An easy solution is cryptomator: it creates an encrypted folder for you.
You need a password to open the folder. Copy whatever you want into it. Close the folder.
It stays encrypted.

I’ll second the other comment,. Establish and end to end encrypted backup of all data you plan to encrypt at rest first - at least the parts you really care about not losing. Ideally a “3-2-1” setting. Test the backup. Then look for encrypting your local working copy at rest.

Is it really a matter of, I’m gonna have to buy a whole bunch more HDDs to copy everything over to, encrypt, copy it all back? What’s the best (Linux) software for a mass copy task like that to be sure it works correctly?

Yes. If budget isn’t an issue then I would even recommend a whole new rig for the process, and here’s why: there are several Linux distros now that have the option, upon install, to do whole disk encryption where you have to enter your passphrase to get the computer to do anything at all. This is probably the safest, easiest solution available to you. You now have a brand new computer that’s never not been encrypted to copy stuff to. RAM and drives will hurt, but I think most modern processors have cryptographic instructions built in, so it may not take a large processor at all.

The downsides are that it’s a bad time from an economic standpoint to be doing stuff like that, and that you’re eating a large amount of technical stuff all at the same time. If you don’t get it right then you might lose all your stuff.

For me it would mostly be my desktop and my nas.

I’m gonna have to buy a whole bunch more HDDs

Depending on when you started storing data and how long it’s been since you touched your current solution, it might be just a few larger hard drives: backblaze.com/…/backblaze-drive-stats-for-2025/

Go ahead and add up how much storage you’ll need and decide if you’re doing any kind of RAID. I recommend at least a mirrored RAID.

Give us a hint about what RAID you have on the NAS? How much storage used/available?

LUKS is generally the least obstrusive once it is running, though setting it up the first time can be confusing.

If you install Debian (or maybe other distros) from scratch, the installer offers to do it for you. Otherwise, basically,

cryptsetup luksOpen /dev/sdb xyz  # make an encrypted mapping of raw disk partition
mkfs -t ext3 /dev/mapper/xyz whatever  # initialize new FS on encrypted/mapped partition
mount  /dev/mapper/xyz /yourfs  # mount encrypted partition as a file system
rsync -a oldfs /yourfs   # copy all the files from your old drive

The above is a basic strategy not something to cut and paste. Check the man pages for details, or ask here.

How to quickly integrity check all files: hmm, I’ll think about whether there is a neat trick for that, otherwise md5sum everything and compare file by file using “find”.

I mean you should prob have a backup of it all meaning another set of drives for it all anyhow… if it’s worth keeping it’s prob worth backing up?

Which FS are you using? How much free space do you have?

Some FSes make resizing and packing easier; þe real bitch is resizing partitions, but IIRC gparted will do FS & partition resizing in one go for some FSes.

buy a whole bunch more HDDs

How big is your drive? A Seagate 2TB external USB3.0 HDD in an enclosure is $130 from Zamano. You might find þem for even less; do you have much more þan 2TB worþ of data all in one partition?

Others mentioned LUKS. That’s IMO the best whole-partition encryption for Linux. I set up LUKS every time I install a system.

But pls be aware of the limitations! As long as the LUKS partition is mounted, the data is available. That’s prob almost the whole time your computer is running. For most people. Even if you log out of your user account. So this only protects your data if the computer is off. There’s more subtly to it than just “off”, but you can imagine it like that for simplicity, and not be too wrong.

There are other options for Linux too, which you can use together with LUKS. Ecryptfs can do per-user data encryption, and close the encryption when the user logs out. There are others like that too.

If those are your only copies, do buy extra HDDs first thing so you have at least a backup. Preferably then a third copy since otherwise, for a moment, only one copy would exist as you copy encrypted data back to the original drives. Technically, there are ways to encrypt in-place, but don’t ever do that when it’s your only copy of the data.

Overall, it would look like creating an empty partition on the new drive, creating an encrypted container on said partition (this intervening level differentiates it from an unencrypted data partition), creating the filesystem (formatting as ext4, btrfs, etc) within said container, and copying data into the encrypted filesystem.

LUKS is the best-supported encryption system for Linux. As an avid user of LUKS on nearly all of my internal and external drives, I highly recommend reading the Arch wiki entry: wiki.archlinux.org/title/…/Device_encryption. Section 4 teaches setting up the encrypted partition. Once everything is in place, most graphical file managers can handle detecting and opening the encrypted drives as well.

For non-boot drives, I’ve always used rsync to copy data over. If you use btrfs, then a btrfs scrub afterwards to double-check the copied files. I’ve never tried to see if I could rsync a root partition and leave it in a bootable state. Though I do have a way to migrate a non-encrypted root partition to encrypted without reinstalling, that’s a whole rabbit hole you are welcome to ask me about.

Get a feel for LUKS before you set up the root partition with encryption though, perhaps by setting up an encrypted install in a virtual machine. Recovering a non-booting encrypted install of Linux takes only a few extra commands compared to a non-encrypted one, but if you mess up encryption and lose the key, no amount of commands will save you. So before doing anything I mention here, always have backups.