Quick answer: Files with a small padlock icon (or green names in File Explorer) are encrypted with Windows’ Encrypting File System (EFS). Signed in to the account that encrypted them, right-click the file or folder, choose Properties > Advanced, clear Encrypt contents to secure data and click OK twice. For a whole folder, run cipher /d /s:"C:\Folder". If you reinstalled Windows or use a different account, you need the original encryption certificate (.pfx) to get them back; administrator rights alone won’t do it.
Applies to: Windows 11 and Windows 10. EFS is part of Pro, Enterprise and Education; Home editions can’t create or remove EFS encryption.
In this guide
First: which kind of encryption is it?
| What you see | What it is | Go to |
|---|---|---|
| Padlock on file or folder icons, or green file names | EFS (per-file encryption) | Back up your key, then Properties or cipher |
| Padlock on the drive in This PC, or a BitLocker recovery screen | BitLocker or Device encryption (whole drive) | Turn off BitLocker or Device encryption |
| Strange new extensions and a ransom note | Ransomware | Files encrypted by ransomware |
| .zip, .7z or .rar that asks for a password, or a VeraCrypt volume | Encryption by another app | Use that app and its password |
Decrypting a BitLocker drive doesn’t change EFS files on it, and the other way round, so check which one you’re dealing with first.
Back up your encryption key first
EFS uses a certificate and private key stored in your user profile. If that key is lost (a reinstall, a deleted account, a reset password on some local accounts) and there’s no backup or recovery agent, Microsoft says the files can’t be recovered. Export it before you do anything else, especially before reinstalling Windows.
- Press Win + R, type
certmgr.mscand press Enter. - Open Personal > Certificates. Find the certificate whose Intended Purposes column says Encrypting File System.
- Right-click it, choose All Tasks > Export and click Next.
- Select Yes, export the private key, then Personal Information Exchange – PKCS #12 (.PFX). Leave Delete the private key if the export is successful cleared.
- Set a password, save the .pfx file to a USB drive you keep safe, and finish the wizard.
You can also run cipher /x C:\Backup\efskey to back up the current EFS certificate and key to a file. Anyone with the .pfx and its password can open your encrypted files, so don’t keep it on a shared or cloud folder. To restore it on another PC or account, double-click the .pfx and follow the import wizard.
Decrypt a file or folder in Properties
- Sign in with the account that encrypted the files.
- In File Explorer, right-click the file or folder and choose Properties.
- On the General tab, click Advanced.
- Clear Encrypt contents to secure data and click OK, then OK again.
- For a folder, choose whether to apply the change to the folder only or to the folder, subfolders and files. Pick the second to decrypt everything inside.
The padlock disappears once the file is decrypted. If new files keep getting the padlock, a parent folder still has encryption turned on: clear the setting on that folder too. On Windows 11 you can also right-click, choose Show more options and use File ownership > Personal, which decrypts the selected items.
Decrypt many files with the cipher command
For large folders, the built-in cipher command is faster. Open Command Prompt (an elevated one isn’t required for your own files) and run:
cipher /d "C:\Users\you\Documents\report.docx"
cipher /d /s:"C:\Users\you\Documents\Private"The first line decrypts one file; the second decrypts the folder and everything in its subfolders. Other switches worth knowing:
cipheron its own lists the current folder, marking encrypted items with E and unencrypted ones with U.cipher /u /nlists every encrypted file on your local drives without changing anything, so you can see what’s still encrypted./hincludes hidden and system files, which cipher skips by default.
No restart is needed afterwards.
If you can’t decrypt
- Access is denied, or the file couldn’t be decrypted. You’re not using the account and key that encrypted it. This happens after reinstalling Windows, on a new PC, or with another person’s files. Import the original .pfx (see above) and try again. Taking ownership or using an administrator account doesn’t help, because the file is locked with the key, not with permissions. On a work PC, IT may have a recovery agent that can decrypt it.
- Encrypt contents to secure data is greyed out. Usual causes: you’re on Windows Home; the drive isn’t NTFS (FAT32 or exFAT, see our FAT32 guide); the file is compressed (NTFS compression and EFS can’t both be on); or EFS has been turned off by policy (Computer Configuration > Administrative Templates > System > Filesystem > NTFS, Do not allow encryption on all NTFS volumes) or by the
NtfsDisableEncryptionsetting. - Encrypted files on a USB stick. Since Windows 10 version 1607, EFS can keep files encrypted on FAT32 and exFAT drives, so files copied to a stick may still be locked on another PC. Decrypt them on the original PC before copying, or import the key on the other PC.
There’s no legitimate tool that decrypts EFS files without the key. Programs that claim to are best avoided.
Turn off BitLocker or Device encryption
If the whole drive is encrypted, the files open normally while you’re signed in, so you only need to turn it off if you have a reason to, such as moving the drive to another PC. Make sure you have the recovery key first (it’s usually saved to your Microsoft account; see where to find your BitLocker recovery key).
- Device encryption (including Windows Home): Settings > Privacy & security > Device encryption, then switch it Off.
- BitLocker (Pro and higher): right-click the drive in File Explorer, choose Manage BitLocker (under Show more options on Windows 11), then Turn off BitLocker and confirm.
- Command line: in an elevated Command Prompt,
manage-bde -off C:decrypts the drive andmanage-bde -statusshows progress.
Decryption runs in the background and can take a long time on a large drive. Keep the PC plugged in. If you only want to pause protection for a BIOS update, suspending BitLocker is the better option.
Files encrypted by ransomware or another app
Windows can’t decrypt files encrypted by ransomware. Disconnect the PC from the network, scan for malware to remove the infection (this stops further damage but doesn’t decrypt anything), then restore the files from a backup, OneDrive version history or File History. The No More Ransom project, run by Europol and security partners, publishes free decryptors for some ransomware families. Be wary of paid “recovery” services and don’t pay the ransom; there’s no guarantee you’ll get the files back.
Archives and containers made by other tools (7-Zip, WinRAR, VeraCrypt) are opened with that tool and the password used to create them.
Related guides
- BitLocker suspended: what it means and how to resume protection
- Dell BitLocker recovery key: where to find it and why it appears
- How to scan for malware on Windows 11 and 10
- How to format a USB drive to FAT32 in Windows 11 and 10
Official sources:
Leave a Reply