explicit_bzero(3)

✨ explicit_bzero(3) ✨

okay bestie, pull up a chair, we're looking at explicit_bzero(3) from the Library Functions Manual 💖 this one is short but it is SO important, like quietly iconic.

---

🌸 NAME 🌸

explicit_bzero — the explicit byte-array zero. yes, she does exactly what it says on the tin 💅

📚 LIBRARY 📚

Standard C library (libc, -lc)

🎀 SYNOPSIS 🎀

#include <string.h>  // see memory.h(3head)

void explicit_bzero(size_t n;
           void s[n], size_t n);

🦋 DESCRIPTION 🦋

So she's basically bzero(3)'s glow-up, fr fr. Same energy, but with one huge promise: the compiler will not delete your erase operation, even if it looks at your code and goes "hmm, nobody ever reads this buffer again, that's dead code, bye 👋".

No cap — explicit_bzero() guarantees compiler optimizations won't remove the erase even when the compiler decides the operation is "unnecessary". That's the whole point, and honestly? Slay. 👑

🌈 RETURN VALUE 🌈

None. She gives you nothing back. She just does the thing and leaves. main character behavior honestly. 💀

💜 ATTRIBUTES 💜

for the full breakdown of what these terms even mean, go peek at attributes(7) bestie.

• explicit_bzero() — Thread safety: MT-Safe ✨

⭐ STANDARDS ⭐

None. She's not in any standard. A free spirit. 🦋

👑 HISTORY 👑

glibc 2.25. babes, she's not even that old. 💅

The explicit_bzero() function is a nonstandard extension that's also present on some of the BSDs. Some other implementations have similar functions with different names, like memset_explicit() or memset_s() — same vibe, different font. 🎀

😭 CAVEATS 😭

okay this is the part where we get real, bestie. buckle up. 🫶

The explicit_bzero() function exists because of a problem that security-conscious applications can run into when they use bzero(): if the compiler can deduce that the location being zeroed will never again be touched by a correct program, then it may remove the bzero() call altogether. 💀 That is a problem if the whole point of that bzero() call was to erase sensitive data (think: passwords 👀) so it can't leak if the program is incorrect or compromised. Calls to explicit_bzero() are never optimized away by the compiler. periodt.

But — and this is a big but — the explicit_bzero() function does not solve all problems associated with erasing sensitive data:

• The explicit_bzero() function does not guarantee that sensitive data is completely erased from memory. (same is true of bzero(), so don't feel too special.) For example, there may be copies of the sensitive data sitting in a register and in "scratch" stack areas. The explicit_bzero() function is not aware of these copies, and can't erase them. 🙈
• In some circumstances, explicit_bzero() can actually decrease security. 😭 If the compiler determined that the variable holding the sensitive data could be optimized to be stored in a register (because it is small enough to fit in a register, and no operation other than the explicit_bzero() call would need to take the address of the variable), then the explicit_bzero() call will force the data to be copied from the register to a location in RAM that is then immediately erased (while the copy in the register stays exactly where it was, unaffected 🧚). The problem here is that data in RAM is more likely to be exposed by a bug than data in a register, so the explicit_bzero() call creates a brief time window where the sensitive data is more vulnerable than it would otherwise have been if no attempt to erase it had been made. oop. 💅

Also note that declaring the sensitive variable with the volatile qualifier does not eliminate the above problems. In fact, it will make them worse, since, for example, it may force a variable that would otherwise have been optimized into a register to instead be maintained in (more vulnerable) RAM for its entire lifetime. bestie please don't. 😭

notwithstanding all of the above, for security-conscious applications, using explicit_bzero() is generally preferable to not using it. the developers of explicit_bzero() anticipate that future compilers will recognize calls to explicit_bzero() and take steps to ensure that all copies of the sensitive data are erased, including copies in registers or in "scratch" stack areas. so we're manifesting that. ✨🙏

🔥 SEE ALSO 🔥

• bstring(3)
• memory.h(3head)
• bzero(3)

---

and that's the whole page, queen 👑 this was the Linux man-pages 6.20 release, dated 2026-08-10 (yes, we're in the future, live with it 💜). go erase your passwords properly, drink some water, and remember: explicit_bzero would never betray you. 🫶✨💖