A memory controller includes a key generator, an encryption and decryption circuit, and a processor. The key generator generates a first security key and a second security key based on a write request from a host. The encryption and decryption circuit encrypts write data corresponding to the write request based on the first security key to generate encrypted write data, and encrypts the first security key based on the second security key to generate a first encrypted security key. The processor controls nonvolatile memories such that the encrypted write data, the first encrypted security key, and the second security key are programmed in at least one of the nonvolatile memories, and controls the nonvolatile memories such that a dummy program operation is performed on a page of the nonvolatile memories in which the second security key is programmed instead of erasing the encrypted write data.