Change LUKS Encryption Passphrase: Step-by-Step

Updated 6 November 2026 · Standard formula, shown below

Yes, you can change the passphrase on a LUKS-encrypted disk without re-encrypting the data. You use the cryptsetup command with the luksChangeKey action, which replaces an existing passphrase with a new one while leaving all other keyslots and the encrypted data intact. This article explains the process, how LUKS passphrases work, and answers common questions about key management.

What is LUKS and How Do Passphrases Work?

LUKS (Linux Unified Key Setup) is a disk encryption specification used by Linux systems. It doesn’t encrypt the whole disk with your passphrase directly. Instead, it generates a master key (random data) that encrypts the actual data. That master key is stored in one of up to 8 keyslots, each protected by a separate passphrase. When you enter a passphrase, LUKS tries each keyslot; if it matches, it unlocks the master key and decrypts the disk.

This design means you can have multiple passphrases (e.g., one for you, one for a backup admin) and change any one without affecting the others. Changing a passphrase only re-encrypts the master key with the new passphrase—the data itself is never touched.

How to Change a LUKS Passphrase

Here are the steps using cryptsetup, the standard tool. You need root privileges and the disk must be unlocked (or you need to unlock it first).

Identify your LUKS device: lsblk -f or blkid to find the partition (e.g., /dev/sda2).
Open a terminal and run: sudo cryptsetup luksChangeKey /dev/sda2
Enter the current passphrase when prompted.
Enter the new passphrase twice (once to confirm).
Done. The old passphrase is replaced, and the keyslot now holds the new one.

If you want to change a specific keyslot, use --key-slot N (N is the slot number, 0-7). For example: sudo cryptsetup luksChangeKey /dev/sda2 --key-slot 2

How to Choose a Strong Passphrase

A LUKS passphrase is only as strong as its entropy. Use a long passphrase (at least 12-16 characters) that includes mixed case, numbers, and symbols, but avoid common phrases or personal info. A passphrase like Tr0ub4dor&3 is weak; correct-horse-battery-staple is better because it’s long and random. Consider using a password manager to generate and store it. Never reuse a passphrase from another account.

Common Problems and Troubleshooting

Forgot current passphrase: You cannot change it without the old one. If you have another keyslot (e.g., a recovery key), you can use that to unlock and then change the forgotten slot.
Wrong key slot: If you specify a slot that is empty, you get an error. Use cryptsetup luksDump to see which slots are in use.
Passphrase too short: LUKS enforces a minimum passphrase length (default 8 characters). Use longer.
Disk is locked: You must unlock the disk (e.g., cryptsetup open) before changing the passphrase, unless you use the --key-file option with a keyfile.
Accidentally changed the wrong slot: If you have multiple passphrases, you can revert by using another slot to unlock and then re-change the one you messed up.

LUKS vs. Other Encryption Tools

Compared to plain dm-crypt (without LUKS), LUKS offers passphrase management, multiple keyslots, and a standard header. Tools like VeraCrypt or BitLocker have similar passphrase change capabilities but different formats. LUKS is native to Linux and widely supported. Changing a passphrase in LUKS is generally safer than in some other systems because it doesn’t require re-encrypting the data.

Safety and Backup Considerations

Always back up the LUKS header before making changes. The header contains the encrypted master keys; if it’s corrupted, your data is lost. Use cryptsetup luksHeaderBackup /dev/sda2 --header-backup-file backup.img. Store the backup securely. Also, ensure you have at least one working passphrase before removing old ones. If you change the only passphrase and then forget it, you lose access permanently—there is no backdoor.

Frequently Asked Questions

Can I change the passphrase without the current one?

No, you must provide the current passphrase (or a valid keyfile) to authenticate the change. If you’ve forgotten it, you’ll need to use another keyslot or restore from a header backup if you have one.

Does changing the passphrase affect my data?

No, the data remains encrypted with the same master key. Only the passphrase that protects that master key is changed. The process is quick and doesn’t re-encrypt the disk.

Can I have multiple passphrases on LUKS?

Yes, LUKS supports up to 8 keyslots, each with its own passphrase. You can add, change, or remove them independently using luksAddKey and luksRemoveKey.

What is the difference between luksChangeKey and luksAddKey?

luksChangeKey replaces an existing passphrase in a specific slot. luksAddKey adds a new passphrase in an empty slot without affecting existing ones. Use luksRemoveKey to delete a passphrase.

How long does it take to change a LUKS passphrase?

It’s usually fast—a few seconds to a minute—because it only re-encrypts the master key (a small amount of data), not the whole disk. The time depends on CPU speed and the number of iterations used for key derivation.

Is it safe to change a passphrase while the disk is in use?

Yes, you can change the passphrase while the disk is unlocked and mounted. The change only affects the keyslot, not the active encryption session. However, it’s good practice to do it when the disk is not heavily used.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.