password protect a usb drive without bitlocker?

VeraCrypt is the usual answer. It's free and open source. You can either encrypt the whole stick or just make an encrypted container file on it that you mount with a password, which is what I do so the rest of the drive stays normal. Downside is any PC you want to open it on needs VeraCrypt installed. If it's only a handful of tax PDFs, 7-Zip works too. Make a .7z with AES-256 and tick encrypt file names, otherwise people can still see what the files are called. Whichever one, keep a copy of the documents somewhere else. Forget that password and nobody is getting them back.