Home Page » News » Tutorials » How to Create and Use an Encrypted VeraCrypt Container on Android with Termux (No Root)

Create and Use an Encrypted VeraCrypt Container on Android (No Root)

13 min read Step‑by‑step guide to install VeraCrypt in Termux, create a secure encrypted container, mount it, and safely use it on Android without rooting your device. October 08, 2026 01:00

Why Use an Encrypted Container on Android?

Android already encrypts the whole device, but there are situations where you need a separate, portable vault:

Sharing a single encrypted file between multiple devices.
Storing highly sensitive documents that you may want to delete without wiping the entire phone.
Keeping a hidden archive that is not indexed by the system media scanner.

A VeraCrypt container gives you a stand‑alone, strong AES‑256 encrypted file that you can mount only when needed. This tutorial shows how to set it up entirely from Termux, so you never have to root your phone.

Note: If you prefer a graphical app, the F‑Droid VeraCrypt client provides a UI wrapper. The steps below give you full control, the ability to script operations, and a deeper understanding of the process.

Before You Start

Android version: 6.0 (Marshmallow) or newer. The commands use the standard Linux toolchain that Termux provides.
Free storage: At least 200 MB for the source code and build tools, plus the size of the container you plan to create.
Backup: The tutorial only touches files inside Termux’s private directory (/data/data/com.termux/files). Existing data outside this area is untouched, but backing up important files is always a good habit.
Internet connection: Required to download the VeraCrypt source and the build dependencies.
Patience: Compiling VeraCrypt on a phone takes 5‑15 minutes depending on the chipset.

Step 1 – Install Termux and Update Packages

Open the Google Play Store or F‑Droid and install Termux.
Launch Termux. The first time it runs it will set up its internal filesystem.
Update the package index and upgrade existing packages:
```
pkg update && pkg upgrade -y
```
This ensures you have the latest clang, make, and other build tools.

Why this matters: an up‑to‑date toolchain avoids compilation errors caused by missing symbols that older libraries might lack.

Step 2 – Install Build Dependencies

Install the core development packages:

pkg install git wget tar proot clang make openssl-dev libcrypt-dev zlib-dev

Optional but recommended: ncurses-dev if you want the text‑based VeraCrypt UI.
```
pkg install ncurses-dev
```

These packages provide the compiler (clang), the GNU make system, and the cryptographic libraries VeraCrypt links against.

Step 3 – Download and Verify the VeraCrypt Source

Navigate to a working directory inside Termux, e.g. ~/src:
```
mkdir -p ~/src && cd ~/src
```
Download the latest stable tarball (as of this writing, 1.26.7). Replace the URL with the current version if you wish to use a newer release:
```
wget https://launchpad.net/veracrypt/trunk/1.26.7/+download/VeraCrypt_1.26.7_Source.tar.bz2
```
Verify the SHA‑256 checksum (optional but good practice). The checksum can be found on the official VeraCrypt download page.
```
sha256sum VeraCrypt_1.26.7_Source.tar.bz2
```
Compare the output with the published checksum; if they differ, abort and re‑download.
Extract the archive:
```
tar xjf VeraCrypt_1.26.7_Source.tar.bz2
```
The source will be placed in a directory called VeraCrypt_1.26.7.

Verification ensures the code has not been tampered with on the way to your device.

Step 4 – Compile VeraCrypt for Android

Enter the source directory:
```
cd VeraCrypt_1.26.7
```
The source includes a script that builds for Linux. Android’s Bionic libc is compatible, so we can use the same makefile with a few tweaks. Open the Makefile and locate the line defining OS. Change it to OS=android.
```
sed -i 's/^OS=.*/OS=android/' Makefile
```
Start the build process:
```
make
```
You will see compilation messages. If you encounter an error about sys/mman.h or similar, ensure the libcrypt-dev and openssl-dev packages are installed.
When the build finishes, the executable veracrypt will appear in the current directory.

Why we compile locally: Pre‑compiled binaries for Android are rare and often bundled with root requirements. Building from source guarantees the binary runs in Termux’s user space, keeping the device unrooted.

Step 5 – Move the Binary to a Permanent Location

Create a bin directory in your home folder and copy the binary:
```
mkdir -p ~/bin && cp veracrypt ~/bin/
```
Make sure the directory is on your PATH. Add the following line to ~/.bashrc (or ~/.zshrc if you use Zsh):
```
echo 'export PATH="$HOME/bin:$PATH"' >> ~/.bashrc
```
Then reload the shell:
```
source ~/.bashrc
```
Test the installation:
```
veracrypt --version
```
You should see the version number and a short usage summary.

Placing the binary in ~/bin keeps it separate from the source tree and makes future updates easier.

Step 6 – Create an Encrypted Container

Decide the size of the container. For example, a 500 MB vault:
```
veracrypt --text --create ~/veracrypt_container.hc --size 500M --encryption AES --hash SHA-512 --filesystem exfat --pim 0 --keyfiles "" --password
```
The command will prompt you to enter a password twice. Choose a strong, memorable passphrase (at least 12 characters, mix of letters, numbers, symbols).
Explanation of flags:
- --text – runs VeraCrypt in command‑line mode (required in Termux).
- --create – creates a new volume.
- --size – size of the container.
- --encryption – encryption algorithm (AES is the default and widely trusted).
- --hash – hash algorithm for the key derivation.
- --filesystem – we use exfat for cross‑platform compatibility; you can choose fat or ntfs if you prefer.
- --pim 0 – disables the optional Personal Iterations Multiplier; leave at 0 unless you have a specific need.
- --keyfiles "" – indicates no additional keyfiles.
After the command finishes, you will see a message confirming the volume creation.

Result: a single file veracrypt_container.hc that holds an encrypted filesystem.

Step 7 – Mount the Container

Create a mount point inside Termux:
```
mkdir -p ~/mnt/veracrypt
```
Mount the container:
```
veracrypt --text --mount ~/veracrypt_container.hc ~/mnt/veracrypt
```
You will be asked for the password again. If the mount succeeds, the command returns silently.
Verify the mount by listing the contents:
```
ls -l ~/mnt/veracrypt
```
You should see an empty directory (or the files you previously stored).

Why mounting matters: while the container is mounted, the encrypted data is available as a regular directory. When you unmount, the underlying file becomes unreadable without the password.

Step 8 – Use the Encrypted Volume

Copy files into the mounted directory just as you would with any other folder. For example:
```
cp /sdcard/Download/secret.pdf ~/mnt/veracrypt/
```
When you are done, you can safely close the mount (see next step) and the files will be encrypted on disk.
If you need to access the container from other Android apps (e.g., a file manager), you can use the SAF (Storage Access Framework) bridge. Install the helper app Termux:API and run:
```
termux-open ~/mnt/veracrypt
```
This opens the mounted folder in the system picker, allowing other apps read/write access while the volume remains mounted.

Tip: Keep the mount point inside Termux’s private storage (/data/data/com.termux/files/home) to avoid accidental exposure through Android’s media scanner.

Step 9 – Unmount the Container

When you no longer need the files, unmount the volume:
```
veracrypt --text --dismount ~/mnt/veracrypt
```
You will see a confirmation line.
Optionally, delete the mount point if you won’t reuse it soon:
```
rmdir ~/mnt/veracrypt
```

Unmounting removes the decrypted view from memory and ensures the container is locked again.

Step 10 – Automate Mounting with a Simple Script

Create a script called vc-mount.sh in ~/bin:

cat > ~/bin/vc-mount.sh <<'EOF'
#!/data/data/com.termux/files/usr/bin/bash
CONTAINER="$HOME/veracrypt_container.hc"
MOUNTPOINT="$HOME/mnt/veracrypt"
if [[ ! -d "$MOUNTPOINT" ]]; then
  mkdir -p "$MOUNTPOINT"
fi
veracrypt --text --mount "$CONTAINER" "$MOUNTPOINT"
EOF
chmod +x ~/bin/vc-mount.sh

Create a counterpart for dismounting:

cat > ~/bin/vc-dismount.sh <<'EOF'
#!/data/data/com.termux/files/usr/bin/bash
MOUNTPOINT="$HOME/mnt/veracrypt"
veracrypt --text --dismount "$MOUNTPOINT"
EOF
chmod +x ~/bin/vc-dismount.sh

Now you can run vc-mount.sh and vc-dismount.sh with a single tap from Termux or via a widget (Termux:Widget plugin) for quick access.

This automation saves you from re‑typing the long command each time.

Troubleshooting Common Issues

1. Compilation Fails with “cannot find -lcrypto”

Make sure the openssl-dev package is installed. Re‑run:

pkg install openssl-dev

Then clean the build directory (make clean) and start again.

2. “Permission denied” When Accessing `/sdcard`

Termux runs in its own sandbox. To read/write external storage you must grant the READ_EXTERNAL_STORAGE and WRITE_EXTERNAL_STORAGE permissions:

termux-setup-storage

Accept the Android prompt. After that, /sdcard will be symlinked to ~/storage/shared.

3. Mount Fails With “Device is not a VeraCrypt volume”

Typical causes:

Wrong file path – double‑check you are using the exact .hc file.
Corrupted container – if you suspect corruption, try mounting with the --protect-hidden flag or restore from a backup.

4. “Out of memory” Errors on Low‑End Devices

VeraCrypt keeps a cache of the decrypted filesystem in RAM. Reduce the container size or use a lighter filesystem like fat instead of exfat. Example:

veracrypt --text --create ~/veracrypt_container.hc --size 200M --filesystem fat

5. Unmount Returns “Device is busy”

Some app may still hold an open file handle. Close any file manager windows that are viewing the mount point, then retry. If the problem persists, force dismount:

veracrypt --text --dismount "$HOME/mnt/veracrypt" --force

Use the --force option only as a last resort, as it may cause data loss for any unsaved changes.

Safety and Best‑Practice Tips

Strong passwords: Use a password manager to generate and store a 20‑character random passphrase. Forgetting it means the container is unrecoverable.
Backup the container: Copy the .hc file to an external SD card or cloud storage (encrypted again) regularly.
Do not store the password in plain text: Avoid scripts that embed the password; VeraCrypt will prompt you each time, which is safer.
Limit mount time: Keep the volume mounted only when you need it. The longer it stays mounted, the larger the window for a malicious app to read the decrypted data.
Keep Termux updated: Run pkg upgrade -y periodically to receive security patches for the underlying toolchain.

Alternative Approaches

If compiling sounds daunting, you can install the pre‑built VeraCrypt APK from the official website (requires allowing installation from “unknown sources”). The app provides a UI but still runs without root. However, the Termux method has two advantages:

It works on devices where the official APK is blocked by the manufacturer.
You gain scriptability, letting you integrate mounting into backup scripts or automation tools like Tasker.

Wrapping Up

By following this tutorial you have turned your Android phone into a portable, strong‑encryption vault without touching the system partition. The workflow—install Termux, compile VeraCrypt, create a container, mount, use, and dismount—covers the entire lifecycle of secure file storage on an unrooted device. Remember to keep your password safe, back up the container file, and unmount when finished. With these habits, you can protect sensitive documents, private photos, or any data you wish to keep out of the hands of apps and prying eyes.

User Comments (0)

Add Comment

No comments added yet.

Add Comment

Your Name: *

Comment Title: *

Your E-mail: * We'll never share your email with anyone else.

Your Comment: *

Comments will not be approved to be posted if they are SPAM, abusive, off-topic, use profanity, contain a personal attack, or promote hate of any kind.