On this page
Full-disk encryption makes stored data unreadable until the computer has the required unlock secret or trusted hardware state. It mainly protects data at rest—for example, when a powered-off laptop is lost and somebody tries to read its disk elsewhere.
Encryption does not replace a login password, software updates, backups, or care while the system is already unlocked.
Begin with two practical questions: what happens when the laptop starts, and what recovery information will you need if the normal unlock method fails? Those answers make the three choices easier to compare than their names alone.
Compare the visible choices
| Choice | Startup behavior | Protection | Recovery responsibility | Compatibility and complexity |
|---|---|---|---|---|
| No encryption | No disk-unlock secret before account login | Files are easier to read from the removed or offline disk | Backups still matter, but there is no encryption secret to lose | Simplest recovery and broadest compatibility |
| Encrypt with a passphrase | Enter the disk passphrase during startup, then log into the account | Encrypts the Ubuntu data while the disk is locked | Store the passphrase outside the encrypted disk | Canonical's recommended encryption choice; adds a deliberate startup and recovery step |
| Use hardware-backed encryption | The TPM can unlock automatically when the trusted boot state is valid | Protects the disk using keys tied to supported hardware | Save the recovery key and understand firmware-sensitive recovery | Requires recent compatible hardware and is documented as beta in the current how-to |
No encryption
- Startup behavior
- No disk-unlock secret before account login
- Protection
- Files are easier to read from the removed or offline disk
- Recovery responsibility
- Backups still matter, but there is no encryption secret to lose
- Compatibility and complexity
- Simplest recovery and broadest compatibility
Encrypt with a passphrase
- Startup behavior
- Enter the disk passphrase during startup, then log into the account
- Protection
- Encrypts the Ubuntu data while the disk is locked
- Recovery responsibility
- Store the passphrase outside the encrypted disk
- Compatibility and complexity
- Canonical's recommended encryption choice; adds a deliberate startup and recovery step
Use hardware-backed encryption
- Startup behavior
- The TPM can unlock automatically when the trusted boot state is valid
- Protection
- Protects the disk using keys tied to supported hardware
- Recovery responsibility
- Save the recovery key and understand firmware-sensitive recovery
- Compatibility and complexity
- Requires recent compatible hardware and is documented as beta in the current how-to
No encryption: what happens when the laptop starts?
Ubuntu starts without asking for a separate disk-unlock secret. The account login can still require a password, but that password does not encrypt files on a powered-off or removed disk.
No encryption can be reasonable for a low-risk test machine, a system whose recovery simplicity matters more than offline data protection, or hardware that cannot support the desired method. It leaves data more exposed if the disk or computer is stolen.
Do not recommend it merely because it avoids a password. Decide based on the sensitivity of the files and how the device is used.
Passphrase encryption: what extra secret do you need?
Canonical’s current installation guide calls Encrypt with a passphrase the recommended encryption option. The installer uses an encrypted storage arrangement and asks for a passphrase.
The disk-unlock passphrase and account login password serve different stages:
- The disk passphrase unlocks encrypted storage early in startup.
- The account password logs a person into Ubuntu after the operating system is available.
They may be typed on different screens. Even if a learner deliberately chooses the same text, they remain different credentials with different purposes.
Hardware-backed encryption: what does the computer manage?
Ubuntu’s hardware-backed method uses a compatible Trusted Platform Module (TPM) and verified boot state. It can unlock automatically when the hardware and firmware measurements match the trusted state. Ubuntu can provide a recovery key for situations where that automatic path no longer works.
This option has strict requirements, including compatible recent hardware and Secure Boot configuration.
The current Ubuntu 26.04 how-to labels the TPM full-disk encryption feature beta and lists known limitations. The installer should prevent selection when requirements fail, but availability does not mean it is the best fit for every beginner.
Choose it only after reading the hardware requirements, accepting its current status, and creating a recoverable off-device copy of the recovery key. Firmware changes can affect the trusted state.
Advanced options
The installer can expose other arrangements such as LVM without encryption or ZFS with or without encryption. LVM helps manage logical storage; ZFS provides advanced pooled-storage and snapshot features. They solve specific needs and add concepts this installation path does not teach.
Do not choose an advanced filesystem or storage manager solely because its name sounds more capable. Use the normal option unless you have a documented requirement and recovery plan.
A balanced decision guide
Ask:
- Does the computer travel or face a meaningful loss or theft risk?
- Will it store personal, work, authentication, or client data?
- Is it shared with other people?
- Can I reliably manage a passphrase or recovery key?
- Does the hardware meet every hardware-backed requirement?
- Am I comfortable troubleshooting a firmware-sensitive unlock path?
- Are recoverable backups already available?
For many laptops holding personal or development data, passphrase encryption is a clear, supported balance.
For a disposable lab system where offline data exposure is not a concern, no encryption may be acceptable.
Hardware-backed encryption prioritizes convenient startup and hardware-rooted protection on suitable systems. It also adds compatibility and recovery conditions, so do not choose it merely because it sounds advanced.
Common mistakes and recovery
Believing login protects an unencrypted removed disk. Account login protects normal access through the running system, not every offline reading method.
Storing the passphrase only on the encrypted disk. Move the record to a separate secure location before installing.
Losing the hardware-backed recovery key. Save it when the installer presents it and verify the copy.
Changing keyboard layout after creating a complex passphrase. Confirm the chosen layout and type the passphrase carefully on the confirmation screen.
Assuming encryption is a backup. Encryption protects confidentiality; a failed disk, deletion, or forgotten secret still loses files without a separate backup.
Practice
Knowledge check
Describe the startup sequence. Explain the difference between the disk passphrase and account password. Then name the current Canonical recommendation when encryption is wanted: Encrypt with a passphrase.
What to learn next
Continue to Complete the Ubuntu Installation and Set Up Your First Boot only after the disk target, keep-Windows decision, and encryption choice all match your written plan.