Return to Answer

If your phone came with Android 5 or above, the storage is encrypted by default. You can verify this by going into Settings > Security & lock screen > Encryption & credentials. It should say Encrypt phone - encrypted and it won't allow you to turn it off.

Hovewer, the safety of the encryption depends on several factors. Most importantly, you should be using a strong password. PIN codes can be brute forced easily - Android allows you to try 5 different passwords every 30 seconds. That means brute forcing a 4 digit PIN takes less than 17 hours.

Another factor is whether you have the bootloader unlocked and what kind of encryption your phone uses.

File-based encryption

Android 10+, some devices with Android 7 - 9.

Android with FBE enabled encrypts the master key by a combination of the device key and your PIN/password. A device like this is NOT decryptable without your password even if one can run arbitrary code* on the device.

You can easily verify if your phone is using FBE by restarting it. If it asks for PIN/password with a default-themed keyboard, it's using FBE.

Full-disk encryption

Android 4.4 - 6, some devices with Android 7 - 9.

The master key is encrypted using only the device key by default. If you can run any code* on the device, your data is as good as unencrypted. To encrypt the master key with your PIN or password, you need to enable "secure startup" (Settings > Security & location > Screen lock > PIN or Password and tap Yes when it asks if you want to use Secure start-up). That makes the master key encrypted with the device key AND your PIN/password.

If you get a black screen with a prompt "To start Android, enter your PIN/password", then your phone is using the secure start-up. If it boots normally and asks for PIN/password with your customized keyboard, your phone is NOT using the secure start-up.

* you can run arbitrary code if the bootloader is unlocked, the device manufacturer (or possibly a very determined hacker) can likely do this even with bootloader locked

Read more about Android encryption here: https://source.android.com/security/encryption/

If your phone came with Android 5 or above, the storage is encrypted by default. You can verify this by going into Settings > Security & lock screen > Encryption & credentials. It should say Encrypt phone - encrypted and it won't allow you to turn it off.

Hovewer, the safety of the encryption depends on several factors. Most importantly, you should be using a strong password. PIN codes can be brute forced easily - Android allows you to try 5 different passwords every 30 seconds. That means brute forcing a 4 digit PIN takes less than 17 hours.

Another factor is whether you have the bootloader unlocked and what kind of encryption your phone uses.

File-based encryption

Android 10+, some devices with Android 7 - 9.

Android with FBE enabled encrypts the master key by a combination of the device key and your PIN/password. A device like this is NOT decryptable without your password even if one can run arbitrary code* on the device.

You can quickly verify if your phone is using FBE by restarting it. If it asks for PIN/password with a default-themed keyboard, it's using FBE.

A more reliable way is running adb shell getprop ro.crypto.type. You'll get the response file for FBE.

Full-disk encryption

Android 4.4 - 6, some devices with Android 7 - 9.

The master key is encrypted using only the device key by default. If you can run any code* on the device, your data is as good as unencrypted. To encrypt the master key with your PIN or password, you need to enable "secure startup" (Settings > Security & location > Screen lock > PIN or Password and tap Yes when it asks if you want to use Secure start-up). That makes the master key encrypted with the device key AND your PIN/password.

If you get a black screen with a prompt "To start Android, enter your PIN/password", then your phone is using the secure start-up. If it boots normally and asks for PIN/password with your customized keyboard, your phone is NOT using the secure start-up.

You can check if the device is using FDE by running adb shell getprop ro.crypto.type. You'll get the response block for FDE.

* you can run arbitrary code if the bootloader is unlocked, the device manufacturer (or possibly a very determined hacker) can likely do this even with bootloader locked

Read more about Android encryption here: https://source.android.com/security/encryption/

Update: as of Android 10, File Based Encryption is mandatory, so any Android 10 device should be relatively safe when turned off. Well, as long as it's using a password, four digit PINs can be easily brute-forced using the right tools.

You can verify if FBE is active by restarting the phone. If it asks for your password and no apps are loaded except phone functions, keyboard (with the default skin) and settings, then FBE is active. After entering the password, your apps should load and notifications should start working.

The rest of this post applies to Android 5 through 9.

The best way to tell if your Android device is encrypted (and the encryption is actually in use) is to reboot it and see if it asks for a password/PIN with a prompt on a black screen that says:

To start Android, enter your PIN

If you're not seeing this prompt, then even though your device may be encrypted, the encryption is pretty much useless. This is because Android's encryption works in two steps:

• your files* get encrypted with a 128-bit master key
• the master key is either encrypted with your password or just stored as is

The lack of prompt means the master key is not encrypted (or your device is not encrypted at all) and your data could be read by anyone who manages to boot a recovery image on your device such as TWRP.

  To enable the encryption (enabled by default on devices shipped with 5.0+) go to Settings > Security & location > Encryption & credentials > Encrypt phone.

But to actually have the master key encrypted and your files inaccessible without a password, you need to go to Settings > Security & location > Screen lock > PIN or Password and tap Yes when it asks if you want to use Secure start-up.

This is how settings look like on Oreo, other versions may be different, but the settings you're looking for should be pretty much the same.

*7.0+ encrypts files, Android 5.0 - 6.x encrypts partitions (source)

If your phone came with Android 5 or above, the storage is encrypted by default. You can verify this by going into Settings > Security & lock screen > Encryption & credentials. It should say Encrypt phone - encrypted and it won't allow you to turn it off.

Hovewer, the safety of the encryption depends on several factors. Most importantly, you should be using a strong password. PIN codes can be brute forced easily - Android allows you to try 5 different passwords every 30 seconds. That means brute forcing a 4 digit PIN takes less than 17 hours.

Another factor is whether you have the bootloader unlocked and what kind of encryption your phone uses.

File-based encryption

Android 10+, some devices with Android 7 - 9.

Android with FBE enabled encrypts the master key by a combination of the device key and your PIN/password. A device like this is NOT decryptable without your password even if one can run arbitrary code* on the device.

You can easily verify if your phone is using FBE by restarting it. If it asks for PIN/password with a default-themed keyboard, it's using FBE.

Full-disk encryption

Android 4.4 - 6, some devices with Android 7 - 9.

The master key is encrypted using only the device key by default. If you can run any code* on the device, your data is as good as unencrypted. To encrypt the master key with your PIN or password, you need to enable "secure startup" (Settings > Security & location > Screen lock > PIN or Password and tap Yes when it asks if you want to use Secure start-up). That makes the master key encrypted with the device key AND your PIN/password.

If you get a black screen with a prompt "To start Android, enter your PIN/password", then your phone is using the secure start-up. If it boots normally and asks for PIN/password with your customized keyboard, your phone is NOT using the secure start-up.

* you can run arbitrary code if the bootloader is unlocked, the device manufacturer (or possibly a very determined hacker) can likely do this even with bootloader locked

Read more about Android encryption here: https://source.android.com/security/encryption/

The best way to tell if your Android device is encrypted (and the encryption is actually in use) is to reboot it and see if it asks for a password/PIN with a prompt on a black screen that says:

To start Android, enter your PIN

If you're not seeing this prompt, then even though your device may be encrypted, the encryption is pretty much useless. This is because Android's encryption works in two steps:

• your files* get encrypted with a 128-bit master key
• the master key is either encrypted with your password or just stored as is

The lack of prompt means the master key is not encrypted (or your device is not encrypted at all) and your data could be read by anyone who manages to boot a recovery image on your device such as TWRP.

To enable the encryption (enabled by default on devices shipped with 5.0+) go to Settings > Security & location > Encryption & credentials > Encrypt phone.

But to actually have the master key encrypted and your files inaccessible without a password, you need to go to Settings > Security & location > Screen lock > PIN or Password and tap Yes when it asks if you want to use Secure start-up.

This is how settings look like on Oreo, other versions may be different, but the settings you're looking for should be pretty much the same.

*7.0+ encrypts files, Android 5.0 - 6.x encrypts partitions (source)

Update: as of Android 10, File Based Encryption is mandatory, so any Android 10 device should be relatively safe when turned off. Well, as long as it's using a password, four digit PINs can be easily brute-forced using the right tools.

You can verify if FBE is active by restarting the phone. If it asks for your password and no apps are loaded except phone functions, keyboard (with the default skin) and settings, then FBE is active. After entering the password, your apps should load and notifications should start working.

The rest of this post applies to Android 5 through 9.

The best way to tell if your Android device is encrypted (and the encryption is actually in use) is to reboot it and see if it asks for a password/PIN with a prompt on a black screen that says:

To start Android, enter your PIN

If you're not seeing this prompt, then even though your device may be encrypted, the encryption is pretty much useless. This is because Android's encryption works in two steps:

• your files* get encrypted with a 128-bit master key
• the master key is either encrypted with your password or just stored as is

The lack of prompt means the master key is not encrypted (or your device is not encrypted at all) and your data could be read by anyone who manages to boot a recovery image on your device such as TWRP.

To enable the encryption (enabled by default on devices shipped with 5.0+) go to Settings > Security & location > Encryption & credentials > Encrypt phone.

But to actually have the master key encrypted and your files inaccessible without a password, you need to go to Settings > Security & location > Screen lock > PIN or Password and tap Yes when it asks if you want to use Secure start-up.

This is how settings look like on Oreo, other versions may be different, but the settings you're looking for should be pretty much the same.

*7.0+ encrypts files, Android 5.0 - 6.x encrypts partitions (source)