Hello people of StackExchange.

It's my first time asking and I know little about Cryptography, so be gentle. My problem can be simplified to this:

I can create a 2GB Volume that contains 1GB of text files and 1GB of photos. It has the password 123.

Or I can create a 1GB Volume with 1GB of text files with the password 123 and a 1GB Volume with 1GB of photos, again password 123.

It seems to me that it makes no difference in security. If the attacker gets the password he gets all the files. But I may have oversimplified the issue. What's your take on it?

  • 4
    $\begingroup$ My take is that you'd be well advised to select a better password... $\endgroup$ – poncho Oct 27 '18 at 22:59
  • $\begingroup$ 1) two short/simple password to secure your Volume. 2) Newer use same password for different Volumes. $\endgroup$ – kelalaka Oct 27 '18 at 22:59

It depends on the possible attack vectors.

Generally password reuse is very dangerous. For instance, you could have less important files in one volume - say that the photos are less important. An attacker could ask you to show him a photo or two. You enter the password and the attacker performs classic shoulder surfing to get to know the password. Now the password is known for the important text files as well. Possibly you would not have entered the password if both sets of files were in one volume. This is one of the many reasons why you should not share passwords of internet sites either.

At the very least you'll have to enter the password twice to unlock all the files, it seems to me. So having two times the same password is less secure than having one whatever you do.

If you want to use one password: use a password manager, preferably on an unconnected device and unlock two highly complex and different passwords with the one used to unlock the database file.


There is no difference in terms of cryptographic security, assuming the same program is used to encrypt each volume using identical settings. An important aspect of password reuse is that your security is at most as good as that of the weakest service or software.

If one volume's encryption key is protected by Argon2 and the other is protected with one of the SHA algorithms, then a rational attacker will first try to crack the second volume. They can try more passwords per second with the fast hash algorithm. (They would also try variations on that password; some users think they're clever because they change the last digit of their password or add a "email" or "stackexchange" suffix to it.)

An advantage to separating volumes, perhaps, is that inadvertently leaving one unlocked won't let someone open the other volume. Assuming the encryption software uses unique salts with its key derivation algorithm, even when passwords are reused, then the derived encryption key will not be the same for both volumes. (Also assuming the password itself isn't accessible long after deriving one encryption key from the password, perhaps due to a bug.)

A significant disadvantage to separating volumes is that it you may need to enter the same password twice as often. In theory that doesn't matter, but in practice anyone would be tempted to use a shorter (and thus weaker) password.

  • 2
    $\begingroup$ tl;dr: Passwords don't directly encrypt files, salted-hashed passwords does. Assuming passwords are salted into different encryption keys and password didn't leak (which it did here), they're essentially the same. $\endgroup$ – DannyNiu Oct 28 '18 at 2:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.