en	[[!meta title="Creating and using LUKS encrypted volumes"]]

en	Introduction to LUKS

en	The simplest way to carry around the documents that you want to use with Tails encrypted is to use the [[Persistent Storage|persistent_storage]].

en	You can create other encrypted volumes using *LUKS* to encrypt, for example, another USB stick or an external hard disk. *LUKS* is the standard for disk encryption in Linux.

en	The *Disks* utility allows you to create encrypted volumes.

en	The GNOME desktop allows you to open encrypted volumes.

en	<div class="attack">
zh-hans	<div class="tip">

en	Such encrypted volumes, like the Persistent Storage, are not hidden.

en	An attacker in possession of the device can know that there is an encrypted volume on it. Take into consideration that you can be forced or tricked to give out its passphrase.

en	Comparison between LUKS and VeraCrypt

en	You can also open *VeraCrypt* encrypted volumes in Tails. *VeraCrypt* is a disk encryption tool for Windows, macOS, and Linux. [[See our documentation about *VeraCrypt*.|veracrypt]]

en	Creating an encrypted partition
zh-hans	Erstellen Sie eine neue, verschlüsselte Partition

en	Choose **Apps&nbsp;▸ Utilities&nbsp;▸ Disks** to open the *Disks* utility.

en	Identifying your external storage device
zh-hans	Identifizieren Sie das externe Speichermedium

en	The *Disks* utility lists all the current storage devices on the left side of the screen.

en	Plug in the external storage device that you want to use.

en	A new device appears in the list of storage devices. Click on it.

en	[[!img storage_devices_after.png class="screenshot" alt=""]]

en	1. Check that the description of the device on the right side of the screen corresponds to your device: its brand, its size, etc.

en	Formatting the device
zh-hans	Formatieren Sie das Medium

en	Click on the [[!img lib/view-more.png alt="Drive Options" class="symbolic" link="no"]] button in the title bar and choose **Format Disk** to erase all the existing partitions on the device.

en	In the **Format Disk** dialog:

en	If you want to overwrite all data on the device, choose **Overwrite existing data with zeroes** in the **Erase** menu.

en	<div class="caution"> <p>Overwriting existing data does not erase all data on flash memories, such as USB sticks and SSDs (Solid-State Drives).</p>

en	See the [[limitations of file deletion|doc/encryption_and_privacy/secure_deletion#spare]].

en	Choose **Compatible with all systems and devices (MBR/DOS)** in the **Partitioning** menu.

en	Click **Format**.

en	In the confirmation dialog, make sure that the device is correct.

en	Creating a new encrypted partition
zh-hans	Erstellen Sie eine neue, verschlüsselte Partition

en	Now the schema of the partitions in the middle of the screen shows an empty device:

en	[[!img empty_device.png class="screenshot" alt="Free Space 123 GB"]]
zh-hans	[[!img places_secret.png link=no alt="Places&nbsp;▸ secret"]]

en	Click on the **[[!img lib/list-add.png alt="Create partition" class="symbolic" link="no"]]** button to create a new partition on the device.

en	1. Configure the various settings of your new partition in the partition creation assistant:

en	In the **Create Partition** screen:

en	**Partition Size**: you can create a partition on the whole device or only on part of it.

en	In the example below, we are creating a partition of 4.0 GB on a device of 8.1 GB.

en	In the **Format Volume** dialog:

en	**Volume Name**

en	You can give a name to the partition. This name remains invisible until the partition is open but can help you to identify it during use.

en	**Erase**

en	You can choose to overwrite existing data on the partition.

en	<div class="caution">
zh-hans	<div class="tip">

en	Overwriting existing data does not erase all data on flash memories, such as USB sticks and SSDs (Solid-State Drives).

en	**Type**

en	Choose **Internal disk for use with Linux systems only (Ext4)** and **Password protect volume (LUKS)**.

en	In the **Set Password** screen:

en	**Password**: type a passphrase for the encrypted partition and repeat it to confirm.

en	<div class="tip">

en	We recommend choosing a long passphrase made of 5 to 7 random words. Learn about the maths behind memorizable and secure passphrases.

en	<div class="caution"> <p>It is impossible to recover your passphrase if you forget it!</p>

en	<p>To help you remember your passphrase, you can write it on a piece of paper, store it in your wallet for a few days, and destroy it once you know it well.</p> </div>

en	Then click **Create**.

en	Creating the partition takes from a few seconds to a few minutes. After that, the new encrypted partition appears in the volumes on the device:

en	[[!img encrypted_partition.png class="screenshot" alt="Partition 1 4.0 GB LUKS / Filesystem 4.0 GB Ext4"]]
zh-hans	[[!img create_partition.png link=no alt="Create partition on…"]]

en	If you want to create another partition in the free space on the device, click on the free space and then click on the **[[!img lib/list-add.png alt="Create partition" class="symbolic" link="no"]]** button again.

en	Using the new partition
zh-hans	Benutzen Sie die neue Partition

en	You can open this new partition from the sidebar of the *Files* browser with the name you gave it.

en	Opening an existing encrypted partition
zh-hans	Öffnen Sie eine bestehende, verschlüsselte Partition

en	When you plug in a device that has an encrypted partition, Tails offers to unlock the encryption automatically.

en	Plug in the external storage device that has the encrypted partition.

en	A dialog appears, asking for the passphrase to unlock the partition.

en	[[!img unlock.png class="screenshot" alt="Authentication Required"]]

en	Enter the passphrase of the partition in the password prompt and click **Unlock**.

en	If you turn on the option **Remember Password**, Tails remembers the passphrase of this partition only until you shut down. The passphrase is not stored in your Persistent Storage.

en	After unlocking, you can access the content of the partition from the sidebar of the *Files* browser.

en	After you finished using the partition, click on the [[!img lib/media-eject.png alt="Eject" class="symbolic" link="no"]] button next to the partition in the sidebar of the *Files* browser to eject the partition safety and lock again the encryption.

en	Opening encrypted volumes from other operating systems
zh-hans	Öffnen verschlüsselter Laufwerke auf anderen Betriebssystemen

en	It is possible to open such encrypted volumes from other operating systems. But, doing so might compromise the security provided by Tails.

en	For example, image thumbnails might be created and saved by the other operating system. Or, the contents of files might be indexed by the other operating system.

en	Changing the passphrase of an existing encrypted partition
zh-hans	Öffnen Sie eine bestehende, verschlüsselte Partition

en	Plug in the external storage device that contains the encrypted partition for which you want to change the passphrase.

en	The device appears in the list of storage devices. Click on it.

en	[[!img storage_devices_after.png class="screenshot" alt=""]]

en	1. Check that the description of the device on the right side of the screen corresponds to your device: its brand, its size, etc.

en	Click on the partition displaying a [[!img lib/network-wireless-encrypted.png alt="Partition LUKS" class="symbolic" link="no"]] in the bottom-right corner.

en	Click on the [[!img lib/system-run.png alt="Additional partition options" class="symbolic" link="no"]] button and choose **Change Passphrase** in the shortcut menu.