<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
Allows the use of security tokens and smart cards (see below). </li><listyle="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
Allows multiple users to mount a single volume using different user passwords or PINs. Just give each user a security token or smart card containing the same VeraCrypt keyfile and let them choose their personal password or PIN that will protect their security
token or smart card. </li><listyle="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
Allows managing multi-user <emstyle="text-align:left">shared</em> access (all keyfile holders must present their keyfiles before a volume can be mounted).
Any kind of file (for example, .txt, .exe, mp3**, .avi) can be used as a VeraCrypt keyfile (however, we recommend that you prefer compressed files, such as .mp3, .jpg, .zip, etc).
<brstyle="text-align:left">
<brstyle="text-align:left">
Note that VeraCrypt never modifies the keyfile contents. You can select more than one keyfile; the order does not matter. You can also let VeraCrypt generate a file with random content and use it as a keyfile. To do so, select
<emstyle="text-align:left"><strongstyle="text-align:left">WARNING: If password caching is enabled, the password cache also contains the processed contents of keyfiles used to successfully mount a volume. Then it is possible to remount the volume even if the
keyfile is not available/accessible.</strong> To prevent this, click '</em>Wipe Cache<emstyle="text-align:left">' or disable password caching (for more information, please see the subsection
</em>'Settings -> Preferences'<emstyle="text-align:left">, item </em>'Cache passwords in driver memory'<emstyle="text-align:left"> in the section
See also the section <ahref="Choosing%20Passwords%20and%20Keyfiles.html"style="text-align:left; color:#0080c0; text-decoration:none.html">
Choosing Passwords and Keyfiles</a> in the chapter <ahref="Security%20Requirements%20and%20Precautions.html"style="text-align:left; color:#0080c0; text-decoration:none.html">
If you want to use keyfiles (i.e. "apply" them) when creating or mounting volumes, or changing passwords, look for the '<emstyle="text-align:left">Use keyfiles</em>' option and the
<emstyle="text-align:left">Keyfiles</em> button below a password input field.</div>
VeraCrypt can directly use keyfiles stored on a security token or smart card that complies with the PKCS #11 (2.0 or later) standard [23] and that allows the user to store a file (data object) on the token/card. To use such files as VeraCrypt keyfiles,
click <emstyle="text-align:left">Add Token Files</em> (in the keyfile dialog window).</div>
Access to a keyfile stored on a security token or smart card is typically protected by PIN codes, which can be entered either using a hardware PIN pad or via the VeraCrypt GUI. It can also be protected by other means, such as fingerprint readers.</div>
In order to allow VeraCrypt to access a security token or smart card, you need to install a PKCS #11 (2.0 or later) software library for the token or smart card first. Such a library may be supplied with the device or it may be available for download from the
website of the vendor or other third parties.</div>
If your security token or smart card does not contain any file (data object) that you could use as a VeraCrypt keyfile, you can use VeraCrypt to import any file to the token or smart card (if it is supported by the device). To do so, follow these steps:</div>
If the token or smart card is protected by a PIN, password, or other means (such as a fingerprint reader), authenticate yourself (for example, by entering the PIN using a hardware PIN pad).
To close all opened security token sessions, either select <emstyle="text-align:left">
Tools</em>><emstyle="text-align:left">Close All Security Token Sessions</em> or define and use a hotkey combination (<emstyle="text-align:left">Settings</em>>
<emstyle="text-align:left">Hot Keys > Close All Security Token Sessions</em>).</div>
By adding a folder in the keyfile dialog window (click <emstyle="text-align:left">
Add Path</em>), you specify a <emstyle="text-align:left">keyfile search path</em>. All files found in the keyfile search path* will be used as keyfiles except files that have the Hidden file attribute set.</div>
<strongstyle="text-align:left"><emstyle="text-align:left">Important: Note that folders (and files they contain) and hidden files found in a keyfile search path are ignored.</em></strong></div>
Keyfile search paths are especially useful if you, for example, store keyfiles on a USB memory stick that you carry with you. You can set the drive letter of the USB memory stick as a default keyfile search path. To do so, select
<emstyle="text-align:left">Settings </em>-><emstyle="text-align:left">Default Keyfiles</em>. Then click
<brstyle="text-align:left">
<emstyle="text-align:left">Add Path</em>, browse to the drive letter assigned to the USB memory stick, and click
<emstyle="text-align:left">OK</em>. Now each time you mount a volume (and if the option
<emstyle="text-align:left">Use keyfiles</em> is checked in the password dialog window), VeraCrypt will scan the path and use all files that it finds on the USB memory stick as keyfiles.</div>
<strongstyle="text-align:left"><emstyle="text-align:left">WARNING: When you add a folder (as opposed to a file) to the list of keyfiles, only the path is remembered, not the filenames! This means e.g. that if you create a new file in the folder or if you
copy an additional file to the folder, then all volumes that used keyfiles from the folder will be impossible to mount (until you remove the newly added file from the folder).
When a keyfile is used, the password may be empty, so the keyfile may become the only item necessary to mount the volume (which we do not recommend). If default keyfiles are set and enabled when mounting a volume, then before prompting for a password, VeraCrypt
first automatically attempts to mount using an empty password plus default keyfiles (however, this does not apply to the '<emstyle="text-align:left">Auto-Mount Devices</em>' function). If you need to set Mount Options (e.g., mount as read-only, protect hidden
volume etc.) for a volume being mounted this way, hold down the <emstyle="text-align:left">
Control </em>(<emstyle="text-align:left">Ctrl</em>) key while clicking <emstyle="text-align:left">
Mount </em>(or select <emstyle="text-align:left">Mount with Options </em>from the
<emstyle="text-align:left">Volumes </em>menu). This will open the <emstyle="text-align:left">
This function allows you to re-encrypt a volume header with a header encryption key derived from any number of keyfiles (with or without a password), or no keyfiles at all. Thus, a volume which is possible to mount using only a password can be converted to
a volume that require keyfiles (in addition to the password) in order to be possible to mount. Note that the volume header contains the master encryption key with which the volume is encrypted. Therefore, the data stored on the volume will
<emstyle="text-align:left">not</em> be lost after you use this function.</div>
Remark: This function is internally equal to the Password Change function.<brstyle="text-align:left">
<brstyle="text-align:left">
When VeraCrypt re-encrypts a volume header, the original volume header is first overwritten 256 times with random data to prevent adversaries from using techniques such as magnetic force microscopy or magnetic force scanning tunneling microscopy [17] to recover
the overwritten header (however, see also the chapter <ahref="Security%20Requirements%20and%20Precautions.html"style="text-align:left; color:#0080c0; text-decoration:none.html">
This function allows you to re-encrypt a volume header with a header encryption key derived from a password and no keyfiles (so that it can be mounted using only a password, without any keyfiles). Note that the volume header contains the master encryption key
with which the volume is encrypted. Therefore, the data stored on the volume will
<emstyle="text-align:left">not</em> be lost after you use this function.</div>
Remark: This function is internally equal to the Password Change function.<brstyle="text-align:left">
<brstyle="text-align:left">
When VeraCrypt re-encrypts a volume header, the original volume header is first overwritten 256 times with random data to prevent adversaries from using techniques such as magnetic force microscopy or magnetic force scanning tunneling microscopy [17] to recover
the overwritten header (however, see also the chapter <ahref="Security%20Requirements%20and%20Precautions.html"style="text-align:left; color:#0080c0; text-decoration:none.html">
You can use this function to generate a file or more with random content, which you can use as a keyfile(s) (recommended). This function uses the VeraCrypt Random Number Generator. Note that, by default, only one key file is generated and the resulting file
size is 64 bytes (i.e., 512 bits), which is also the maximum possible VeraCrypt password length. It is also possible to generate multiple files and specify their size (either a fixed value for all of them or let VeraCrypt choose file sizes randomly). In all
cases, the file size must be comprised between 64 bytes and 1048576 bytes (which is equal to 1MB, the maximum number of a key file bytes processed by VeraCrypt).</div>
Use this function to set default keyfiles and/or default keyfile search paths. This function is particularly useful if you, for example, store keyfiles on a USB memory stick that you carry with you. You can add its drive letter to the default keyfile configuration.
To do so, click <emstyle="text-align:left">Add Path</em>, browse to the drive letter assigned to the USB memory stick, and click
<emstyle="text-align:left">OK</em>. Now each time you mount a volume (and if <emstyle="text-align:left">
Use keyfiles</em> is checked in the password dialog), VeraCrypt will scan the path and use all files that it finds there as keyfiles.<brstyle="text-align:left">
<brstyle="text-align:left">
<strongstyle="text-align:left"><emstyle="text-align:left">WARNING: When you add a folder (as opposed to a file) to your default keyfile list, only the path is remembered, not the filenames! This means e.g. that if you create a new file in the folder or if
you copy an additional file to the folder, then all volumes that used keyfiles from the folder will be impossible to mount (until you remove the newly added file from the folder).
<brstyle="text-align:left">
<brstyle="text-align:left">
</em></strong><spanstyle="text-align:left; font-style:italic">IMPORTANT: Note that when you set default keyfiles and/or default keyfile search paths, the filenames and paths are saved unencrypted in the file
</span>Default Keyfiles.xml<spanstyle="text-align:left; font-style:italic">. For more information, please see the chapter
</span><ahref="VeraCrypt%20System%20Files.html"style="text-align:left; color:#0080c0; text-decoration:none">VeraCrypt System Files & Application Data</a><spanstyle="text-align:left; font-style:italic.html">.
<p><spanstyle="text-align:left; font-size:10px; line-height:12px">* Found at the time when you are mounting the volume, changing its password, or performing any other operation that involves re-encryption of the volume header.<brstyle="text-align:left">
** However, if you use an MP3 file as a keyfile, you must ensure that no program modifies the ID3 tags within the MP3 file (e.g. song title, name of artist, etc.). Otherwise, it will be impossible to mount volumes that use the keyfile.<brstyle="text-align:left">
