iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Volume encryption protects an entire NAS volume; shared-folder encryption protects only the folders you select. On a Synology system, an encrypted volume can include shared folders, LUNs, package data, files, folders, and metadata. Shared-folder encryption creates narrower encrypted areas with their own lock, unlock, and key boundaries. The right choice depends on whether you need blanket protection or controlled isolation for particular data.
Both options mainly address data at rest: they reduce the value of drives or a whole NAS that someone steals or removes. Neither replaces user permissions, strong administrator authentication, network encryption, malware protection, or encrypted backups. Encryption also changes how applications, snapshots, protocols, restores, and emergency access work, so decide the scope and key process before creating storage.
What each encryption method protects
Volume encryption
Volume encryption applies encryption to the storage volume as a unit. On Synology, the documented scope includes shared folders, package data, LUNs, files, folders, and metadata stored on that volume. This broad scope reduces the chance that an overlooked share or service directory remains in clear text. It is particularly useful when most or all information on a volume has the same sensitivity and recovery policy.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Because the encrypted boundary is the volume, unlocking it can make many services and datasets available at once. A lost volume key can therefore affect every workload on that volume, not just one project. Volume encryption may also require a supported NAS model, a particular operating-system release, or creation of a new volume rather than conversion of an existing one.
#1 Best Overall
- Entry-level NAS Personal Storage：UGREEN NAS DH2300 is your first and best NAS made easy. It is designed for beginners who want a simple, private way to store videos, photos and personal files, which is intuitive for users moving from cloud storage or external drives and move away from scattered date across devices. This entry-level NAS 2-bay perfect for personal entertainment, photo storage, and easy data backup (doesn't support Docker or virtual machines).
- Set Your Devices Free, Expand Your Digital World: This unified storage hub supports massive capacity up to 64TB.*Storage drives not included. Stop Deleting, Start Storing. You can store 22 million 3MB images, or 2 million 30MB songs, or 43K 1.5GB movies or 67 million 1MB documents! UGREEN NAS is a better way to free up storage across all your devices such as phones, computers, tablets and also does automatic backups across devices regardless of the operating system—Window, iOS, Android or macOS.
- The Smarter Long-term Way to Store: Unlike cloud storage with recurring monthly fees, a UGREEN NAS enclosure requires only a one-time purchase for long-term use. For example, you only need to pay $459.98 for a NAS, while for cloud storage, you need to pay $719.88 per year, $2,159.64 for 3 years, $3,599.40 for 5 years. You will save $6,738.82 over 10 years with UGREEN NAS! *NAS cost based on DH2300 + 12TB HDD; cloud cost based on 12TB plan (e.g. $59.99/month).
- Blazing Speed, Minimal Power: Equipped with a high-performance processor, 1GbE port, and 4GB RAM on Board, this NAS handles multiple tasks with ease. File transfers reach up to 125MB/s—a 1GB file takes only 8 seconds. Don't let slow clouds hold you back; they often need over 100 seconds for the same task. The difference is clear.
- Let AI Better Organize Your Memories: UGREEN NAS uses AI to tag faces, locations, texts, and objects—so you can effortlessly find any photo by searching for who or what's in it in seconds. It also automatically finds and deletes similar or duplicate photo, backs up live photos and allows you to share them with your friends or family with just one tap. Everything stays effortlessly organized, powered by intelligent tagging and recognition.
Shared-folder encryption
Shared-folder encryption applies to selected shared folders. You can leave general-purpose data unencrypted while placing finance, personnel, research, or other sensitive material in separately protected folders. Separate folders can provide independent keys and lock or unlock boundaries, which is useful when departments have different custodians or when one dataset must be offline while others remain available.
The smaller boundary has consequences. Encrypted folders can have filename, path, protocol, snapshot, backup, or application restrictions that do not apply to ordinary folders. A service may need the folder to be unlocked before it can start, and an application that expects to rename a path or access it through a particular protocol may not work as designed.
Scope comparison
| Characteristic | Volume encryption | Shared-folder encryption |
|---|---|---|
| Protected boundary | Entire volume, including the data types supported by the vendor | Only the selected shared folders |
| Typical Synology scope | Shared folders, LUNs, package data, files, folders, and metadata on the encrypted volume | Selected shared folders and their contents |
| Keys and availability | One volume-level unlock decision can affect many services and datasets | Folders can have separate keys and can be locked or unlocked independently |
| Best fit | Consistent protection for nearly everything stored in a volume | Isolation for a subset of sensitive data or separate departmental controls |
| Main exposure if misconfigured | An unencrypted volume elsewhere on the NAS may be overlooked | Data outside the selected folders remains unencrypted |
The exact scope is vendor- and version-dependent. Read the storage-system documentation for the NAS model, filesystem, and firmware you will run; the words “volume” and “shared folder” do not guarantee identical behavior across platforms.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesWhat threat does NAS encryption address?
Encryption is most valuable when an attacker can obtain the storage media or the NAS itself but does not have the unlock key. If drives are removed and analyzed on another machine, encrypted blocks should not reveal usable files without the key. The same applies to a retired drive that was not securely erased, although encryption is not a substitute for a documented drive-retirement process.
Encryption does not automatically protect data while a legitimate user or service has unlocked it. A compromised account can still read files through normal permissions. Ransomware running with write access can still encrypt or delete accessible files. An administrator who can unlock a volume can expose its contents. Use least-privilege accounts, multifactor authentication where available, network segmentation, secure protocols, patching, and immutable or offline backups alongside storage encryption.
Rank #2
- 【Advanced Home Data & Media Hub】For advanced home users who need phone backup, file storage, and centralized data management. Centralize family photos, 4K videos, movies, computer backups, and personal files in one place while running multiple apps for home entertainment and everyday data management. Suitable for households with growing digital libraries and multiple NAS use cases.
- 【Built for Creators, Media Servers & Advanced Apps】Powered by the Intel N100 Quad-Core CPU, 8GB DDR5 RAM, 2.5GbE networking, and dual M.2 NVMe slots, DXP2800 handles large files and heavier workloads with ease. Run Docker, virtual machines, and media server applications compatible with Plex—ideal for content creators, tech enthusiasts, and advanced home users managing 4K videos, RAW photos, personal media libraries, and multiple NAS apps.
- 【Up to 80TB for Growing Digital Libraries】 Supports up to 80TB of storage using two HDD bays and two M.2 NVMe SSD slots for family photos, movies, RAW photos, 4K videos, work files, and device backups. AI photo management supports recognition of people, objects, scenes, and locations, album organization, and duplicate photo detection. HDDs and SSDs are not included.
- 【AI-powered Home Surveillance】Turn DXP2800 into a centralized home surveillance hub by connecting compatible network cameras and storing recordings locally on your NAS. AI-powered features include Face Recognition, People Detection, and Pet Detection, helping advanced home users review important events more efficiently while managing home surveillance and personal data in one place.
- 【One data Center Across Your Devices】Keep files from desktops, laptops, phones, tablets, and other devices together instead of scattered across cloud accounts and external drives. Access, back up, organize, and share data across Windows, macOS, Android, iOS, web browsers, and compatible smart TVs—ideal for creators and advanced home users working across multiple devices.
Encryption of the source NAS also does not automatically encrypt backup media. A backup job can copy readable files to an unencrypted USB disk, another NAS, cloud storage, or a removable cartridge. Treat every destination as a separate protection boundary and verify its encryption and key-recovery design.
When volume encryption is the better choice
- Uniform sensitivity: Most or all data on the volume requires the same at-rest protection.
- Coverage of service data: You want package data, LUNs, metadata, and shared folders covered rather than relying on a list of folders that someone must maintain.
- Lower omission risk: New shares created on the encrypted volume inherit the volume boundary instead of requiring a separate encryption decision.
- Centralized operations: A single documented unlock and recovery process is easier for a small team than many folder keys.
Confirm that the NAS supports volume encryption before designing around it. On Synology, the feature requires DSM 7.2 or later and a supported model. Availability and implementation can vary by filesystem, volume type, and installed services. A broad boundary can also make startup and emergency recovery more consequential: losing or withholding the volume key can stop every dependent service at once.
When shared-folder encryption is the better choice
- Only some data is sensitive: General media, public project files, and cache data do not need the same lock boundary as payroll or legal records.
- Separate custodians: Departments or projects need independent keys and the ability to lock one dataset without taking down others.
- Platform limitations: The NAS does not support suitable volume encryption, or the existing storage design cannot be replaced.
- Different availability schedules: A highly confidential folder should remain locked except during a controlled workflow.
Before selecting this option, test every application and protocol that will use the folder. Narrow protection is useful only if the resulting path, filename, access, and backup behavior fit the workload.
Compatibility and vendor-specific limits
Synology
Synology distinguishes volume encryption from shared-folder encryption in its storage documentation. Current published limits list a maximum filename length of 255 characters for volume encryption and 143 characters for shared-folder encryption. A file tree that works in an ordinary folder can therefore fail after migration to an encrypted shared folder if applications generate long names or deeply nested paths.
Synology documentation states that volume encryption requires DSM 7.2 or above on supported models. DSM 7.3 specifications list support for up to 218 encrypted shared folders; that figure is a platform specification for that release, not a guarantee that every model, filesystem, or workload will perform identically. Check the model-specific compatibility list and the release notes before deployment.
Rank #3
- Your Personal Streaming Server - Build your own Netflix-style media library and stream 4K movies, shows and photos to any device without monthly fees
- Create Your Own Cloud - Store your entire photo, video and music collection; access from anywhere with fast 282 MB/s transfer speeds
- Creator-Grade Backup Solution - Protect your irreplaceable content with automated backups to cloud services, external drives and remote NAS
- Multi-Layered Data Protection - Combine RAID redundancy, automated backups and snapshot technology to prevent data loss from any cause
- Smart Home Surveillance - Support up to 30 IP cameras with AI detection, instant alerts and secure remote monitoring
QNAP
QNAP documentation for QTS 5.2.x describes shared-folder encryption using 256-bit AES. QNAP behavior depends on the QTS or QuTS hero release, NAS model, storage type, and the folder’s configuration. Its guidance recommends shared-folder encryption when only particular departmental or sensitive data requires isolation.
Recommended Free Tools
QNAP documentation also notes that an encrypted-folder path cannot be changed and that some encrypted folders cannot be accessed through NFS. Any service that stores an absolute path, exports NFS, or expects to rename a share should be tested on a non-production folder before migration. Do not infer that a QNAP feature has the same scope or limits as a similarly named Synology feature.
Other NAS platforms
Some systems encrypt a filesystem, dataset, pool, or volume rather than a “shared folder.” Others encrypt only selected directories or rely on an external key manager. Compare the actual encrypted object, what metadata is covered, when keys are requested, and which protocols and applications are supported. A vendor’s marketing label is less important than the documented boundary and recovery procedure.
Filename, path, and protocol implications
Encryption can impose constraints at the storage layer or in the NAS service that presents the share. The Synology filename limits above are a concrete example. QNAP’s documented path restriction means that moving or renaming an encrypted folder may require a new folder and a controlled data migration rather than a simple settings change.
Protocol support must be checked separately. A folder that is available through SMB may have restrictions through NFS, FTP, WebDAV, an object-storage gateway, or a container runtime. Applications that scan a directory at boot may fail if the folder is still locked. Indexers, media servers, virtual machines, databases, and backup agents can each have their own assumptions about path permanence and availability.
Rank #4
- Entry-level NAS Home Storage: The UGREEN NAS DH4300 Plus is an entry-level 4-bay NAS that's ideal for home media and vast private storage you can access from anywhere and also supports Docker but not virtual machines. You can record, store, share happy moment with your families and friends, which is intuitive for users moving from cloud storage, or external drives to create your own private cloud, access files from any device.
- Smart Photo Backup & AI Album: Automatically back up photos and videos from your phone in real time and keep growing family memories organized with AI-powered photo albums. Semantic search, custom learning, and recognition of people, objects, pets, and similar photos help you quickly find the moments you want. Duplicate photo removal also helps keep your library organized—ideal for families and users with large photo collections.
- User-Friendly App & Easy Setup: Connect quickly via NFC, set up simply and share files fast on Windows, macOS, Android, iOS, web browsers, and smart TVs. You can access data remotely from any of your mixed devices. What's more, UGREEN NAS enclosure comes with beginner-friendly user manual and video instructions to ensure you can easily take full advantage of its features.
- More Cost-effective Storage Solution: Unlike cloud storage with recurring monthly fees, A UGREEN NAS enclosure requires only a one-time purchase for long-term use. For example, you only need to pay $629.99 for a NAS, while for cloud storage, you need to pay $719.88 per year, $1,439.76 for 2 years, $2,159.64 for 3 years, $7,198.80 for 10 years. You will save $6,568.81 over 10 years with UGREEN NAS! *NAS cost based on DH4300 Plus + 12TB HDD; cloud cost based on 12TB plan (e.g. $59.99/month).
- Your Data, You Control：No third-party clouds, no hidden access, UGREEN NAS provides a more secure and private data storage solution. It stores data locally on your private hard drives and does automatic backups. Thus, you can keep full control over it. The advanced encryption is TRUSTe certified in the United States and is awarded the first (and only) ETSI EN 303 645 certification mark for NAS products by TÜV SÜD Group.
- Inventory the longest filenames and deepest paths before migration.
- List every protocol and service that reads or writes the data.
- Test create, rename, delete, lock, unlock, restart, and restore operations.
- Record whether the application needs the folder available before the NAS starts its services.
Keys: the operational center of the design
The encryption algorithm is only as useful as the key process. Export the recovery key when the NAS offers that function, and verify that the exported file can be used in a recovery exercise. Keep the only copy away from the NAS and outside the same rack or physical equipment. QNAP explicitly warns not to store the only key file on the same NAS, in an unencrypted share, or in the same equipment rack.
Use at least two protected copies with different failure domains, such as an offline removable device held in a secure location and a separately protected organizational key-management system. Control who can retrieve each copy, log access, and document the owner and successor for every key. An encrypted USB device can be useful for offline custody, but it must itself be protected and tested; an unencrypted stick left beside the NAS is not a meaningful separation.
Automatic unlock versus manual unlock
Saving a key on the NAS can automatically unlock a shared folder after a restart. This improves unattended recovery and keeps scheduled services running, but a thief who obtains both the NAS and its stored key may bypass the intended lock. If automatic unlock is disabled, an administrator must provide the key manually after reboot or after the folder is locked, which improves separation but creates an availability obligation.
Choose deliberately based on the threat model. For a server in a controlled facility with frequent unattended restarts, automatic unlock may be acceptable when the stored key is separately protected by the platform. For highly sensitive data, manual unlock can ensure that a powered-off or restarted NAS does not expose the folder until an authorized person is present.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Backups, snapshots, and replication
Map each encrypted source to the protection state of every copy. A backup application may read plaintext after the NAS unlocks a folder and then write plaintext to its destination unless destination encryption is enabled. Replication can also reproduce data without reproducing the source key policy. Document whether the destination has its own encryption, who holds that key, and how a restore works if the source NAS is unavailable.
Best Value
- Value NAS with RAID for centralized storage and backup for all your devices. Check out the LS 700 for enhanced features, cloud capabilities, macOS 26, and up to 7x faster performance than the LS 200.
- Connect the LinkStation to your router and enjoy shared network storage for your devices. The NAS is compatible with Windows and macOS*, and Buffalo's US-based support is on-hand 24/7 for installation walkthroughs. *Only for macOS 15 (Sequoia) and earlier. For macOS 26, check out our LS 700 series.
- Subscription-Free Personal Cloud – Store, back up, and manage all your videos, music, and photos and access them anytime without paying any monthly fees.
- Storage Purpose-Built for Data Security – A NAS designed to keep your data safe, the LS200 features a closed system to reduce vulnerabilities from 3rd party apps and SSL encryption for secure file transfers.
- Back Up Multiple Computers & Devices – NAS Navigator management utility and PC backup software included. NAS Navigator 2 for macOS 15 and earlier. You can set up automated backups of data on your computers.
Snapshots are not automatically an independent security boundary. They may reside on the same encrypted volume, inherit the same key, or be exposed through administrative tools after unlock. Verify how snapshots, immutable retention, replication, and cloud synchronization interact with the chosen encrypted object. Test a restore to replacement hardware or a clean test volume; a backup that cannot be decrypted during an incident is not a recoverable backup.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Performance and capacity expectations
Encryption consumes CPU time and can change latency, throughput, power use, and cache behavior. There is no single cross-vendor performance number that applies to every NAS. Results depend on the processor and hardware acceleration, filesystem, RAID layout, workload, protocol, number of concurrent users, and the vendor’s implementation.
Measure the operations that matter to you: large sequential transfers, small random files, database transactions, virtual-machine storage, backup windows, and rebuild or scrub activity. Run the test with the intended encryption scope and services enabled. Do not assume that a result from one model or firmware release predicts another, and do not disable encryption solely to chase a benchmark without assessing the theft risk.
Free tools Windows power users keep installed
One-click scans. No signup required.
A deployment procedure that avoids common mistakes
- Define the threat and compliance boundary. Decide which data must be protected if drives, a powered-off NAS, or a backup device leaves the building. Separate at-rest requirements from account, network, and ransomware controls.
- Inventory data and dependencies. Record shares, LUNs, package data, databases, containers, virtual machines, snapshots, replication jobs, backup targets, protocols, and applications that use each path.
- Confirm platform support. Check the exact NAS model, DSM/QTS/QuTS hero release, filesystem, volume type, and feature limits. Confirm whether volume encryption is available and whether it requires a newly created volume.
- Select the boundary. Use a volume when consistent coverage and simple omission control outweigh broad unlock consequences. Use shared folders when sensitivity, custodianship, or availability must be separated.
- Run a compatibility pilot. Copy representative long paths, filenames, permissions, database files, and application data to a test area. Exercise every protocol, including NFS if relevant, and test a reboot with the folder locked.
- Create and export keys. Generate the encryption key through the NAS interface, export the recovery key, and place protected copies in separate failure domains before loading production data.
- Migrate with a rollback plan. Keep a verified backup, schedule downtime where applications require it, preserve permissions and ownership, and confirm checksums or application-level validation after copying.
- Configure backup encryption independently. Enable encryption at each destination, store its recovery material separately, and perform a full restore test.
- Document operations. Record unlock order, automatic-unlock settings, key custodians, emergency contacts, supported protocols, and the procedure for replacing a failed NAS or drive.
- Review after changes. Recheck the design when adding a share, installing a package, changing firmware, moving a path, enabling replication, or changing the backup target.
Recovery and failure scenarios
The NAS restarts and services do not come online
Determine whether the encrypted volume or folder is still locked. Supply the recovery key through the documented management interface, then start or verify dependent services. If automatic unlock was expected, check whether the stored key was removed, became inaccessible, or was invalidated by a configuration change.
A key file is missing
Do not delete or reinitialize the encrypted object while investigating. Locate the separately stored recovery copy and confirm that it belongs to the correct volume or folder. If no usable key exists, vendor support may not be able to recover encrypted contents; encryption is designed to prevent access without the key.
A drive or entire NAS is stolen
Assume that every unencrypted volume, share, and backup destination is readable. Rotate credentials, revoke management sessions, notify the relevant security or privacy contacts, and preserve logs. Encrypted volumes or folders should remain protected only if the attacker does not also obtain an accessible key or an automatically unlocked running system.
An application cannot access an encrypted folder
Check that the folder is unlocked before the service starts, that the service account still has permission, and that the application uses a supported protocol and unchanged path. For NFS or path-sensitive workloads, consult the platform’s restrictions and migrate to a supported access method rather than repeatedly changing the encrypted path.
Practical choices by scenario
| Scenario | Usually appropriate starting point | Reason to reconsider |
|---|---|---|
| Small office where nearly every file is confidential | Volume encryption on a supported platform | Use separate folders if some services must remain available while sensitive data is locked |
| Mixed media and a small personnel repository | Shared-folder encryption for the personnel data | Use volume encryption if unencrypted service data or new shares would create unacceptable omissions |
| Several departments with separate custodians | Multiple encrypted shared folders with documented key ownership | Use a volume boundary when centralized recovery is more important than independent locks |
| NAS used for NFS workloads | Confirm protocol support before choosing either method | QNAP documents restrictions for some encrypted folders over NFS; an unsupported design may require a different layout |
| Unattended remote site | Choose an explicit automatic-unlock and physical-security policy | Manual unlock may leave services offline after a power event; automatic unlock may weaken protection if the device and stored key are both compromised |
Bottom line
Choose volume encryption when you need consistent, broad coverage for a volume and accept a shared unlock and recovery boundary. Choose shared-folder encryption when only selected data needs protection, separate keys are valuable, or the platform does not offer a suitable volume option. In either case, verify model and firmware support, test application and protocol compatibility, export and separately protect recovery keys, and encrypt backup media independently. The decision is not simply “whole NAS versus one folder”; it is a choice of protection scope, availability behavior, operational complexity, and recovery responsibility.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
