How to Password-Protect a File on Windows Without Installing Software

If you are on a managed Windows computer at work, you probably cannot install 7-Zip, WinRAR, AxCrypt, VeraCrypt, or any other encryption tool — IT has locked installs to admin only. The same is true on shared family PCs, library computers, and Windows machines provided by your school. But you can still encrypt files with AES-256, because every modern Windows browser has the Web Crypto API built in.

This guide shows the exact workflow using free file password protector, which runs entirely in your browser. No installer. No admin rights. No registry changes.

The Workflow

1. Open Edge, Chrome, Firefox, or Brave on your Windows machine.
2. Visit the free file password protector.
3. Drag your file from File Explorer onto the drop zone.
4. Enter a strong password (use the password generator if you need one).
5. Click Encrypt & Download. The .enc file lands in your Downloads folder.

Total time: under a minute. No installer prompt. No SmartScreen warning. No "this app needs admin to run."

Why This Works on Locked-Down Machines

Group Policy can block almost everything — installers, command-line tools, USB devices — but it cannot block JavaScript running inside your already-approved browser. The Web Crypto API is part of Microsoft Edge and Chrome by default, and corporate IT departments rarely (if ever) restrict it because doing so would break HTTPS, password managers, and most modern websites.

That means a tool that uses Web Crypto can do real AES-256 encryption on a locked-down corporate laptop without tripping any policy. You are not installing software — you are using a feature of the browser that was already approved.

Sell Custom Apparel — We Handle Printing & Free Shipping

EFS, BitLocker, and Why You Still Need Per-File Encryption

Windows has two built-in encryption options:

BitLocker encrypts the entire disk. If your laptop is stolen with the power off, the disk is unreadable. But once you log in, every file is decrypted automatically — BitLocker does not protect against "I sent the wrong file to the wrong person" or "my coworker copied the file off my desktop."

EFS (Encrypting File System) ties encryption to your Windows user account. Files are decrypted automatically when you open them but unreadable to anyone else on the machine. EFS is great for local protection but has the same weakness as BitLocker for sharing: copy the file off the machine and the encryption is gone.

Per-file encryption with a password is the layer on top: it follows the file wherever it goes. Even if you email it, drop it in OneDrive, or hand it on a USB stick, the file stays encrypted until someone enters the password.

Sending the Encrypted File

Once you have the .enc file, you can send it via Outlook, Teams, OneDrive, SharePoint, or any other channel your work allows. The encryption protects the contents regardless of how it travels.

The key rule: send the password through a different channel. If the file goes through email, send the password by Teams chat or a phone call. This separation is what makes the encryption meaningful — an attacker would have to compromise two different systems to unlock the file.

Decrypting Later

To open your encrypted file later, return to the same tool, switch to the Decrypt tab, drag in the .enc file, and enter the password. You get the original file back, byte-for-byte identical to what you encrypted.

If you forget the password, there is no recovery. Use a password manager (Bitwarden is free and works in every browser without an install).

Frequently Asked Questions

Will Windows SmartScreen block this?

No. SmartScreen blocks downloaded executables. The encryption tool is a webpage — there is no .exe to download or run. You are using your already-approved browser.

Does it work on Windows 7 or 8?

Web Crypto API is supported in Chrome, Edge, and Firefox on Windows 7 and 8 — but those operating systems are end-of-life and should not be used for sensitive files. Upgrade to Windows 10 or 11 for security reasons unrelated to this tool.

Can I encrypt a file from a network drive?

Yes. Drag the file from your mapped network drive onto the drop zone. The browser reads the bytes locally, encrypts them, and offers the .enc file as a download. The original on the network drive is unchanged.