When installing Debian, I chose an option to create Encrypted LVM (Logical Volume Management). So now, when I turn on my PC, it asks me for an encryption password.

It looks ok, but how does it work? What does GRUB initialize to ask my password, if the full drive with my OS and Kernel is encrypted?

How does it decrypt my files after I put in my password? If there are any possible problems with this system?

  • Are you sure /boot is encrypted? Last I checked the debian installer left /boot unencrypted when doing its Encrypted LVM install (it's been a while since I've checked though, I always do a custom install). The Arch Linux wiki may be helpful. Oct 12, 2018 at 18:02
  • @AndrolGenhald not really sure, will check this
    – keddad
    Oct 12, 2018 at 20:12
  • @biryulin04 It is unencrypted. However, you can utilize GRUB2 to encrypt your boot partition as well, but this is not done by default.
    – forest
    Nov 12, 2018 at 1:45

2 Answers 2


Debian boot sequence

  1. Grub is not encrypted. Grub is located on /boot wich hold kernel and initramfs, readable without encryption.

  2. Grub load kernel, kernel load initramfs. initramfs hold a full filesystem, not encrypted, with common directories /bin, /etc, /lib, /lib/module ... containing everything nedeed for encryption and filesystems.

  3. Once initramfs loaded, the kernel run a script (called init) automatically at startup.

  4. start script hold all procedure to

    • load required modules,
    • ask user for password,
    • check filesystem if needed and
    • mount final root /.
  5. Then once done, run pivot_root in order to become able to umount /initramfs before continuing normal boot on finalized /.


The /boot partition is not encrypted for exactly the reason you mention in your question. Typically, files and data should not be written to that partition for exactly this reason.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .