Encrypt files automatically before backup on Windows
By Param Nimbark. Last updated 2026-10-12.
Your backup is only as private as the drive or the cloud account it lands in, because every backup tool Windows ships copies your files exactly as they are. A scanned passport in Documents is a scanned passport on the USB drive and in OneDrive. This guide covers what Windows itself offers, why none of it encrypts before the copy, and then the Seqtrix way: a File Watch trigger that encrypts each new file with AES-256-GCM seconds after it appears, so the backup only ever sees locked files.
Installs from the Microsoft Store, no SmartScreen prompt. Free Starter plan, no account.
Direct installer for Windows 10 and 11, 64-bit, v0.16.0.
The manual way: backing up with what Windows ships
Use one of these regardless; a readable backup beats no backup. The point of this section is what each one does to the bytes it copies.
Plug in an external drive, open Control Panel, go to System and Security, then File History, and turn it on. Windows copies Documents, Pictures, Videos, Desktop and your libraries to the drive on a schedule and keeps earlier versions. The copies are plain files: open the drive on any PC and everything is readable.
Signed in with a Microsoft account, this syncs your folders to OneDrive and backs up settings and app lists. The files arrive in OneDrive as they are; whoever can sign in to the account, or whoever the account is shared with, can open them.
EFS, the file encryption built into Windows Pro. It is not available in the Home edition, and it decrypts transparently for anything running under your login, including a backup tool. Microsoft documents that a copy to a FAT-formatted drive is stored unencrypted, and a sync client reads the readable bytes the same way.
A basic task in Task Scheduler running robocopy C:\Users\you\Documents D:\Backup\Documents /E every night is the classic hand-rolled backup. It is reliable and free. It copies; nothing in the chain encrypts, and there is no built-in encrypt command on a Home PC to put in front of it.
The honest summary: Windows will copy your files to a drive or to OneDrive on a schedule, and on Pro it will encrypt them for your own login, but nothing in the box encrypts a file with a password you hold before the copy leaves the machine. That step has to come from somewhere else, and it has to run by itself or it will not happen.
The Seqtrix way: File Watch in front of the Encrypt step
Seqtrix is a Windows automation app with a Security Lock step and six trigger types. Two of them do this job together: the File Watch trigger notices a new file, and the Encrypt step locks it with AES-256-GCM and a password you choose. Your existing backup tool stays exactly as it is; it just finds encrypted files where readable ones used to be.
- 1Build the encrypt sequence
In the editor add a Wait step of a few seconds, then a Security Lock step. Choose Encrypt, pick the folder you drop files into under Select Target, and set an encryption password.
- 2Attach a File Watch trigger
Open Schedules, create a schedule for that sequence and choose File Watch. Set the Watch path to the same folder, the event to file created, turn on Watch sub-folders too if you use sub-folders, and put the extensions you drop in, such as *.pdf, *.docx, in the Name filter.
- 3Point the backup at the encrypted output
Let File History, OneDrive or your robocopy job back up that folder as before. Every new file is encrypted seconds after it lands, so the backup only ever copies encrypted files.
From template: Encrypt it before the cloud sees it
In Seqtrix open Templates, search for Encrypt it before the cloud sees it and press Try this template. As shipped it is a manual habit: it creates a dated staging folder, opens it for you to drop files in, writes a manifest with SHA-256 hashes, compresses the bundle, encrypts the zip with the Security Lock step and clears the staging folder. To make it automatic, delete the first three steps (make the folder, open it, wait) and point the compress and encrypt steps at the folder your File Watch trigger watches. The template is on the Pro plan; the steps above work on the trial.
From template: Weekly backup to my USB drive
If you would rather have Seqtrix do the copying too, search Templates for Weekly backup to my USB drive and press Try this template. It is on the free plan: robocopy copies Documents and Pictures to a backup folder on D:, stamps a backup log and opens the folder for you to check. Add a Security Lock step set to Encrypt before the two copy steps and the drive only ever receives encrypted files.
Why the trigger matters
A standalone encryption tool can lock a file when you remember to open it. The backup, meanwhile, runs on its own schedule and copies whatever it finds, so the race is lost on the day you forget. Putting the Encrypt step behind a File Watch trigger removes you from the loop: the file lands, the sequence runs, the backup copies the result. Task Scheduler can run a copy on a clock but has no encrypt step to chain; the Seqtrix vs Windows Task Scheduler page covers what each one is for.
FAQ
No. File History writes copies of your files to the drive you chose, and Windows Backup syncs them to OneDrive under your Microsoft account. In both cases the copy is the file as it is: anyone who can open the drive or sign in to the account can read it. Encryption has to happen before the copy, which is what the File Watch trigger is for.
Not if the Name filter is set. The watcher only fires for names that match the filter, so with *.pdf, *.docx in the filter a new PDF starts the sequence and the encrypted file it produces does not. Watching for the created event only, rather than any change, is the second safeguard.
File Watch is an Advanced and Pro trigger, and the 15-day trial on every install is the Advanced plan, so it works from the first day. The Encrypt step itself is on every plan. The Encrypt it before the cloud sees it template is on the Pro plan.
Copy the encrypted file back to the PC and unlock it from the Security Dashboard with the same password, or run an unlock sequence. The password is the only key: there is no account, machine or recovery key behind it, so store the password in a password manager and not in the backup.
Yes. Replace the File Watch trigger with a Cron schedule, for example 11pm daily, and point the Encrypt step at the folder. Order it to run before your backup job. The per-file version in this guide is better when files arrive all day and the backup client syncs continuously.
Keep going
Make tonight's backup an encrypted one
Every install includes a 15-day Advanced trial, no credit card. Paid passes are one-time, with no auto-renewal.
Installs from the Microsoft Store, no SmartScreen prompt. Free Starter plan, no account.
Direct installer for Windows 10 and 11, 64-bit, v0.16.0.