How to Encrypt Your Android Device (A Step-by-Step Guide)

Imatge
Àmbits Temàtics

If you’re like me, your whole life is on your phone.

The Android hand­set that you take out of your pocket, back­pack or purse for what seems like thou­sands of times a day contains all of your perso­nal and busi­ness infor­ma­tion, your favo­rite apps, all of your contacts, price­less photos of friends and family, and God only knows what else. No one but you deser­ves to have access to that.

Unfor­tu­na­tely, if your Android device is lost or stolen, whoe­ver gets their hands on it could have access to whate­ver is stored on it. Sure, you’ve protec­ted it with a pass­code or a finger­print so no one can unlock it. But, they could connect it via USB to a compu­ter and attack it from there. That’s why encryp­ting your Android phone or tablet is so impor­tant.

In this arti­cle, I’m going to explain the bene­fits of encryp­ting your Android device, as well as the draw­backs. I’ll walk you through step-by-step instruc­ti­ons about how to encrypt the device. I’ll also explain the encryp­tion opti­ons avai­la­ble for microSD card users.

Then, finally, I’ll explain what will happen if you ever need to decrypt your Android device. (Spoi­ler alert: You’ll need a recent backup.)

 

Why Should You Encrypt Your Android Device?

 

1

What Does Device Encryp­tion Do?

Device encryp­tion converts all of the data you have stored on your Android phone or tablet into a “scram­bled” form that can only be acces­sed using the correct creden­ti­als. (That creden­tial is your Android device pass­code or pass­word.)

Decoder Ring

Encryp­tion is a sophis­ti­ca­ted form of the charac­ter subs­ti­tu­ti­ons that many of us used in grade school to send “secret” messa­ges to our scho­ol­ma­tes. (A = 21, B = 4, C = 12, etc.) Or maybe you had one of those fancy deco­der rings. (Well, lah-dee-dah!)

 

2

​The Bene­fits of Encryp­ting Your Android Device

Device encryp­tion does not protect the data trave­ling to and from your device – only the data that is stored on the device. You’ll want to use a VPN to protect the data trans­mit­ted to and from your device.

Android device encryp­tion is popu­lar among corpo­ra­ti­ons that issue devi­ces to their employees. Those devi­ces may contain corpo­rate secrets, time-sensi­tive docu­ments or other infor­ma­tion that may be attrac­tive to hackers – or even corpo­rate compe­ti­tors. Hackers are unable to access the device and its data without the devi­ce’s pass­code or pass­word.

Users who own Android devi­ces for perso­nal use will also want to consi­der encryp­ting their device(s), keeping their perso­nal files, photos and other infor­ma­tion safe from the prying eyes of anyone who may steal or find a lost device.

Encryp­tion provi­des an addi­ti­o­nal layer of protec­tive secu­rity for your devi­ce’s data over the stan­dard pass­code/pass­word/finger­print lock screen used on many Android devi­ces.

If your device is not encryp­ted and is merely protec­ted by a lock screen, users may not be able to access your device directly, but they can access the data on it by connec­ting it to a compu­ter and running soft­ware to access the data stored on the device.

If your device is encryp­ted, the infor­ma­tion stored on the device will be unre­a­da­ble, even if acces­sed by exte­rior methods. Remem­ber, more secu­rity is always better secu­rity.

 

3

​The Draw­backs of Encryp­ting Your Android Device

I don’t want to mislead my readers into thin­king encryp­tion is all flowers and unicorns, with no draw­backs of any kind.

As with just about any type of secu­rity-rela­ted subject, there are some draw­backs to encryp­ting your device. I’ll lay them out for you here, and then it will be up to you to decide if any of these are deal-brea­kers.

I am not listing these “cons” to deter you from encryp­ting your device. On the contrary, I recom­mend encryp­ting your mobile devi­ces. Howe­ver, I simply want my readers to be well-infor­med about the subject of encryp­tion before they blindly jump into the process.

Slower Perfor­mance

After an Android device is encryp­ted, you may see some slight perfor­mance drops. 

While this will likely not be noti­ce­a­ble on high-end devi­ces, users of low-end or older devi­ces may see a drop in the perfor­mance of their devi­ces. This is because, once the infor­ma­tion on your device has been encryp­ted, it will need to be decryp­ted on the fly every time you access it. This will tax your devi­ce’s CPU a bit more.

Encryp­tion Is a One-Way Street; There’s No Going Back 

If you turn on encryp­tion for your Android phone or tablet, there’s usually no way to reverse the process, short of doing a factory reset of the device and star­ting over. Sure, some manu­fac­tu­rers may offer an option to encrypt and then decrypt, but this option is not gene­rally avai­la­ble.

If Your Device Is Rooted, You’ll Need to (Tempo­ra­rily) Unroot It 

Many Android users root their device to give them access to featu­res of the device and opera­ting system that may not normally be avai­la­ble. This is simi­lar to having Admi­nis­tra­tor access to a compu­ter or network, which allows a user to perform acti­ons that are not avai­la­ble to the average user.

If you attempt to encrypt a rooted Android device, you’ll run into problems and run the risk of losing all of your data. If you want to encrypt a rooted device, you’ll need to unroot it, encrypt it and then root it again after­ward.

Time Invest­ment  

When encryp­ting your Android device, it can take an hour or more to complete the process. The actual length of time will depend on the speed of your device, as well as the amount of data you have stored on the device. 

Be warned: this is not somet­hing you can do on your coffee break, or while you’re waiting to get a table at your favo­rite lunch spot.

If none of the above would deter you from encryp­ting your Android device, then let’s move on to the next section, where I walk you through the steps to encrypt your device.

 

How to Encrypt Your Android Device

As promi­sed, this is the portion of our show that you’ve all been waiting for. Well, not the guy over in the corner with the iPhone, but the rest of you. It’s time to encrypt your Android phone or tablet.

We’ll be cove­ring two types of Android encryp­tion: full-disk encryp­tion and file-based encryp­tion. Full-disk encryp­tion protects all of a devi­ce’s user­data parti­tion (the storage on the Android device), while file-based encryp­tion allows files to be indi­vi­du­ally encryp­ted, allo­wing the files to be unloc­ked on an inde­pen­dent basis.

Please note: Android devi­ces install custo­mi­zed versi­ons of Android on their devi­ces. This means the steps for encryp­ting your device may be slightly diffe­rent. 

If your system menus don’t match the menus menti­o­ned here, check with your device maker’s custo­mer support folks for more infor­ma­tion. Both of the devi­ces I used for this part of the arti­cle were made by BLU

Full-Disk Encryp­tion

Android 5.0 through Android 9 supports full-disk encryp­tion. 

Full-disk encryp­tion uses a single encryp­tion key to unlock the encryp­tion used for the device, which is protec­ted by the user’s device pass­word. It protects all of a devi­ce’s user­data parti­tion. When the device boots up, the user must provide their pass­code before any part of the user­data storage is acces­si­ble. Without it, the device is unusa­ble. 

While this method of encryp­tion is exce­llent for secu­rity, it’s lousy for user conve­ni­ence. Most of a devi­ce’s core func­ti­o­na­lity is not imme­di­a­tely avai­la­ble when a user rebo­ots their device, meaning featu­res like alarms, acces­si­bi­lity servi­ces and even recei­ving phone calls are not avai­la­ble.

Step 1: Backup! Backup! Backup!

If you haven’t done so alre­ady, take the time to back up your Android device. 

While encryp­tion is a safe and simple process, Murphy’s Law (“anyt­hing that can go wrong will go wrong”) always applies to any process rela­ted to elec­tro­nic devi­ces, and encryp­tion is no excep­tion. 

Besi­des, you’re suppo­sed to be backing up ALL of your devi­ces on a regu­lar basis. That’s Safe Compu­ting 101.

Step 2: Make Sure Your Device is Fully Char­ged

Make sure your device is char­ged to at least 80% of its full capa­city. 

The Android opera­ting system won’t let you begin the process unless your device is char­ged to at least 80%. You’ll need to keep your device plug­ged into a char­ger during the entire encryp­tion process, just to help ensure everyt­hing will run smoothly.

Step 3: Enter a Lock Screen Pass­code 

Okay, this is somet­hing you should alre­ady have set up on your phone or tablet. Howe­ver, on the off chance you don’t lock your device with a pass­code or pass­word, do so now. 

Ideally, you’ll want to use a fairly complex string of numbers or charac­ters to set your pass­code. Howe­ver, keep in mind that you’ll need to remem­ber AND enter this pass­code every time you unlock your device, so try to find a happy medium.

Step 4: Begin the Encryp­tion Process

While your phone is connec­ted to the char­ger, do the follo­wing. (The menus on your device might differ a bit, depen­ding on the Android version your device has insta­lled and which company manu­fac­tu­red the device.)

1. Enter the “Settings” app on your Android device.

2. Tap the “Secu­rity” menu option in the Settings menu.

Android Phone Security Settings

3. Find the “Encryp­tion” section in the Secu­rity menu. There, you’ll see a menu option labe­led “Encrypt Phone” (or “Encrypt Tablet, ” depen­ding on which device you’re encryp­ting.) Tap that.

Android Phone Encryption Settings

4. ​On the next screen, you’ll see an expla­na­tion of what’s about to happen, and that you’ll need to unlock the device every time you wish to use it. 

It will also mention that you’ll need to perform a factory data reset to decrypt your device, losing all of your data. In addi­tion, it will warn you that your device must be char­ged and remain connec­ted to the char­ger during the encryp­tion process.If all of that doesn’t scare you off, tap the “ENCRYPT PHONE” button to begin the encryp­tion process.

Android Phone Encrypt Phone

5. Go get a snack and your favo­rite beve­rage, sit down with your favo­rite book or Netflix show and wait awhile. 

Be sure not to unplug or screw around with your phone while it is encryp­ting. Seri­ously. Leave it alone.

Your device will prompt you when the decryp­tion process has finis­hed, usually within the space of an hour or so.

Step 5: Enjoy Your Newly Encryp­ted Android Device

Once the encryp­tion process is finis­hed, all of the data stored on your Android device will be protec­ted from the eyes of others. 

File-Based Encryp­tion

Android 7.0 and above supports file-based encryp­tion (FBE). (For devi­ces running Android 10 and later, file-based encryp­tion is a requi­re­ment and should be enabled on new devi­ces straight out of the box. Howe­ver, if you have upda­ted your device to Android 10, you will need to convert your devi­ce’s encryp­tion to file-based.)

File-based encryp­tion allows diffe­rent files to be encryp­ted using diffe­rent encryp­tion keys, allo­wing the files to be unloc­ked inde­pen­dently. 

Devi­ces that offer support for file-based encryp­tion also support Direct Boot, which allows a device to go straight to the lock screen when it boots up, allo­wing access to device featu­res such as alarms, acces­si­bi­lity servi­ces and recei­ving calls.

By using file-based encryp­tion and APIs (program­ming inter­fa­ces) that allow apps to be aware of file-based encryp­tion, apps can operate within a limi­ted context before a user has provi­ded their creden­ti­als, while still allo­wing private user infor­ma­tion to be protec­ted.

If you buy an Android device with Android 7.0 or later insta­lled, there’s a chance file-based encryp­tion might alre­ady be in place. Howe­ver, it isn’t requi­red to be enabled on new devi­ces until Android 10. Here’s how to find out if your device is alre­ady using FBE.

Go to “Settings” -> “Secu­rity” -> “Screen Lock” and tap your current screen lock setting. If “require PIN to start device” is an option, you’re running full-disk encryp­tion and can convert to file-based encryp­tion. 

If you need to convert your device to FBE, please keep in mind that this process will erase all of your data, which will effec­ti­vely factory-reset the device! This makes step 1 arguably the most impor­tant step of the entire process.

To convert your Android device to file-based encryp­tion, do the follo­wing:

Step 1: Back It Up!

If you haven’t backed up your Android device, do it now. Always back up any elec­tro­nic device before making a big change, like encryp­ting your device or upda­ting the opera­ting system. Espe­ci­ally in this case, as we’re erasing all of the data on your device.

It’s easy to back up your device, and the peace of mind a regu­lar backup provi­des is well worth the amount of time it takes to perform a backup. 

Step 2: Make Sure Your Device is Fully Char­ged

Make sure your device is char­ged to at least 80% of its full capa­city. You’ll also want to keep your device plug­ged into a char­ger during the entire process.

Step 3: Enable Deve­lo­per Opti­ons

You’ll need to enable Deve­lo­per Opti­ons on your device to perform the conver­sion of your device to FBE. To do so, follow these steps:

  1. Go to the Settings menu and find “About phone” or “About tablet.” Tap that. 

  2. On the About screen, find the Build number.

  3. Tap the Build number field 7 times to enable Deve­lo­per Opti­ons. After you tap a few times, you’ll see a count­down noti­fi­ca­tion that says “You are now X steps away from being a deve­lo­per.” 

When you’re done, you’ll see a message that says “You are now a deve­lo­per!” (You’ll have to learn how to actu­ally deve­lop apps on your own, though – it’s not a learn-by-osmo­sis thing.)

Step 4: Begin the Encryp­tion Process

With your phone connec­ted to the char­ger, perform the follo­wing steps. (The menus on your device might differ a bit, depen­ding on the Android version your device has insta­lled and which company manu­fac­tu­red the device.)

  1. After backing out to the main Settings menu, find the “System” menu item. Tap that.

  2. In the System menu, look for “Deve­lo­per opti­ons.” Tap that.

  3. Find the “Convert to file encryp­tion” option. Tap that. 

4. On the next screen, you’ll see a warning that conver­ting your device to file-based encryp­tion will erase all of your data, and that the feature is alpha and may not work correctly. (When a feature is “alpha, ” it means it is still being tested, and may still contain bugs and unwan­ted “featu­res.”)If you have a backup of your device (you’ll need it to restore your data and apps), and you’re sure you want to convert your devi­ce’s encryp­tion to file-based encryp­tion, tap the “WIPE AND CONVERT…” button.

5. Wait while your device is conver­ted. It will reboot when finis­hed.

6. Restore your data and enjoy your devi­ce’s new file-based encryp­tion.

 

What Have We Lear­ned?

Before signing off, let’s take a quick look at what we’ve cove­red in this arti­cle.

If you want to ensure that the infor­ma­tion stored on your Android phone or tablet stays safe from prying eyes, encryp­ting your device is one of the best steps you can take to protect your privacy, espe­ci­ally if the device is lost or stolen.

Encryp­ting your Android device covers the data on the device with a coating of encryp­tion, rende­ring the infor­ma­tion unre­a­da­ble, unless the user enters their pass­code or pass­word, or unlocks the device using their finger­print or other biome­tric unloc­king process.

This is a secu­rity-enhan­cing step that all Android users can take to protect their perso­nal data, and it’s parti­cu­larly impor­tant for users that keep busi­ness-rela­ted infor­ma­tion on the device.

Users should be made aware of a few draw­backs, which might affect the usage of their devi­ces.

The main draw­back for most users will likely be that they’ll see slower perfor­mance with their device, as encryp­ted data needs to be decryp­ted on the fly every time it’s acces­sed. The decryp­tion requi­res more work by your devi­ce’s proces­sor. This will be most noti­ce­a­ble with older or low-end devi­ces.

If you turn on encryp­tion on your Android tablet or phone, you cannot reverse the process. If you wish to decrypt the data, you’ll need to perform a factory reset of the device and start over comple­tely. (Howe­ver, some device manu­fac­tu­rers do offer ways to decrypt data. Check with your device makers before pulling the trig­ger on reset­ting your device.)

If you have rooted your device, as many users do in order to access advan­ced featu­res of their device not normally avai­la­ble without root access, you’ll need to unroot your device. If you try to encrypt your Android phone or tablet while it is still rooted, you could run into problems, which could cause you to lose the data stored on the device.

Encryp­ting your device is not somet­hing you should try on your lunch or coffee break. The encryp­tion process will usually take an hour or more to complete, depen­ding on the speed of your device.

The Android encryp­tion process is simple to perform, and merely takes a few taps of a finger. The main invest­ment is time. Once the process has comple­ted, other parties will not be able to access your devi­ce’s preci­ous data unless they have access to your pass­code or finger­print.

The encryp­tion process is a simple, yet impor­tant way to keep your perso­nal and busi­ness-rela­ted infor­ma­tion safe from crooks, hackers, govern­ment types and anyone else that would love to see what you have stored on your Android device.

Now, if you’ll excuse me, my postal carrier is here with a package. I think it’s the vintage Captain Midnight deco­der I purcha­sed on eBay.