin or user modes — one password, one person. For a freelancer carrying contracts, ID scans and a client folder, that is the job done.

If the drive lives in a toolbox, a jacket pocket or a bag that gets rained on, this is the one we point at first. The datAshur PRO is IP57 rated against dust and water, and its certification list is the longest in this set: FIPS 140-2 Level 3, plus NATO Restricted and NLNCSA approvals.

The PIN goes in on the keypad — seven to fifteen digits — before the drive is connected, and after that it behaves like any other stick. No software, no driver, no operating system involved. The compatibility list runs from Windows, macOS and Linux through Chrome and Android to thin clients, zero clients and embedded systems, which is more than most buyers need and exactly what a site engineer or a kiosk technician wants to see.

Capacity is the whole trade-off. Eight gigabytes is a document drive in an age when a single memory card is larger — contracts, certificates, spreadsheets, site photos and not much else. For an inspector carrying credentials and a handful of images, that is exactly the right size. For anyone shooting video, it is not a candidate at all.

One handling note worth knowing. Changing the PIN is a button sequence rather than a menu, so set it up once at a desk with the instructions open, then leave it alone. Past that, it is about as fuss-free as encrypted storage gets.