CRYPTSETUP-ERASE(8)

💖 CRYPTSETUP-ERASE 💖

okay so bestie, this is the cryptsetup-erase manual page (you'll also see it as cryptsetup-luksErase), and it's literally the "nuke the keys" button. Let's get into it 🎀

---

✨ NAME ✨

cryptsetup-erase, cryptsetup-luksErase — erase all keyslots 👋

---

🌸 SYNOPSIS 🌸

cryptsetup erase [<options>] <device>
cryptsetup luksErase [<options>] <device>

---

🦋 DESCRIPTION 🦋

So this one erases all the keyslots and yeets the volume key entirely. Unless your device is set up with OPAL self-encrypting drive support, you do not need to hand over any password for this. Like, none. It just goes. 😭

This operation is irreversible. Unless you have a header backup, every bit of old encrypted data in the container is permanently irretrievable. Periodt. And heads up — a header backup cannot be used to recover data from OPAL self-encrypting drives, because those keys get permanently removed from the hardware. Gone gone.

Also, lowkey important: the erase does not wipe or overwrite the data area. It only removes all active keyslots from the LUKS device. If you wanna know how to wipe the whole device including the encrypted data, go read the cryptsetup FAQ. 💅

And note — the --hw-opal-factory-reset option for an OPAL self-encrypting drive will erase ALL data on the drive, regardless of which partition you run it on. Not just yours. The whole drive. 🙈

<options> can be [--header, --disable-locks, --hw-opal-factory-reset, --key-file].

---

👑 OPTIONS 👑

• --batch-mode, -q — Suppresses all confirmation questions. Use with care, bestie! If the --verify-passphrase option is not specified, this option also switches off the passphrase verification. ⚠️
• --debug or --debug-json — Run in debug mode with full diagnostic logs. Debug output lines are always prefixed by #. If --debug-json is used, additional LUKS2 JSON data structures are printed. Very giving "I want to see everything" energy. 🔍
• --disable-locks — Disable lock protection for metadata on disk. This option is valid only for LUKS2 and is ignored for other formats.

WARNING: Do not use this option unless you run cryptsetup in a restricted environment where locking is impossible to perform (where /run directory cannot be used).

• --header <device or file storing the LUKS header> — Use to specify a detached LUKS2 header when erasing an OPAL self-encrypting drive.
• --help, -? — Show help text and default parameters. Your lil cheat sheet. 🫶
• --hw-opal-factory-reset — Erase ALL data on the OPAL self-encrypting drive. This option does not require a valid LUKS2 header to be present on the device to run. After providing the correct PSID via interactive prompt or via the --key-file parameter, the device is erased. 💀
  • PSID is usually printed on the OPAL drive label (either directly or as a QR code). PSID must be entered without any dashes, spaces or underscores.
  • PSID should be treated as sensitive information, because it lets anyone with remote access to the OPAL drive destroy data even if the device is locked. Be sure you do not leak PSID through transparent packaging during transport or images of the drive posted online. Like, please don't post it. 🚫📸
• --key-file, -d file (LUKS2 with HW OPAL only) — Read the Admin PIN or PSID (with --hw-opal-factory-reset) from the file, depending on the options used. If the name given is -, then the secret will be read from stdin. In this case, reading will not stop at newline characters. 🧚
• --usage — Show short option help. The tiny version.
• --version, -V — Show the program version. Slay, what version we on? ⭐

---

😭 REPORTING BUGS 😭

Found a bug? Report it at the cryptsetup mailing list <cryptsetup@lists.linux.dev> or in the Issues project section at <https://gitlab.com/cryptsetup/cryptsetup/-/issues/new>. 🐛

Please attach the output of the failed command with the --debug option added. It helps so much, fr fr. 💜

---

🌈 SEE ALSO 🌈

• Cryptsetup FAQ <https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions>
• cryptsetup(8), integritysetup(8) and veritysetup(8)

---

🎀 CRYPTSETUP 🎀

Part of the cryptsetup project <https://gitlab.com/cryptsetup/cryptsetup/>. 👑

---

and that's the whole page, bestie!! this was cryptsetup version 2.8.8, dated 2026-09-07, from the cryptsetup 2.8.8 era — now go back up your headers before you erase anything, i'm literally begging 🫶💖✨