Windows (10) Professional users on NTFS-formatted drives can benefit from a built-in security option in the context menu to encrypt files and folders, it's called EFS. This would be much more comfortable and elegant than any third party encryption software, which installs additional software, opens unneccessary application windows and shows encrypted folders not as folders, but as drives in new pop-up Windows Explorer windows instead (like e.g. Cryptomator does). Plus such a specifically installed encryption software might raise a flag all by itself. And Windows Bitlocker, on the other hand, "only" encrypts whole drives and partitions, but how should I know beforehand how big that drive or rather partition should be(come) in light of limited SSD memory?
So I'd prefer Window's built-in EFS encryption of single folders with flexible, dynamic sizes. The only problem with Microsoft's EFS encryption is that it's useless if someone else but yourself gets access to your Windows profile, because this very user can simply open (and change) the encrypted files and folders just like yourself and without the need of entering a password, as long as (s)he just uses the same user account (which can't be avoided under all thinkable circumstances). I tried the command line cipher /k command to issue another EFS password (that no other person using my Windows profile knows), but this doesn't seem to work this way?
But I've also read that under some circumstances, like when an administrator changes a user's (my?) password (I'm my own administrator), the (original) Windows profile user (me) loses access to his/her EFS-encrypted files, but if that user had created a recovery key before, (s)he should nevertheless retain access to the files. Maybe I could also somehow play along Microsoft's strange EFS game rules and create another user account and activate EFS encryption there (so that an adversary with access to my own Windows profile would have no access to (actually but then not officially) my own files, but how could I avoid having the same problem as the adversary then)? Maybe somehow through shared folder access rights with my 'accomplice' user? I'm not sure.
I just can't think of a smart, simple way to put this into practice so that I can quicly add confidential files on the go to an EFS-encrypted folder in my own Windows profile, but in a way that only myself and not e.g. my boss who (hypothetically) also has access to my Windows profile has access. Just like encryption was meant to work. Can you? :-)