Create an Encrypted VeraCrypt Container on Android Using Termux (No Root)

Why an Encrypted Container on Android?

Android devices store a lot of personal data – photos, documents, backups, and even app data. While the built‑in encryption protects the whole device, you may want to keep a specific set of files hidden from the system, cloud backups, or other users who might gain temporary access. An encrypted VeraCrypt container works like a virtual drive that is readable only after you provide the correct password. It offers strong, open‑source encryption (AES‑256, Twofish, etc.) and can be moved between devices.

This tutorial shows how to set up such a container using Termux, a lightweight terminal emulator for Android. No root is required; everything runs in user space.

Before You Start

• Charge your device to at least 50 % – compilation can be CPU‑intensive.
• Connect to a stable Wi‑Fi network (the download size is ~30 MB).
• Make sure you have at least 1 GB of free internal storage for the source code and the container file.
• Enable Settings → Security → Install unknown apps for Termux (or allow from the Play Store) so it can execute binaries.
• Back up any important data – while the process does not touch existing files, a failed compile may require reinstalling Termux.

Step 1 – Install and Prepare Termux

1. Install Termux from F‑Droid (recommended for the latest version) or the Google Play Store.
2. Open Termux and run the initial update commands:

   pkg update && pkg upgrade -y

   This ensures all repositories are current.
3. Install essential build tools and libraries:

   pkg install git make clang wget tar proot -y

   VeraCrypt’s source uses make and the clang compiler.
4. Grant Termux access to shared storage so you can move files in and out of the container:

   termux-setup-storage

   You will be prompted to allow storage access – tap Allow.

Step 2 – Download VeraCrypt Source

VeraCrypt does not provide a pre‑compiled Termux package, so we compile it from source.

1. Create a working directory:

   mkdir -p ~/src && cd ~/src

2. Download the latest stable tarball (replace 1.26.7 with the current version if needed):

   wget https://launchpad.net/veracrypt/trunk/1.26.7/+download/VeraCrypt_1.26.7_Source.tar.gz

3. Extract the archive:

   tar -xzf VeraCrypt_1.26.7_Source.tar.gz

4. Enter the source directory:

   cd VeraCrypt_1.26.7

Step 3 – Compile VeraCrypt for Android

The source includes a Makefile with an Android target. The compilation may take 5‑15 minutes depending on your CPU.

1. Set the ANDROID flag and start the build:

   make clean && make -j$(nproc) GUI=none

   The GUI=none option skips the graphical front‑end, which is unnecessary for command‑line use.
2. If you encounter an error about android-ndk or missing headers, install the NDK via Termux’s package manager:

   pkg install ndk-sysroot -y

   Then retry the make command.
3. When the build finishes, the binaries veracrypt and veracrypt-mount appear in the src folder.
4. Copy the main binary to a directory in your PATH for easy access:

   cp src/veracrypt $PREFIX/bin/ && chmod +x $PREFIX/bin/veracrypt

Step 4 – Create an Encrypted Container File

VeraCrypt containers are just regular files that act as virtual disks once mounted.

1. Decide on the size of the container. For example, a 500 MB container is suitable for a few documents:

   veracrypt --text --create ~/storage/shared/secure_container.hc --size 500M --encryption AES --hash SHA-512 --filesystem exFAT --pim 0 --keyfiles "" --random-source /dev/urandom

   Explanation of the flags:
   • --text – forces command‑line mode.
   • --create – creates a new volume.
   • --size 500M – container size.
   • --encryption AES – encryption algorithm (AES‑256 by default).
   • --hash SHA-512 – hash algorithm for the header.
   • --filesystem exFAT – file system usable on both Android and Windows/macOS.
   • --pim 0 – Personal Iterations Multiplier; 0 means default.
   • --random-source /dev/urandom – source of entropy.
2. When prompted, enter a strong password (minimum 12 characters, mix of letters, numbers, symbols). Confirm it.
3. The tool will ask whether to use keyfiles – press Enter to skip.
4. After a short key‑derivation phase, the container file is ready.

Step 5 – Mount the Container

Mounting makes the encrypted volume appear as a directory you can read/write.

1. Create a mount point directory:

   mkdir -p ~/veracrypt-mount

2. Mount the container:

   veracrypt --text --mount ~/storage/shared/secure_container.hc ~/veracrypt-mount

   You will be asked for the password you set earlier.
3. If the mount succeeds, you will see a confirmation line like:

   VeraCrypt 1.26.7 successfully mounted.

   Now any file you copy into ~/veracrypt-mount is stored encrypted on the underlying container file.

Step 6 – Using the Encrypted Volume

You can treat the mount point like any other directory. Below are common tasks.

• Copy files into the container:

  cp /sdcard/Download/secret.pdf ~/veracrypt-mount/

• Open a file with an Android app: Many file managers can browse ~/veracrypt-mount via the Termux storage shortcut. Alternatively, use termux-open:

  termux-open ~/veracrypt-mount/secret.pdf

• List contents:

  ls -lh ~/veracrypt-mount

Step 7 – Unmount the Container Safely

Improper unmounting can corrupt the filesystem inside the container.

1. First, ensure no process is using the mount point. You can close any file manager or stop background copy operations.
2. Unmount with the following command:

   veracrypt -d ~/veracrypt-mount

   The -d flag tells VeraCrypt to dismount the specified mount point.
3. Verify that the mount point is empty:

   ls ~/veracrypt-mount

   It should return “No such file or directory” or an empty list.

Step 8 – Backing Up the Container

The container file is a single, portable entity. Back it up like any other file.

• Copy it to cloud storage (e.g., Google Drive) – the encryption remains intact.
• Use rsync over Wi‑Fi to another Android device or a PC.
• Keep at least two copies in separate locations to avoid loss from accidental deletion.

Alternative: Using LUKS with cryptsetup

If VeraCrypt compilation fails on your device (e.g., due to missing glibc support), you can fall back to Linux Unified Key Setup (LUKS) via the cryptsetup package available in Termux.

1. Install cryptsetup:

   pkg install cryptsetup -y

2. Create a raw file (e.g., 200 MB):

   dd if=/dev/zero of=~/storage/shared/luks_container.img bs=1M count=200

3. Initialize LUKS on the file:

   cryptsetup luksFormat ~/storage/shared/luks_container.img

4. Open the LUKS volume:

   cryptsetup open ~/storage/shared/luks_container.img myvault

5. Create a filesystem (ext4 is common):

   mkfs.ext4 /dev/mapper/myvault

6. Mount it:

   mkdir -p ~/luks-mount && mount /dev/mapper/myvault ~/luks-mount

7. When finished, unmount and close:

   umount ~/luks-mount && cryptsetup close myvault

LUKS offers comparable security, but VeraCrypt is more portable across Windows, macOS, and Linux because the container file can be opened with the free VeraCrypt GUI on those platforms.

Troubleshooting Common Issues

Best Practices for Ongoing Use

• Use a strong, unique password for each container. Consider a passphrase with multiple words.
• Store the password in a reputable password manager (e.g., Bitwarden) – never write it on plain paper.
• Regularly back up the container file to at least two locations.
• When moving the container between devices, always mount via VeraCrypt on the destination to verify integrity.
• Keep Termux and the compiled VeraCrypt binary up to date by pulling the latest source and recompiling every 6‑12 months.

Wrapping Up

By following this tutorial you now have a portable, AES‑256 encrypted container that lives on your Android device, accessible only after you provide the correct password. The container can be backed up, transferred, and opened on Windows, macOS, or Linux with the standard VeraCrypt GUI, giving you a seamless cross‑platform security solution without ever rooting your phone.

Feel free to experiment with larger containers, different file systems (NTFS for Windows compatibility), or multiple containers for separate data categories. As always, treat your passwords and backups with the same care you would any other valuable asset.