Secure Boot? Plain Explanation
Secure Boot sounds like marketing, but it is a real protection: it makes sure only trusted software can start your PC. It also causes confusing errors when installing other operating systems. Here is what it does, when it helps, and when to touch it.
TL;DR / Quick Fix
Secure Boot checks that your bootloader is signed before the PC starts, blocking rootkits and boot malware. Leave it on for Windows — it's required for Windows 11. You only need to disable it when installing operating systems or tools whose bootloaders aren't signed, and you can re-enable it after.
Follow these steps
- Understand what it verifies. Each boot component's signature, in a chain from firmware upward. Unsigned code does not run.
- Leave it on for Windows. Windows 11 requires it; Windows 10 benefits from it. There is no everyday reason to disable it.
- Know when to disable it. Installing Linux distributions or tools with unsigned bootloaders — the classic legitimate reason.
- Find the toggle. BIOS setup, under the Security or Boot tab. The exact label varies by maker.
- Re-enable it afterward. Do not leave it off permanently out of laziness after a one-time install.
- Pair it with a TPM for full protection. The two work together as the PC's boot-trust foundation — see the TPM check guide.
What NOT to do
- Do not disable Secure Boot to 'speed up' booting. The checks add a negligible fraction of a second.
- Do not leave it off permanently after a one-time install. Re-enable it when done.
- Do not confuse Secure Boot with a BIOS password. Different protections, different purposes.
- Do not panic at 'Secure Boot violation' errors. They mean it is working — check which software is unsigned.
Frequently asked questions
Does Secure Boot slow down my PC?
No. The signature checks add a fraction of a second to boot.
Can malware bypass Secure Boot?
Sophisticated attacks exist, but it stops the common bootkits cold.
Why does Linux complain about Secure Boot?
Some distributions lack signed bootloaders. Many major ones now support it out of the box.