cryptsetup-luksformat

initialize LUKS encrypted partition

TLDR

Initialize LUKS volume with passphrase

$ cryptsetup luksFormat [/dev/sdXY]

Initialize LUKS volume with keyfile

$ cryptsetup luksFormat [/dev/sdXY] [path/to/keyfile]

Initialize with passphrase and set label

$ cryptsetup luksFormat --label [label] [/dev/sdXY]

SYNOPSIS

cryptsetup luksFormat [options] device [keyfile]

cryptsetup luksFormat initializes a LUKS (Linux Unified Key Setup) encrypted partition. It creates the LUKS header and sets up the initial key slot with either a passphrase or keyfile.LUKS provides standardized on-disk encryption with multiple key slots, secure key management, and compatibility across distributions.

PARAMETERS

--type type

LUKS type: luks1 or luks2. Defaults to luks2.

-c, --cipher cipher

Encryption cipher specification. Compiled-in default (typically aes-xts-plain64).

-s, --key-size bits

Key size in bits, must be a multiple of 8. For XTS the volume key is split between two ciphers, so 512 yields AES-256.

-h, --hash hash

Hash algorithm used in the LUKS key setup and volume key digest.

-i, --iter-time ms

Milliseconds to spend on PBKDF passphrase processing. Higher values increase brute-force resistance.

--pbkdf algo

PBKDF algorithm for LUKS2: pbkdf2, argon2i, or argon2id (the default).

-d, --key-file file

Read the passphrase from a file. Use - to read from standard input.

-l, --keyfile-size bytes

Read at most this many bytes from the key file.

-y, --verify-passphrase

Ask for the passphrase twice and fail if the entries differ.

-q, --batch-mode

Suppress all confirmation questions. Useful for scripting.

--use-urandom, --use-random

Select the kernel RNG (/dev/urandom or /dev/random) used to generate the volume key.

--sector-size bytes

Encryption sector size for LUKS2: a power of two between 512 and 4096.

--label label

Set the LUKS2 device label.

--integrity algo

Enable authenticated disk encryption with the given integrity algorithm (LUKS2 only).

INSTALL

sudo apt install cryptsetup-bin

sudo dnf install cryptsetup

sudo pacman -S cryptsetup

sudo apk add cryptsetup

sudo zypper install cryptsetup

nix profile install nixpkgs#cryptsetup

CAVEATS

Destroys all data on the partition. Cannot be undone. Always backup data first. LUKS1 is more compatible; LUKS2 supports newer features. Requires root privileges.