Full-disk encryption

The installer ticks Encrypt system for you. Your disk becomes a LUKS2 container holding a Btrfs filesystem, unlocked by one passphrase in the early boot environment.

What it protects

A powered-off or stolen laptop: without the passphrase, documents, browser data, saved passwords and SSH keys are unreadable.

What stays unencrypted

The EFI partition and /boot (the kernel and the early boot image). Ubuntu’s signed GRUB can’t open a LUKS2 volume, so these live outside it — which is also what keeps Secure Boot working with Canonical’s signed boot chain.

Good to know

• The passphrase cannot be recovered. Lose it and the data is gone.
• Fingerprint doesn’t unlock the disk — only login and sudo.
• Encryption can’t be added later without reinstalling. If you untick it, the installer shows a red page explaining what an unencrypted laptop exposes, before anything is written.
• Encryption protects the machine while it’s off. Once unlocked and running, other protections apply.