<h2 id="comparison">Strength of Argon2id compared to PBKDF2</h2>

Since Tails 5.13 (16 May 2023), Tails creates LUKS devices version 2 (LUKS2) with Argon2id as *key derivation function*.

- Physical access to the device - Very expensive computer equipment - Professional hacking skills

You can see the details of our calculations in [[!tails_ticket 19615]] and this [spreadsheet](https://cryptpad.disroot.org/sheet/#/2/sheet/view/KdOJLeuCsc4dS3vq-bHhFw6zByUSRJXsCcAkB-ERxtc/).

<h2 id="schemes">Other password schemes give too little guarantee</h2>

We recommend using passphrases made of several random words because using randomness is the only way to really guarantee the strength of a password.

Using other password schemes give little guarantee over the strength of a password, even if it follows complicated password policies and validates on password strength meters.

For example, a [Dutch hacker logged into Donald Trump's Twitter account *twice*](https://www.washingtonpost.com/world/2020/12/17/dutch-trump-twitter-password-hack/) by guessing his passwords, despite that these passwords included several words, were more than 8 characters, and even had special characters. They were definitely not random enough: "*maga2020!*" and "*yourefired*".

To understand the maths behind password strength, watch [An information theoretic model of privacy and security metrics](https://media.libreplanet.org/u/libreplanet/m/an-information-theoretic-model-of-privacy-and-security-metrics/). Bill Budington from the EFF explains the concept of entropy and its implication on browser fingerprinting and password safety in accessible terms.

<h1 id="updating">Keeping your encryption secure</h1>

All users are recommended to upgrade to LUKS2 on all their encrypted devices: Persistent Storage, backup Tails, and other external encrypted volumes.

Depending on the strength of your passphrase, we might also recommend choosing a different passphrase and migrating to another Tails USB stick:

- [[If your passphrase has 4 random words or fewer|argon2id#4]] - [[If your passphrase has 5 random words|argon2id#5]] - [[If your passphrase has 6 random words or more|argon2id#6]]

Persistent Storage (4 words or fewer)

Persistent Storage (4 words or fewer)

[[!toggle id="4_ps_keepassxc" text="Display the instructions to generate a passphrase using *KeePassXC*."]]

[[!toggleable id="4_ps_keepassxc" text="""

[[!inline pages="security/argon2id/keepassxc.inline" raw="yes" sort="age"]]

Change your passphrase.

If you created your Persistent Storage with Tails 5.12 or earlier, we recommend you migrate your entire Tails to a different USB stick and destroy your old Tails USB stick (or at least [[securely delete the entire device|doc/encryption_and_privacy/secure_deletion#device]]).

If you don't, the previous LUKS1 data might still be written in some recovery
data on the USB stick and could be recovered using advanced data forensics
techniques.