LearnLinux › cmds › commands
Linux Encryption LUKS

cryptsetup — manage disk encryption (LUKS)

cryptsetup configures and manages encrypted block devices using LUKS (Linux Unified Key Setup).

What cryptsetup is good for

Formatting with LUKS will destroy all existing data on the device. Always double-check the target device with lsblk.
Common pattern: LUKS → open → create filesystem → mount.

10 Practical Examples

1) Format device as LUKS

sudo cryptsetup luksFormat /dev/sdX

2) Open encrypted device

sudo cryptsetup luksOpen /dev/sdX secure_disk

Creates /dev/mapper/secure_disk

3) Create filesystem inside encrypted device

sudo mkfs.ext4 /dev/mapper/secure_disk

4) Mount encrypted volume

sudo mount /dev/mapper/secure_disk /mnt/secure

5) Close encrypted device

sudo cryptsetup luksClose secure_disk

6) Show LUKS header info

sudo cryptsetup luksDump /dev/sdX

7) Add new key

sudo cryptsetup luksAddKey /dev/sdX

8) Remove key slot

sudo cryptsetup luksRemoveKey /dev/sdX

9) Change passphrase

sudo cryptsetup luksChangeKey /dev/sdX

10) Verify mapping

lsblk -f
sudo cryptsetup status secure_disk