Encrypt and Decrypt Files on Android with OpenSSL in Termux (No Root)

Why encrypt files on Android without root?

Android stores many personal documents, photos, and backups on the internal storage. If you need to move a file to a cloud service, share it via email, or simply keep it safe from prying eyes, encryption is the most reliable protection. Using OpenSSL inside Termux gives you full control over the cryptographic algorithm, key length, and password handling—all without rooting the device.

Before you start

• Ensure your phone has at least 200 MB of free storage for Termux packages.
• Connect to a stable Wi‑Fi network – the installation downloads several megabytes.
• Charge the device to at least 50 % to avoid interruptions.
• If you plan to encrypt sensitive personal data, write down the password or store the generated private key in a secure location (e.g., a password manager).

Step 1 – Install Termux and update the environment

1. Open the Google Play Store (or F-Droid) and install Termux.
2. Launch Termux. The first run will set up a minimal Linux environment.
3. Update package lists and upgrade existing packages:

   pkg update && pkg upgrade -y

   This may take a few minutes. Do not skip the upgrade – newer OpenSSL builds depend on recent libraries.

Step 2 – Install OpenSSL

1. In the same Termux session, install the OpenSSL package:

   pkg install openssl

   The command pulls the openssl binary and its dependencies.

2. Verify the installation:

   openssl version

   You should see something like OpenSSL 1.1.1l 24 Aug 2021. If an error appears, run pkg install libcrypt and retry.

Step 3 – Choose an encryption method

OpenSSL supports many symmetric algorithms. For most everyday use, AES‑256‑CBC offers a good balance of security and speed. This tutorial uses the enc sub‑command, which handles key derivation from a password automatically.

Step 4 – Encrypt a file

1. Place the file you want to protect somewhere you can reference it from Termux. The easiest way is to copy it to the shared ~/storage/downloads folder:

   termux-setup-storage

   This command asks for storage permission and creates a storage shortcut inside Termux.

2. Navigate to the folder containing the file (replace myfile.pdf with your actual filename):

   cd ~/storage/downloads

3. Run the encryption command. You will be prompted twice for a password – the second time to confirm:

   openssl enc -aes-256-cbc -salt -in myfile.pdf -out myfile.pdf.enc

   Explanation of flags:

   • -aes-256-cbc – selects the cipher.
   • -salt – adds a random 8‑byte salt, improving resistance against dictionary attacks.
   • -in – source file.
   • -out – destination encrypted file.

   After you enter the password, myfile.pdf.enc will appear in the same directory.

Step 5 – Verify the encryption

1. Check the file size. The encrypted file should be slightly larger than the original due to the salt and padding.

   ls -lh myfile.pdf myfile.pdf.enc

2. Attempt a quick decryption to a temporary location (do not overwrite the original):

   openssl enc -d -aes-256-cbc -in myfile.pdf.enc -out /tmp/check.pdf

   If the password is correct, /tmp/check.pdf will be a valid copy. You can open it with any PDF viewer to confirm.

Step 6 – Decrypt the file later

1. When you need the original file, run the decryption command:

   openssl enc -d -aes-256-cbc -in myfile.pdf.enc -out myfile_decrypted.pdf

   You will be asked for the same password you used during encryption.

2. After decryption, verify integrity by comparing checksums:

   sha256sum myfile.pdf myfile_decrypted.pdf

   The two hashes should match exactly.

Step 7 – Automate encryption for multiple files

If you regularly need to protect a batch of files, a tiny shell script saves time. Create encrypt.sh in your ~/bin (create the folder if it does not exist):

mkdir -p ~/bin
cat > ~/bin/encrypt.sh <<'EOF'
#!/data/data/com.termux/files/usr/bin/bash
# Simple wrapper for OpenSSL AES‑256‑CBC encryption
if [ $# -lt 1 ]; then
  echo "Usage: $0 file1 [file2 ...]"
  exit 1
fi
for src in "$@"; do
  if [ ! -f "$src" ]; then
    echo "File not found: $src"
    continue
  fi
  dst="${src}.enc"
  echo "Encrypting $src → $dst"
  openssl enc -aes-256-cbc -salt -in "$src" -out "$dst"
done
EOF
chmod +x ~/bin/encrypt.sh

Now you can encrypt any number of files with a single command:

~/bin/encrypt.sh ~/storage/downloads/report.docx ~/storage/downloads/photo.jpg

The script prompts for the password once per file. For a single password across all files, you can add the -pass pass:YOUR_PASSWORD flag (but keep in mind that storing passwords in plain text is insecure).

Step 8 – Optional: Use a private key instead of a password

Some users prefer asymmetric encryption (public‑key cryptography) so that the decryption key never travels with the encrypted data. OpenSSL can encrypt a symmetric key with an RSA public key, then store the encrypted key alongside the ciphertext.

1. Generate an RSA key pair (2048‑bit is sufficient for most cases):

   openssl genpkey -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:2048
   openssl rsa -pubout -in private_key.pem -out public_key.pem

2. Encrypt a file using the public key:

   openssl rsautl -encrypt -inkey public_key.pem -pubin -in myfile.pdf -out myfile.pdf.key.enc
   openssl enc -aes-256-cbc -salt -in myfile.pdf -out myfile.pdf.enc -pass file:myfile.pdf.key.enc

   The first command encrypts a random symmetric key with the RSA public key. The second command uses that encrypted key as the password source.

3. Decrypt:

   openssl rsautl -decrypt -inkey private_key.pem -in myfile.pdf.key.enc -out myfile.key
   openssl enc -d -aes-256-cbc -in myfile.pdf.enc -out myfile_decrypted.pdf -pass file:myfile.key

   After decryption, securely erase the temporary myfile.key file:

   shred -u myfile.key

Troubleshooting

• "openssl: command not found" – Ensure you installed the package in the same Termux session. Run pkg install openssl again.
• Decryption fails with "bad decrypt" – Most likely the password is mistyped or the encrypted file is corrupted. Verify the file size and try re‑encrypting a small test file.
• Permission denied when accessing storage – Run termux-setup-storage and grant the permission dialog that appears.
• File too large error – Termux runs on a 32‑bit environment on some older devices, limiting single‑process memory. Split the file into chunks (split command) and encrypt each chunk separately.

Security considerations

• Always use a strong, random password (minimum 12 characters, mix of letters, numbers, symbols).
• Keep the OpenSSL version up to date. Run pkg upgrade openssl periodically.
• If you store encrypted files on external SD cards, remember that the card itself is not encrypted – anyone with the password can decrypt the data.
• Consider adding a MAC (Message Authentication Code) by using an authenticated cipher like AES‑256‑GCM. The command syntax changes only the algorithm name.

Wrap‑up

With Termux and OpenSSL you gain a full‑featured, cross‑platform encryption toolbox on Android without needing root access. The steps above let you protect single files, automate batch encryption, and even employ public‑key cryptography for extra safety. Because the process runs entirely on the device, your data never leaves the phone unless you deliberately upload the .enc file to the cloud.

Feel free to adapt the scripts to your workflow, experiment with different ciphers, or combine this method with other Termux utilities like rsync for secure, encrypted backups.