Encrypt Files Tomb Linux: Secure Folder Guide

Updated 6 November 2026 · Standard formula, shown below

Tomb is a command-line tool for Linux that creates encrypted storage folders, called tombs, where you can safely hide and protect files. You enter a password or key file to open a tomb, and once closed, its contents are sealed with strong encryption. This guide explains what Tomb does, how it works, and how to use it to encrypt your sensitive files.

What Is Tomb and Why Use It?

Tomb is a free, open-source utility that combines standard Linux tools (like LUKS, cryptsetup, and steghide) into a single script. It creates an encrypted file that you can mount as a folder, copy files into, and then lock again. Unlike encrypting individual files, a tomb acts like an encrypted vault: everything inside is protected together.

People use Tomb for keeping private documents, financial records, or personal photos safe from unauthorized access. It is especially useful on shared computers or laptops that might be lost or stolen. Because Tomb uses proven encryption standards, your data remains unreadable without the correct password or key.

How Tomb Encryption Works

Tomb relies on the Linux kernel’s device-mapper and LUKS (Linux Unified Key Setup) to create an encrypted container. Here is the basic process:

Create a tomb file – a file of a chosen size, which will hold your encrypted data.
Format it – Tomb sets up a LUKS encrypted volume inside that file.
Open it – you provide a password or a key file, and Tomb decrypts the volume and mounts it as a folder.
Use it – copy, edit, or delete files inside the mounted folder.
Close it – unmount and re-encrypt the volume, making the files inaccessible again.

The encryption algorithm is AES-256 by default, which is considered secure for most purposes. Tomb also supports two-factor authentication: you can require both a password and a separate key file to open the tomb.

Installing Tomb on Linux

Tomb is available in the repositories of many Linux distributions. You can install it with your package manager:

Debian/Ubuntu: sudo apt install tomb
Fedora: sudo dnf install tomb
Arch Linux: sudo pacman -S tomb

If your distribution does not have a package, you can download the source from the official Tomb website and run make install. Ensure you have the required dependencies: cryptsetup, sudo, pinentry, and steghide (for key hiding).

Step-by-Step: Creating and Using a Tomb

Here is a typical workflow to create a 100 MB tomb named secret:

Create the tomb file: tomb create secret -s 100 – this creates a 100 MB file called secret.tomb.
Set a password: Tomb will ask you to choose a password. Make it strong and memorable.
Open the tomb: tomb open secret.tomb – enter your password when prompted. The tomb will be mounted at /run/media/secret (or similar).
Copy files into it: Move your sensitive files into the mounted folder.
Close the tomb: tomb close secret – this unmounts and locks the tomb.

You can also create a key file with tomb forge secret.key and use it to open the tomb with tomb open secret.tomb -k secret.key. This adds an extra layer of security.

Common Problems and How to Fix Them

Users often encounter a few issues:

Permission errors: If you cannot open a tomb, ensure you have read/write permissions on the tomb file and the mount point. Use sudo if needed.
Forgotten password: There is no recovery. If you lose the password or key, the data is permanently inaccessible. Always keep a backup key in a safe place.
Mount point already exists: If the mount folder is not empty, Tomb may refuse to mount. Close any other tombs and check the mount path.
Missing dependencies: If Tomb fails to run, install the required packages listed in its documentation.

Tomb vs. Other Encryption Tools

Several alternatives exist, each with different strengths:

EncFS: Encrypts individual files and folders transparently, but is generally considered less secure than LUKS-based solutions.
LUKS directly: You can create an encrypted partition or file with cryptsetup alone. Tomb adds convenience and key management.
VeraCrypt: A cross-platform tool with a graphical interface, but it is not natively integrated with Linux as deeply as Tomb.
GnuPG: Encrypts individual files or directories, but does not create a mountable folder.

Tomb stands out for its simplicity and tight integration with Linux security features.

Safety and Backup Considerations

Encryption protects your data from unauthorized access, but it does not protect against accidental loss. Always back up your tomb file and key separately. If you lose the key and password, your data is gone forever – there is no backdoor.

Also, be aware that while a closed tomb is encrypted, an open tomb is just a normal folder. Always close it when you are done, especially on shared systems. Use tomb close all to close all open tombs at once.

Frequently Asked Questions

Is Tomb safe to use?

Yes, Tomb uses industry-standard AES-256 encryption via LUKS. As long as you choose a strong password and keep your key files safe, your data is well protected.

Can I use Tomb on any Linux distribution?

Tomb works on most Linux distributions that have the required dependencies. It is a shell script, so as long as you can install cryptsetup and related tools, it should run.

What happens if I forget my Tomb password?

There is no way to recover the data. Tomb does not store any password recovery information. This is a security feature, but it means you must keep your password and key files safe.

Can I resize a tomb after creation?

No, Tomb does not support resizing. You would need to create a new tomb and copy the files over.

Does Tomb work on Windows or macOS?

No, Tomb is Linux-only. For cross-platform encryption, consider VeraCrypt or Cryptomator.

Can I hide a tomb inside another file?

Yes, Tomb supports steganography: you can hide a key file inside an image or audio file using steghide. This is an advanced feature for extra security.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.