Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have seen on this site that many Linux users encrypt the swap partition. What are the benefits of encrypting swap?

share|improve this question
See also: – jcora Jun 7 '14 at 10:20
up vote 7 down vote accepted

Encryption of swap space is used to protect sensitive information. Consider an application that deals with passwords. As long as these passwords stay in physical memory, these passwords will not be written to disk and be cleared after a reboot. If the OS starts swapping out memory pages to free space for other applications, the passwords may be written to the disk platters unencrypted. Encrypting swap space can be a solution for this scenario.

Swap partitions are not encrypted by default and should be cleared of any sensitive data before continuing.

The swap partition can hold a lot of unencrypted confidential information and the fact that it persists after shutting down the computer can be a problem.

To encrypt SWAP, see Encrypting your Ubuntu swap partition

Source:C. Brüffer

share|improve this answer

I assume you're talking about a home directory or full disk encryption installation.

Swap is allocated space on persistent storage (because it's cheaper), providing more virtual memory to the operating system. All your applications run in the virtual memory holding all unencrypted data for the operations. Chances are fairly high that portions of the data you've got on encrypted on disk are ending unencrypted on the swap storage. Also temporary in-memory stuff like encryption keys could be moved from the physical memory to swap for some time (if the kernel decides so). With a plain encryption key an attacker is for certain able to decrypt your whole hard drive.

Moreover, swap doesn't get wiped after you turn your PC off, unlike physical memory.

Also note that if you hibernate your system, all of the physical memory will be written to swap. This provides an even larger amount of data for a possible attacker.

Summarized, in the context of encryption of data on your machine, it is a very bad thing not to encrypt swap if you handle encrypted files, from a security standpoint. It can even breach the complete security you're trying to achieve.

share|improve this answer

For the same reasons you would want to encrypt main memory. Programs have clear text copies of your information and they get swapped out to disk (swap partition) by the scheduler from time to time. If one were sufficiently motivated and enabled, swap could be mined for that personal data.

However, encrypting swap doesn't matter much if you haven't encrypted your root disk.

encryption is not cheap, expect a significant performance hit.

The only folks I know who "do it all" travel extensively. If you just want to tinker, go for it.

P.S. before someone makes a wisecrack about not being able to encrypt main memory please visit, even the instruction set is encrypted.

share|improve this answer
I understand encrypting swap data. However... encrypting RAM...what is the threat model this is supposed to protect against? – Jay Sullivan Jan 14 '15 at 4:53
Bus analyzers for starters. It's the sort of thing a military would be interested if they lost an asset in the field. – ppetraki Jan 14 '15 at 14:48

This here is why long ago I got convinced to really encrypt also my swap partition.

Try the following commands:
First find out your swap device, then find out if your user password (or any string critical for you) is stored somewhere on the swap memory:

  $ sudo swapon --summary  
  Filename                                Type        ...  
  /dev/mapper/vg_ubu476-lv_swap           partition   ...  

   $ sudo time strings < /dev/mapper/vg_ubu476-lv_swap | grep <part of your password>

If the password is not found, then the command ends with no output. That took 40 seconds for me, with my 4 GiB of swap.
Try that with " | more" instead of " | grep <...>"; that will show if you had wiped your disk from the very beginning, before encrypting, with random ASCII or not.

Beware of a problem: after those commands your "part of your password" will stay written in your bash history, and you may feel the need to erase it. With "part of password" you have at least not got the complete password there... And: only root can look inside it.

My strings command has looked into the decrypted layer of the system, which lives only while running the OS.

Stepping beneath that there are the LVM, then the decrypted LUKS container, and finally the encrypted device (a large partition). You may try and scan them all with "strings".

When I did that "strings" the first time I found lots of root passwords, as I was using "su - root" in the place of "sudo su -". Now I do not find any.

Performance - Belive me: I am working with 1,3 terabytes of encrypted stuff (system + large photo database) on three SSDs on a Thinkpad W520 whithout feeling any delays. But at least 8 GiB memory may somewhat help.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.