To modify an existing LUKS passphrase, the cryptsetup command-line utility is used. This process replaces an old passphrase with a new one for a specific key slot.
Steps to Change a LUKS Passphrase
The core command is cryptsetup luksChangeKey <device>.
- Identify your LUKS encrypted device. This is the raw block device, for example,
/dev/sda3or/dev/nvme0n1p2. Do not use the mapped device name like/dev/mapper/myvolumefor this operation. - Open a terminal.
- Execute the command with superuser privileges. Replace /dev/your-luks-device with the actual path to your LUKS device:
sudo cryptsetup luksChangeKey /dev/your-luks-device
- The system will then prompt you for the following:
- Enter passphrase to be changed: Type the current, valid LUKS passphrase for any active key slot on the device.
- Enter new passphrase: Type your desired new passphrase.
- Verify passphrase: Re-enter the new passphrase for confirmation.
Important Considerations
- You must know an existing valid passphrase to change it. Without a current passphrase, you cannot use luksChangeKey.
- This command changes the passphrase associated with the key slot that is successfully unlocked by the "passphrase to be changed" you provide.
- If you need to target a specific key slot (LUKS supports multiple key slots, typically 0-7), you can use the --key-slot <N> option, where <N> is the numerical identifier of the slot. For example:
sudo cryptsetup luksChangeKey /dev/your-luks-device --key-slot 0
However, if you only use one passphrase or are unsure, omitting --key-slot is usually sufficient as cryptsetup will find the slot corresponding to the entered current passphrase.
- Ensure your new passphrase is strong, combining uppercase letters, lowercase letters, numbers, and symbols, and is memorable to you.
After successful completion, the specified key slot will be accessible with the new passphrase.
