VeraCrypt: The Free Disk Encryption Where One Man Wrote 76% of Last Year's Commits
Downloads verified live, a 54-week gap between stable releases, and the month Microsoft switched off its code-signing account without warning.
VeraCrypt -- full-disk and container encryption. Encrypts a whole system drive, an external disk, or a file that mounts as a drive, with no account and no key held by anyone else.
Alternative to: Symantec Endpoint Encryption at $41.24 per device per year on a published government reseller price list; ESET Full Disk Encryption at $33.80 per seat per year at 1-10 seats, falling to $13.50 at 5,000+; Sophos Central Device Encryption at $24.57 per seat per year retail. Windows BitLocker is free only if you
already run Windows Pro -- it is not available on Home, and a Windows 11 Pro licence lists at $199.99.
Cost to run: free, on an unlimited number of machines, by the project's own licence terms. The costs that remain are operational: no central key escrow, no managed recovery, no support contract.
Licence: dual -- Apache License 2.0 and TrueCrypt License 3.0. GitHub shows "Other" because the combination is non-standard. Free for commercial use; the project's FAQ says so explicitly. You may not name a derivative anything confusable with VeraCrypt or TrueCrypt.
Runs on: Windows x64 and ARM64, macOS Monterey 12+ including Apple Silicon, Linux (AppImage, .deb, .rpm, Raspberry Pi), FreeBSD 14+ and OpenBSD 7.8+.
Requires: administrator or root rights. A signed kernel driver on Windows. macFUSE or FUSE-T on macOS, plus Full Disk Access granted by hand. Expect friction with Secure Boot on system-encrypted machines.
Traction: 11,306 stars · 1,310 forks · 120 contributors · 2,938 commits on master · 436 open issues / 842 closed.
Liveness: live -- stable release 1.26.29 shipped June 2026, last commit 2026-07-15, warrant canary refreshed 2026-07-31, and all three installers I pulled returned real files rather than 404s.
Maturity: 1.26.29, descended from TrueCrypt 7.1a. Audited once, by Quarkslab in 2016, at version 1.18. Two CVEs fixed in the current release.
Links: repo · veracrypt.io · Trendshift peak #1, 2026-06-29
Figures as of 2026-08-18.
What it does
VeraCrypt turns a disk, a partition, or a single file into an encrypted volume. Mount it with the right password and it behaves like an ordinary drive. Unmount it and it is a wall of noise.
Three modes matter. System encryption protects a whole Windows boot drive with a pre-boot password, so a stolen laptop is a brick. Container files are single files that mount as drives, which travel across operating systems and cloud storage without special handling. Non-system partition encryption covers external and secondary disks.
It also does hidden volumes: a second encrypted volume nested inside the free space of the first, with its own password, so that surrendering one password does not reveal the other. That feature carries caveats, covered below.
The distinguishing property is that nobody else holds a key. No vendor, no cloud, no recovery portal. That is the entire pitch, and it is also the entire operational burden.
What it replaces, and what that costs
The comparison is genuinely mixed here, and pretending otherwise would make the entry worthless.
Apple FileVault is free. It ships with every copy of macOS and costs nothing. On a Mac, VeraCrypt is not saving anyone money -- it is offering a different trade, because Apple can hold your recovery key in iCloud and VeraCrypt cannot hold anything at all.
Windows BitLocker is free if you already have the right edition. It requires Windows 11 or 10 Pro, Enterprise or Education. It is not available on Windows Home. Microsoft's own Store lists Windows 11 Pro at $199.99. So for a machine already running Pro, BitLocker costs nothing and VeraCrypt replaces no bill. For a fleet of Home machines, the arithmetic changes sharply -- 100 Home laptops upgraded to Pro is 100 × $199.99 = $19,999 one-time, before anyone encrypts anything.
The managed products are where the recurring money is.
Symantec Endpoint Encryption -- $41.24 per device per year, subscription with support, from a North Carolina state reseller price list negotiated through Carahsoft. Broadcom's own pages hide the number.
ESET Full Disk Encryption -- published and tiered, no sales call required: $33.80 per seat per year at 1-10 seats, down to $13.50 at 5,000+.
Sophos Central Device Encryption -- $24.57 per seat per year retail in the 10-24 client tier, and as low as $4.93 per device per year on a negotiated government contract. Worth knowing what "per seat" actually swings by. Note that Sophos CDE is a management layer over native BitLocker and FileVault, not its own cryptography.
WinMagic SecureDoc -- no published pricing at all.
For 100 laptops over one year, at list:
Symantec Endpoint Encryption -- 100 × $41.24 = $4,124
ESET Full Disk Encryption (small-tier rate) -- 100 × $33.80 = $3,380
Sophos Central Device Encryption (retail) -- 100 × $24.57 = $2,457
VeraCrypt -- $0
What that $2,457 to $4,124 buys, and VeraCrypt does not provide, is the console: central key escrow, remote recovery, policy enforcement, compliance reporting, and somebody to call. VeraCrypt's own FAQ is direct about this -- an admin must manually back up each volume header before handing over a machine, or there is no reset path at all.
So the honest sentence is this. VeraCrypt does not reduce a Mac's encryption bill, because FileVault was already free. It does not reduce a Windows Pro fleet's bill, because BitLocker was already included. It replaces a real recurring bill only where a managed encryption product is currently being paid for -- and in exchange it hands you back the work that product was doing.
Is it still alive?
Live, and the qualifier matters more than the verdict.
Version 1.26.29 shipped in June 2026. The previous numbered stable release, 1.26.24, was 2025-05-31 -- a gap of roughly 54 weeks, with a beta cycle in between. The last commit to master was 2026-07-15, a Swedish translation merge. The PGP-signed warrant canary was refreshed 2026-07-31 with no warrants reported.
The downloads download. I pulled three installers directly: VeraCrypt.Setup.1.26.29.exe returned HTTP 200 and 40,832,408 bytes; the macFUSE VeraCrypt_1.26.29.dmg returned 20,012,255 bytes; the FUSE-T build recommended for Apple Silicon returned 20,012,297 bytes. Real files, no 404s.
The bus factor is the finding. Over the trailing twelve months, 25 people committed at least once. But maintainer Mounir Idrassi made 197 of roughly 260 recent commits -- about 76%. Everyone else contributed between one and nineteen, mostly translations. The copyright headers moved from IDRIX to AM Crypto in 2026, and AM Crypto is Idrassi's own one-person consulting practice, not a staffed company.
That concentration stopped being theoretical in April 2026, when Microsoft suspended the developer account VeraCrypt used to sign its Windows kernel drivers -- with no warning and no notification. Windows will not load an unsigned kernel driver, so for about a week the project could not ship a signed update at all. The account was reinstated. The single point of failure was not.
Trendshift records VeraCrypt reaching #1 on GitHub Trending across all languages on 2026-06-29, which is when the 1.26.29 release landed.
What people say
Reddit was unreachable from the research sandbox; nothing from it is quoted here. Hacker News permalinks below. HN publishes story points, not per-comment scores, so only story-level figures are given.
The performance complaint, which is the most common substantive criticism:
"Sadly VeraCrypt is not optimized for SSDs and has a massive performance impact compared to Bitlocker for full disk encryption because the SSD doesn't know what space is used/free with VeraCrypt."
-- debazel, news.ycombinator.com/item?id=46739255
A long-time user who moved on:
"I've used countless encryption 'schemes' over the years, from True/Vera-Crypt to encrypted sparse bundles/images, and none have ever really felt right... These days i tend to use Cryptomator instead."
-- 8fingerlouie, on a thread at 384 points, news.ycombinator.com/item?id=37735299
And on the signing-account suspension, from Jason Donenfeld, the maintainer of WireGuard, whose account was caught in the same sweep -- a 1,297-point thread:
"This is the same problem I'm currently facing with WireGuard. No warning at all, no notification. One day I sign in to publish an update, and yikes, account suspended... That's kind of crazy: what if there were some critical RCE in WireGuard, being exploited in the wild, and I needed to update users immediately?... Microsoft would have my hands entirely tied."
-- zx2c4, news.ycombinator.com/item?id=47687884
The catch
No central key management, by design and by consequence. VeraCrypt's own FAQ confirms there is no admin console. An IT admin must back up each volume header manually before deployment or a forgotten password is permanent.
One maintainer. About 76% of the last year's commits came from one person, working through a solo consulting practice.
One code-signing chain, already proven fragile. April 2026 demonstrated what happens when a platform vendor pulls it.
macOS is the rough edge. Open issues as of August 2026 include mount crashes with macFUSE 5.3.3, FUSE-T processes persisting after dismount, and FSKit described as unusable with the current backend.
The audit is ten years old. Quarkslab audited version 1.18 in 2016, funded by OSTIF with donations from DuckDuckGo and VikingVPN. It found 8 critical, 3 medium and 15 low or informational issues, nearly all fixed in 1.19 -- including removing the unsafe GOST cipher and a bootloader password-length leak. There has been no second full third-party audit since. The project does run continuous static analysis and fixed two named CVEs in the current release.
Plausible deniability has documented limits. The project itself notes an adversary inspecting the disk can still detect a VeraCrypt boot loader, and that enabling TRIM leaves unused sectors visibly zeroed, which weakens the hidden-volume story.
Release cadence is slow. 54 weeks between the last two stable releases, against 436 open issues.
Credits
Mounir Idrassi (idrassi, @idrassi) of AM Crypto, in Kobe, Japan -- creator, and by a wide margin the person who writes this software. The project account @VeraCrypt_IDRIX. The translators who made up most of the other contributions in the last year, including NickWick13. Quarkslab and OSTIF for the 2016 audit, funded by DuckDuckGo and VikingVPN. The security researcher credited as "vastblast" for the two CVEs fixed in 1.26.29. The Hacker News commenters quoted above. Pricing verified against Microsoft's Store, published reseller price lists and ESET's tiered list; peak rank from Trendshift.