---
title: "SFS encryption"
description: "How encryption works for SFS, and what to decide at creation."
content_type: "concept"
product: "sfs"
platform: "MyAccount"
url: "/myaccount/sfs/concepts/sfs-encryption/"
---

# SFS encryption

Encryption protects an SFS's data where it is stored on disk. You turn it on when you create the
SFS, and it stays on for as long as the SFS exists. Decide before you create it.

## Turn it on at creation

When you create the SFS, check **Enable Encryption** on the same form where you set its name, VPC,
and size; see [Create an SFS](/myaccount/sfs/how-to/create-an-sfs/).

## Set a passphrase

Under **Enter Passphrase(Optional)**, set your own passphrase, or leave it blank and E2E generates one for you. A passphrase is exactly 12 characters, with at least one uppercase letter, one
lowercase letter, and one of `! @ # $ % ^ & *`.

## Spot an encrypted SFS

An encrypted SFS shows a shield icon next to its name in the list.

## Copies of an encrypted SFS

A clone or an upgrade of an encrypted SFS starts unencrypted, because encryption is set only when
you create an SFS. **Enable Encryption** on the clone and upgrade forms leaves the copy unencrypted. Encryption covers the SFS's own disk; its snapshots and backups are stored unencrypted. To get an encrypted copy,
create a new SFS with **Enable Encryption** checked, then copy your files to it; see [Create an SFS](/myaccount/sfs/how-to/create-an-sfs/).