Encrypted Installation Guide

Ten extra seconds of setup; theft of the laptop stops mattering for your data.

Enable during guided install

In the partitioning step (Calamares Installer Walkthrough): choose Erase disk, tick Encrypt, enter the passphrase twice. Calamares builds LUKS2-on-root automatically; only the EFI partition stays readable.

Passphrase craft

  • Four-plus random words beat symbol soup ("ember-cactus-vault-nine").

  • You’ll type it every boot — make it typeable half-asleep.

  • No recovery backdoor exists: lost passphrase + no keyfile = gone. Consider enrolling a second keyfile afterwards per Disk Encryption on AcreetionOS.

Verify after first boot

lsblk                          # 'crypto_LUKS' under the root partition
sudo cryptsetup status         # active mapping details

What’s protected vs not

Protected Not protected

Files, swap-in-partition, system configs at rest

Boot firmware settings, ESP bootloader bits

Data on stolen powered-off machine

Running session (screen lock matters!), cloud accounts

Recovery & snapshots interplay

  • Timeshift restores work normally — they operate on the unlocked mapper.

  • Chroot rescue adds one step (unlock first): cryptsetup open …​ per Chroot Rescue Guide.

  • The Recovery Environment handles this dance itself.

Hibernation with encryption

Doable — needs sized swap + resume hook configuration after install: LVM & LUKS Administration walks the parameters.