# info > CRYPTSETUP --- type: CommandReference command: cryptsetup mode: man section: 8 source: man-pages --- ## Quick Reference - `cryptsetup --type luks2 luksFormat /dev/sdX` — create LUKS2 container - `cryptsetup open /dev/sdX sdX_crypt` — open encrypted device and map to sdX_crypt - `cryptsetup close sdX_crypt` — remove mapping and wipe key - `cryptsetup luksAddKey --key-slot 5 /dev/sdX` — add new passphrase to key slot 5 - `cryptsetup luksRemoveKey /dev/sdX` — remove a passphrase - `cryptsetup luksDump /dev/sdX` — dump header information - `cryptsetup resize ` — resize active mapping - `cryptsetup status ` — show mapping status ## Name manage plain dm-crypt and LUKS encrypted volumes ## Synopsis `cryptsetup [options] [action_args]` Actions: open, close, status, resize, refresh, reencrypt, luksFormat, luksOpen, luksSuspend, luksResume, luksAddKey, luksRemoveKey, luksChangeKey, luksConvertKey, luksKillSlot, erase, luksUUID, isLuks, luksDump, luksHeaderBackup, luksHeaderRestore, token, convert, config, repair, benchmark, tcryptOpen, tcryptDump, bitlkOpen, bitlkDump. ## Options ### General Options - `-v, --verbose` — print more information on command execution - `--debug, --debug-json` — run in debug mode with full diagnostic logs. `--debug-json` prints additional LUKS2 JSON data structures - `--type ` — specify device type (plain, luks, luks1, luks2, loopaes, tcrypt) - `-h, --hash ` — passphrase hash for plain/loopaes open; hash for LUKS key setup (must be at least 160 bits for luksFormat) - `-c, --cipher ` — cipher specification string (default: aes-cbc-essiv:sha256 for plain, aes-xts-plain64 for LUKS) - `-y, --verify-passphrase` — prompt for passphrase twice when creating mapping or luksFormat - `-d, --key-file ` — read passphrase from file. `-` reads from stdin (newline not stripped) - `--keyfile-offset ` — skip bytes at start of key file - `--keyfile-size, -l ` — read max bytes from key file (default: whole file up to compiled-in max) - `--new-keyfile-offset ` — skip bytes when adding new passphrase from key file (luksAddKey) - `--new-keyfile-size ` — max bytes to read when adding new passphrase (luksAddKey) - `--master-key-file ` — use master key from file (luksFormat, luksAddKey, open, luksDump) - `--dump-json-metadata` — print LUKS2 JSON metadata (luksDump) - `--dump-master-key` — dump master key (luksDump, tcryptDump) - `--json-file ` — read/write token JSON (token action). `-` for stdin/stdout - `--use-random, --use-urandom` — RNG source for master key creation (luksFormat) - `-S, --key-slot <0-N>` — specify key slot (LUKS). LUKS1: 0-7, LUKS2: 0-31 - `-s, --key-size ` — key size in bits (multiple of 8). Used for open --type plain and luksFormat - `-b, --size ` — device size in 512-byte sectors (open, resize) - `-o, --offset ` — start offset in backend device (open --type plain/loopaes, luksFormat). For LUKS, sets data offset (must be multiple of 8) - `-p, --skip ` — IV calculation offset in 512-byte sectors (open --type plain/loopaes) - `--device-size [units]` — override device size. Units: S (512 bytes), K/M/G/T (1024 base), KB/MB/GB/TB (1000 base). WARNING: destructive with reencrypt - `-r, --readonly` — set up read-only mapping - `--shared` — create additional mapping for same ciphertext device (open --type plain) - `--pbkdf ` — PBKDF algorithm for LUKS keyslot: pbkdf2, argon2i, argon2id - `-i, --iter-time ` — milliseconds to spend on PBKDF processing (luksFormat, luksAddKey, luksChangeKey). 0 = compiled-in default - `--pbkdf-memory ` — memory cost for Argon2 (KB). Not for PBKDF2 - `--pbkdf-parallel ` — parallel cost for Argon2 (threads, max 4) - `--pbkdf-force-iterations ` — set iterations directly, bypass benchmark - `-q, --batch-mode` — suppress confirmation questions. Also disables passphrase verification for luksFormat if `-y` not given - `--progress-frequency ` — print wipe progress every - `-t, --timeout ` — timeout for passphrase input (0 = wait forever) - `-T, --tries ` — number of passphrase retries (default 3) - `--align-payload ` — align payload on 512-byte sector boundary (luksFormat). DEPRECATED; use `--offset` instead - `--uuid=UUID` — set UUID for luksFormat or change with luksUUID - `--allow-discards` — enable discard (TRIM) requests. WARNING: security impact. Requires kernel 3.1+ - `--perf-same_cpu_crypt` — encryption on same CPU as IO submission. Kernel 4.0+ - `--perf-submit_from_crypt_cpus` — disable offloading writes after encryption. Kernel 4.0+ - `--perf-no_read_workqueue, --perf-no_write_workqueue` — bypass dm-crypt workqueue for synchronous processing. Kernel 5.9+ - `--test-passphrase` — verify passphrase without activating device (open) - `--header ` — use detached LUKS header device/file - `--header-backup-file ` — file for header backup/restore - `--force-password` — skip password quality checking (luksFormat, luksAddKey, luksChangeKey) - `--deferred` — defer device removal in close until last user closes - `--cancel-deferred` — cancel deferred device removal - `--disable-external-tokens` — disable loading of external LUKS2 token plugins - `--disable-locks` — disable lock protection for metadata (LUKS2 only). WARNING: only in restricted environments - `--disable-keyring` — store volume key directly in dm-crypt target instead of kernel keyring (LUKS2) - `--key-description ` — key description in keyring for token command - `--priority ` — set priority for LUKS2 keyslot - `--token-id` — specify token ID for token, open, resize actions - `--token-only` — fail if token activation fails; do not fall back to passphrase prompt - `--token-type` — restrict to specific token type - `--sector-size ` — sector size for encryption (512-4096, power of 2). LUKS2 or plain mode - `--iv-large-sectors` — count IV in larger sector size instead of 512 bytes (open --type plain) - `--persistent` — write activation flags persistently into LUKS2 metadata (open, refresh) - `--refresh` — refresh active device parameters - `--label