Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If performance is of no concern, which TrueCrypt algorithm is the safest to use?

  • AES
  • Serpent
  • Triple DES
  • Twofish
  • AES-Twofish
  • AES-Twofish-Serpent
  • Serpent-AES
  • Serpent-Twofish-AES
  • Twofish-Serpent
share|improve this question
They're all safe, otherwise they wouldn't be in the product. But use AES, since it's the standard. – Ian Boyd Nov 6 '10 at 16:13
I'd say unless there is a government agency after you, the quality of your password is more likely to be an issue than the encryption algorithm. – Col Aug 17 '11 at 13:43
That’s so weird; I could have sworn the title was asking which is the fastest. ಠ_ఠ – Synetech Oct 6 '13 at 13:38

14 Answers 14

up vote 33 down vote accepted

these are the results of the voting in the final round of the AES-contest:

Rijndael 86-10 = 76
Serpent 59-7   = 52
Twofish 31-21 = 10
RC6 23-37 = -14
MARS 13-83 = -70 

(, linked via truecrypt serpent, read that one as well).

so, for a variety of reason Rijndael became AES, which is the successor of DES (and 3DES).

and, just because it popped up today on, the story of AES:

share|improve this answer

Using TrueCrypt 7.0a, the most secure method of encryption is: Use the AES-Twofish-Serpent cascading encryption with the XTS method. Use the Whirlpool hash algorithm. (SHA-512 is a very close 2nd place here... it's debatable... I'm leaning towards Whirlpool because SHA-512 is already having a successor developed because of fears that it is based on an older SHA-1 that has been compromised.) MOST IMPORTANT is to use a VERY strong password. 20 to 30+ characters, uppercase, lowercase, numbers, symbols. Use Microsoft's online password checker for a strength test. You can also use Keyfiles to further secure your password.

I recommend the AES-Twofish-Serpent over the Serpent-Twofish-AES because you want the outermost encryption (AES will be the first layer they need to break) to be the most standard in the industry. That one is the most tried and true and the most tested of all of them. Plus, if someone assumes a file is encrypted with AES, there's no way of seeing that is is then encrypted with Twofish... so they do all this work to break the AES, only to find that Twofish stands in their way now. And then again after Twofish they run into Serpent, which is the biggest beast of them all (even though it is less used / tested than AES, it still has a much higher security margin than AES)

If you do use Keyfiles, I'd recommend having TrueCrypt create 3 keyfiles for you. Create one keyfile for each hash algorithm they provide. You might also add some .jpg's and some .mp3 files as well. I would make sure to make each keyfile read-only however.

This is probably overkill though.

share|improve this answer
+1 Thanks for your tips on Truecrypt! – Amir Rezaei Aug 19 '11 at 6:26
You say use 20-30 chars, but isn't that overkill? Even 10 lowercase chars would be 26^10 = 141,167,095,653,376 combinations (4 million years at one check per second). More than good enough surely? – Dan W Nov 2 '12 at 19:54
@Dan W: At one check per second, surely. However, though hashing methods vary a lot in performance, consumer grade hardware comes a lot closer to testing billions of passwords per second. Your ten character lowercase password would be cracked in a matter of hours. – Marcks Thomas Dec 6 '12 at 19:15
Your rationale for the cascade order doesn't make any sense. An attacker will have to break through each layer (each one using an independent key), regardless of whether AES is first or last. – jjlin Sep 21 '13 at 17:18

The cascaded ciphers (AES-Twofish-Serpent, etc.) should be the most secure. Your data is encrypted with one algorithm, then the output from that is encrypted with the second algorithm, whose output is encrypted with the third algorithm. According to the TrueCrypt documentation, each algorithm uses a different key, each derived from your passphrase.

If a vulnerability is found in one (or two) of these ciphers, your data should still be secure, as an attacker would still not be able to break the remaining ciphers.

share|improve this answer
I would like to add that if only one cipher is to be chosen, Serpent is likely to be the most secure, but is significantly slower than AES (note that the government's selection of the Advanced Encryption Standard involved performance, not just security). – bwDraco Jul 13 '11 at 22:22

Either AES-Twofish-Serpent or Serpent-Twofish-AES. But regular AES is sufficient.

share|improve this answer

Rijndael won the AES competition primarily because it's the fastest and easiest to implement in hardware, not because it's the most "secure." Twofish and Serpent are usually considered more secure, but since they are all extremely rock-solid, that's a very subjective claim. And of course, encrypting with multiple algorithms will be even more "secure," but will reduce the speed even further.

Again, they're all rock-solid, so my advice would be to just go with whichever is fastest on your machine (usually AES).

share|improve this answer

I've read that chaining algorithms together may result in weaker security due to the algorithm used to follow one with the other.

Further, the efficiency and speed will take a large hit if you used one of the combined ciphers.

I would recommend either Rijndael (AES) or Serpent and if you want it to be secure: the most crucial element is the key so make a very long key with at least one of each set of upper and lower case, number and symbol characters.

share|improve this answer

Although there are some dangers in cascading multiple ciphers together, Truecrypt appears to deal with them as best it can. It doesn't add any known plaintexts to the output of the first cipher and it uses indepentant keys for each so by chaining the different algorithms together it should increase the security.

I would stear clear of 3DES though. Having read the Truecrypt page listing the choices of algorithm it doesn't even list triple DES so they may have recently removed it.

share|improve this answer
For those interested in a more in depth discussion of the "dangers" in cascading multiple ciphers, check this topic:… – Tiago Oct 10 '13 at 4:01

You can conceivably use a shorter pass word if you are using keyfiles, and if you are not worried about performance hits, using AES Twofish and Serpent will cause much headache to those trying to get into the encrypted material. But also don't overlook that you can also take one encrypted file and place it on the inside of a larger encrypted file. In this way, you can "allow" your attackers to look at the outside container and let them think they have the entire container. When in fact, they don't have anything at all. Feel free to put something slightly shady in the outside file, but nothing that would actually cause you problems. I think a slew of pornographic photos would fit this bill nicely, here is something that someone would want to hide, and as such, you have a nice reason. The outside container does not reveal that the inside container even exists. Place your actual material inside the inner container. Even better is to make the outside container "weak" with an insufficient password, and no keyfile. Let your attackers think they broke your encryption, and shrug your shoulders and say, "Damn, you are good, you have me dead to rights."

share|improve this answer

I recommend that you use the Whirlpool hash with these algorithms as it is the strongest.

For encryption algorithms, you should use a cascade. I recommend AES, Twofish, Serpent. AES is quite weak (compared to other algorithms but is the fastest) and is the industry standard therefore will be effective as an outer layer. Twofish is even stronger and after decrypting the AES layer, there will be another layer (Twofish) which is even stronger. Serpent is the strongest and this cascade proves effective.

Some extra info: For passwords, the NSA has a quantum computer that can decrypt very quickly. I would not trust the NSA (they designed AES). I would recommend a minimum of 40 letters, lowercase and uppercase, numbers, symbols and no dictionary words or personal information (birth dates etc.) and you could use keyfiles. If you are at risk from an adversary, use the plausible deniability features built into TrueCrypt.

share|improve this answer
There are no known known Quantum Computing attacks on AES. Quantum Computers are not faster than our binary computers. They are only different. – Mark Lopez Mar 4 '14 at 22:13

Best public cryptanalysis for each, assuming 256 bit variants (higher time complexity is better, but all kinds of caveats):

  • Rijndael: 2^254.4 time complexity (ignoring related key attacks that wouldn't be at issue here)
  • Serpent: 12 rounds of 32, 2^228.8 time complexity (but requires 2^118 known plaintexts)
  • Twofish: 6 rounds of 16 (but requires 2^51 chosen plaintexts)
  • 3DES: 2^118 (with 2^32 known plaintexts; note, 3DES uses 168 bit, so brute force is 2^168 instead of 2^256)

Undoubtedly, 3DES is the least secure, but that doesn't necessarily make it insecure (barring the usual unpublished backdoor concern). However I would avoid it. All of the other algorithms are generally considered secure. Determining the presence of an intentionally placed backdoor in any of them likely requires Snowden to release more documents. And honestly, if any of the top 3 did have a backdoor, that would be an absolute bombshell revelation. Given his track record, I'm personally happy to assume that they're still secure.

share|improve this answer

Or use Diceware passphrase:

  • NSA cannot decrypt diceware passphrase. Infeasible.

share|improve this answer
It would seem to me that 'Diceware', which attempts to replace a PRNG with actual dice, limits the dictionary and possible passwords substantially. You are going from nearly infinite possibilities to a finite list of possible words in finite combinations. Is this not true? – bitsum Jan 30 at 23:34

Since there are no known attacks against AES that make brute-forcing feasible (ref:, unless you expect 3-letter agencies to devote their entire computing power for the next millennium to cracking your drive, AES is the way to go. The last version of TrueCrypt as well its forks support AES-NI, which on my Core i7 3770 provide a throughput of over 2.5 GB/sec.

Your connection to the IP address advertised by this domain uses AES encryption on most browsers (although CloudFlare holds the key seen by your browser, and decrypts and re-encrypts your data before sending it to the StackExchange servers, so don't use your TrueCrypt/VeraCrypt/CipherShed password for your StackExchange password because if said 3 letter agencies were to crack your drive, they'd intercept your password at the CloudFlare proxy and try that first long before attempting the never-going-to-work brute force).

share|improve this answer

After a quick search I'd say AES 256 bits.

I would avoid Triple AES and Triple blowfish. Running the same algorithm multiple times may result in less security then using the original algorithm one time.


share|improve this answer
Seems believable as speculation, but Triple DES is certainly enhanced by the multiple passes. (Unless the designer of the underlying implementation makes a blunder and does "EK2(DK1(EK1(plaintext)))" as Simon Singh did in his cypher challenge :P) – RJFalconer Nov 6 '10 at 18:19
1) Your source is a joke. A random forum post. 2) There is no reason to believe that triple encryption with different keys will weaken the encryption. – CodesInChaos Jul 23 '11 at 13:13
Reminds me, many years ago, when I decided to upgrade my database's hash algorithm from md5 to something stronger by allowing the hash of the hashed md5 as a positive password match. So essentially I just hashed the existing hashes, and bam, they were upgraded to the new algorithm without bothering users. I had someone worry that this degraded the pw digest, but in fact it only increased it. A hash of a hash is a-kin to an encryption of encryption in the fact that it strengthens in distance from plaintext. It's easy to think otherwise, but not the case. – bitsum Jan 30 at 23:31

I suggest that you use AES-Twofish-Serpent with the hash as whirpool.

That will make your virtual drive/folder 110% rock-solid!

share|improve this answer
Can you explain that? – Bonsi Scott Dec 28 '13 at 12:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.