I'm learning how to use eCryptfs: https://wiki.archlinux.org/index.php/ECryptfs

I get things as below from the link:

This is used to derive the actual file encryption master key. Thus, you should not enter a custom one unless you know what you are doing - instead press Enter to let it auto-generate a secure random one. It will be encrypted using the login passphrase and stored in this encrypted form in ~/.ecryptfs/wrapped-passphrase. Later it will automatically be decrypted ("unwrapped") again in RAM when needed, so you never have to enter it manually. Make sure this file does not get lost, otherwise you can never access your encrypted folder again!

So I did a simple test:

mkdir -p ~/test
mount -t ecryptfs ~/test ~/test
cd ~/test && vim data
umount -t ecryptfs ~/test

For now, I did get an encrypted file, which means that ~/test/data was unreadable. Of course, if I mount it again, I can read it.

Now, I delete ~/.ecryptfs: rm -rf ~/.ecryptfs. Then I try to mount it: mount -t ecryptfs ~/test ~/test

To my surprise, I can still mount it and read the ~/test/data.

Now I'm confused. I thought I could move ~/.encryptfs into some USB to keep my secret data secure. But it doesn't seem to work because I can still mount it even if I delete ~/.encryptfs. Am I doing something wrong?

  • Did your mount command ran without any problems? Did it really mount the fs successfully?
    – qbi
    Feb 1, 2018 at 13:31
  • The documentation is referring to ecryptfs-setup-private which uses a wrapped passphrase. Your test does not create a wrapped passphrase, and so the original passphrase is sufficient to decrypt the files. Feb 1, 2018 at 14:32
  • @AndrolGenhald I don't quite understand. I'm sorry but I've executed exryptfs-setup-private at the beginning. Maybe I do it in a wrong way?
    – Yves
    Feb 2, 2018 at 0:55
  • @Yves You don't indicate in the question that you used ecryptfs-setup-private when doing your test. Feb 2, 2018 at 14:01
  • @AndrolGenhald Sorry about that.
    – Yves
    Feb 3, 2018 at 1:22

1 Answer 1


A reading of the manpage and a quick skim of the source to confirm indicates that (among other things) ecryptfs-setup-private creates a directory with encrypted data at ~/.Private, creates a mountpoint for decrypted data at ~/Private, and encrypts the encryption key with the login passphrase at ~/.ecryptfs/wrapped-passphrase. These paths are not configurable.

What you've done is create an ecryptfs directory at ~/.Private with a wrapped passphrase, then created a separate ecryptfs directory at ~/test using your passphrase directly as the key (bad idea). If you want to test that wrapped passphrases work properly you will need to use the ~/Private directory instead of trying to create your own.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .