What decryption means for a VMware virtual machine

A VMware virtual machine can be encrypted in two ways: the entire disk file can be locked with a password, or individual files inside the guest operating system can be encrypted separately. Decryption means unlocking that encrypted data so you can read or use it again. If you encrypted a virtual machine yourself and now need to access it, you will need either the password you set or the encryption key you saved. If someone else encrypted it, you will need their permission or that same password or key — there is no backdoor.

The process differs depending on where the encryption happened. If VMware Workstation or vSphere encrypted the virtual machine file itself at the storage level, you decrypt it through the virtualization software. If Windows BitLocker or Linux dm-crypt encrypted files inside the guest operating system, you decrypt them from inside that operating system, the same way you would on a physical computer.

Key Takeaways

  • VMware virtual machine encryption at the storage level requires the password or encryption key you set when you created the encryption, entered through VMware Workstation, vSphere, or the command line.
  • Encryption inside the guest operating system (like Windows BitLocker or Linux LUKS) is decrypted from within that operating system, not from the virtualization software.
  • If you lose the password or key, there is no recovery method — the data remains locked unless you have a backup copy of the key stored separately.
  • Decryption at the storage level can take hours for large virtual machines and will slow down the machine while it runs.
  • Some virtual machines use both types of encryption at once, which means you must decrypt both layers separately.

Decrypting a VMware virtual machine file at the storage level

If you encrypted the virtual machine file itself using VMware Workstation Pro, VMware Fusion, or vSphere, you decrypt it by opening the virtual machine settings and removing the encryption. In VMware Workstation Pro on Windows or Linux, right-click the virtual machine name, select Manage, then Encrypt. A dialog will appear asking for the password you set when you encrypted it. Enter the password and select the option to decrypt. The process will begin when ready and may take several hours depending on the size of the virtual machine disk.

In VMware Fusion on Mac, the process is similar: open the virtual machine, go to Virtual Machine menu, select Encrypt, and enter your password to decrypt. In vSphere (the enterprise version), you access encryption settings through the vSphere Client interface under the virtual machine's Security settings, then select Decrypt. You will need administrator credentials for the vSphere host.

During decryption, the virtual machine will be locked and unavailable. Do not power it off or move the files while decryption is running. If the process is interrupted, you may need to restart it from the beginning. Once decryption finishes, the virtual machine files will no longer be encrypted and will take up slightly less disk space.

Decrypting files inside the guest operating system

If the encryption happened inside Windows, you will most likely be dealing with BitLocker, which encrypts the entire drive or specific folders. To decrypt a BitLocker-encrypted drive, boot the virtual machine normally, open Manage BitLocker (search for it in the Windows Start menu), select the encrypted drive, and click Turn off BitLocker. Windows will ask for your BitLocker recovery key or password. Enter it, and Windows will begin decrypting the drive in the background. This can take hours for large drives and will not prevent you from using the computer while it happens.

If you encrypted individual files or folders using Windows Encrypting File System (EFS), right-click the file or folder, select Properties, go to the Advanced button, and uncheck Encrypt contents to find data. Windows will decrypt that file or folder without asking for a password if you are logged in as the user who encrypted it.

On Linux virtual machines, encrypted drives are usually set up with LUKS (Linux Unified Key Setup). To decrypt a LUKS-encrypted drive, you will need to use the command line. Open a terminal and run sudo cryptsetup luksOpen /dev/sdX name-of-decrypted-volume, replacing /dev/sdX with the actual device name and name-of-decrypted-volume with a name you choose. You will be prompted for the passphrase. Once unlocked, you can mount the decrypted volume normally. To permanently decrypt it, you would need to back up the data, remove the LUKS encryption layer, and restore the data — a more involved process that is usually not necessary unless you are decommissioning the virtual machine.

What to do if you have lost the password or key

If you encrypted a VMware virtual machine and no longer have the password, there is no way to decrypt it without that password. VMware does not have a master key or recovery method. The same is true for BitLocker, LUKS, and other encryption systems — they are designed so that even the software maker cannot unlock them without the original password or recovery key.

If you saved a recovery key when you set up the encryption, that key can unlock the data. BitLocker recovery keys are usually saved to your Microsoft account or printed as a text file. LUKS recovery keys are typically saved to a separate location you chose. Check your email, cloud storage, password manager, or physical files for any saved keys. If you find the recovery key, you can use it in place of the password to decrypt.

If you have no password and no recovery key, your only option is to restore the virtual machine from a backup made before encryption was applied. If no such backup exists, the data is not recoverable.

Decrypting a virtual machine with both storage-level and guest-level encryption

Some virtual machines use encryption at both levels: the virtual machine file itself is encrypted by VMware, and the operating system inside also uses BitLocker or LUKS. In this case, you must decrypt both layers. Start by decrypting the VMware storage-level encryption first (using the steps above for your virtualization software). Once that finishes and the virtual machine is accessible, boot the virtual machine and decrypt the guest operating system encryption using BitLocker or LUKS steps.

The order matters because you cannot access the guest operating system to decrypt it until the storage-level encryption is removed. If you try to decrypt in the wrong order, you will not be able to complete either process.

Why decryption takes time and what to expect

Decryption is a computationally intensive process. The software must read every block of encrypted data, decrypt it, and write it back to disk. For a 500 GB virtual machine, this can take 2 to 8 hours depending on your disk speed and processor. During this time, the virtual machine may be slow or unavailable, depending on the type of encryption and the software doing the decrypting.

You can usually check the progress of decryption in the virtualization software's interface. In VMware Workstation, a progress bar appears in the Encrypt dialog. In Windows BitLocker, you can check progress by opening Manage BitLocker and looking at the status of each drive. On Linux, you can monitor LUKS decryption with the cryptsetup status command.

Plan decryption for a time when you do not need the virtual machine. Do not shut down the host computer or move the virtual machine files while decryption is running, as this will interrupt the process and may require you to start over.

Frequently Asked Questions

Can I decrypt just part of a virtual machine?

No. If the entire virtual machine file is encrypted at the storage level, you must decrypt the whole thing. If only certain files or folders inside the guest operating system are encrypted, you can decrypt those individually without touching the rest of the system.

Will decrypting a virtual machine make it run faster?

Slightly. Encryption adds a small amount of overhead to disk operations. Once decrypted, the virtual machine will have marginally faster disk performance, but the difference is usually not noticeable in everyday use.

What if the decryption process fails halfway through?

If decryption is interrupted, the virtual machine will remain encrypted. You will need to restart the decryption process from the beginning. If the process keeps failing, check that you have enough free disk space (decryption needs temporary working space) and that the virtual machine files are not corrupted. If the files are corrupted, you will need to restore from a backup.

Do I need to decrypt a virtual machine before backing it up?

No. You can back up an encrypted virtual machine without decrypting it first. The backup will contain the encrypted files. When you restore from that backup, the virtual machine will still be encrypted and you will need the password to decrypt it again.

Can I decrypt a virtual machine that someone else created?

Only if you have the password or recovery key they used. If you do not have either, you cannot decrypt it. Ask the person who created it for the password or recovery key, or ask them to decrypt it for you before transferring it to you.