A storage device includes a non-volatile memory configured to store an encryption key and a data key encrypted with the encryption key, writes data using the data key, and reads the data using the data key; and a storage controller, wherein the storage controller is configured to receive a first security setting command which allows access to the data key, using a first password, generates a first key on the basis of the first password in response to the first security setting command, encrypts the encryption key with the first key to generate a first encrypted encryption key, encrypts the first key with the encryption key to generate an encrypted first key, and stores the first encrypted encryption key and the encrypted first key in the non-volatile memory.