Passphraseprotected

Passphraseprotected describes data or resources secured by a cryptographic key derived from a user-supplied passphrase rather than a static password stored or transmitted in plaintext. In practice, a passphrase is fed into a key derivation function (KDF) such as PBKDF2, scrypt, or Argon2, often with a random salt and multiple iterations. The KDF outputs a symmetric key used to encrypt the content with algorithms such as AES or ChaCha20-Poly1305. To decrypt, the correct passphrase must be provided, producing the same key via the KDF.

Common contexts include disk encryption (LUKS, FileVault, BitLocker), encrypted archives (ZIP or 7z with AES), email and file encryption (PGP/GPG), and encrypted databases or backups. The term passphraseprotected emphasizes that the protection relies on a secret passphrase rather than a stored key.

Security considerations: the protection strength hinges on passphrase entropy and KDF parameters. A long, unpredictable passphrase makes brute-force attacks impractical, especially when memory-hard KDFs are used. Salt prevents precomputed attacks. Risks include forgotten passphrases, weak passphrases, and brute-force exposure if the attacker gains the encrypted data and parameters. Best practices include using a long, random or well-chosen passphrase, employing a reputable KDF with appropriate iterations, and enabling multi-factor authentication where possible. Passphrase-based protection is often improved by pairing with hardware keys or external factors and by regularly updating protection policies.