---
title: "Node encryption"
description: "What disk encryption protects on a node, why it is a creation-time choice, and what you actually control (on or off, nothing more)."
content_type: "concept"
product: "node"
platform: "MyAccount"
url: "/myaccount/node/concepts/node-encryption/"
---

# Node encryption

Disk encryption protects the data stored on a node's disk. If that storage were ever read
outside the running node, the data stays unreadable without the passphrase you set. It is a
single on-or-off choice you make when you create the node, and it is off by default.

Turn it on if the node will hold data you would need to keep unreadable even if the disk were ever
accessed outside your running node. That requirement comes up most often for compliance-sensitive or
customer data. Decide before you create the node: encryption is set for good at creation. If a node
already running needs it, save an image from it, then [create a new
node](/myaccount/node/how-to/create-a-node/) from that image with **Enable Encryption** checked, and
move your workload over to it.

## Turning on encryption when you create a node

**Enable Encryption** is an optional checkbox under **Advanced settings** when you create a
node, with a passphrase field next to it. It is offered for C3,
M3, E1, E1WC, and SDC3 nodes. If your account turns encryption on by default in
**General Settings**, the checkbox comes pre-selected when you start creating a node.

Setting a passphrase is optional. A passphrase you do set needs to be 8 to 12 characters, with
an uppercase letter, a lowercase letter, and a special character.

E2E does not publish the method or key size; your only choice is whether encryption is on or off.

## Once the node is running

The node list shows a lock icon next to a node's name when its disk encryption is on. You can tell
at a glance without opening the node.

To run an encrypted node from a saved image, turn on encryption when you create that node. See [Save
a node as an image](/myaccount/node/how-to/save-a-node-as-an-image/) for that task.

Backup encryption is a separate setting with its own passphrase, turned on when you enable backups
rather than here. Encrypt the disk and the backups separately if you want both protected. See
[Enable backups on a node](/myaccount/node/how-to/enable-backups-on-a-node/).