CRYPTSETUP-TOKEN(8)

💖 CRYPTSETUP-TOKEN(8) 💖

okay bestie, so this is a page from the Maintenance Commands section of the manual — it's the cryptsetup-token page, and it's literally all about managing LUKS2 tokens. pull up a chair, we're doing this together 🫶

---

✨ NAME ✨

cryptsetup-token — manage LUKS2 tokens 👑

---

✨ SYNOPSIS ✨

cryptsetup token <add|remove|import|export|unassign> [<options>]
<device>

---

✨ DESCRIPTION ✨

k so the action add creates a new keyring token that enables auto-activation of the device. for the auto-activation to work, the passphrase has to be stored in the keyring with the specified description. usually you'd store that passphrase in the user or user-session keyring. also important: the token command is supported only for LUKS2. no LUKS1 girlies here, sorry 💅

for adding a new keyring token, the option --key-description is mandatory — like, you genuinely cannot skip it. also, a new token gets assigned to the keyslot specified with the --key-slot option, or to all active keyslots if the --key-slot option is omitted.

to remove an existing token, specify the token ID that should be removed with the --token-id option.

⚠️ WARNING: the action token remove removes any token type, not just keyring type, from the token slot specified by the --token-id option. read that again bestie, it's not picky 😭

action import can store an arbitrary valid JSON data in the LUKS2 token. it may be passed via standard input or a file passed in the --json-file option. if you specify --key-slot, a successfully imported token is also assigned to the keyslot.

action export writes the requested token JSON to a file passed with --json-file or to standard output.

action unassign removes the token binding to the specified keyslot. both the token and the keyslot must be specified by the --token-id and --key-slot parameters.

if --token-id is used with action add or action import and a token with that ID already exists, the option --token-replace can replace the existing token. slay ✨

<options> can be [--header, --token-id, --key-slot, --key-description, --disable-external-tokens, --disable-locks, --disable-keyring, --json-file, --token-replace, --unbound, --external tokens-path].

---

✨ OPTIONS ✨

• --batch-mode, -q — suppresses all confirmation questions. use with care! 😬

if the --verify-passphrase option is not specified, this option also switches off the passphrase verification.

• --debug or --debug-json — run in debug mode with full diagnostic logs. debug output lines are always prefixed by #.

if --debug-json is used, additional LUKS2 JSON data structures are printed. it's giving "here's the tea, in full" 🍓

• --disable-external-tokens — disable loading of plugins for external LUKS2 tokens.
• --disable-keyring — do not load the volume key in the kernel keyring; store it directly in the dm-crypt target instead. this option is supported only for the LUKS2 type.
• --disable-locks — disable lock protection for metadata on disk. this option is valid only for LUKS2 and is ignored for other formats.

⚠️ WARNING: do not use this option unless you run cryptsetup in a restricted environment where locking is impossible to perform (where /run directory cannot be used). fr fr, don't be brave about this one 🙈

• --external-tokens-path <absolute path> — override the system directory path where cryptsetup searches for external token handlers (or token plugins). it must be an absolute path (starting with / character).
• --header <device or file storing the LUKS header> — use a detached (separated) metadata device or file where the LUKS header is stored. this option allows one to store the ciphertext and LUKS header on different devices.

for commands that change the LUKS header (e.g., luksAddKey), specify the device or file with the LUKS header directly as the LUKS device.

• --help, -? — show help text and default parameters. 🫶
• --json-file — read the token JSON from a file or write the token to it. option --json-file=- reads JSON from standard input or writes it to standard output, respectively.
• --key-description text — set the key description in the keyring that will be used for passphrase retrieval.
• --key-slot, -S <0-N> — for LUKS operations that add key material, this option allows you to specify which keyslot is selected for the new key.

the maximum number of keyslots depends on the LUKS version. LUKS1 can have up to 8 keyslots. LUKS2 can have up to 32 keyslots based on keyslot area size and key size, but a valid keyslot ID can always be between 0 and 31 for LUKS2.

• --token-id — specify the token number. if omitted, the first unused token id is used when adding or importing a new token.
• --token-replace — replace an existing token when adding or importing a token with the --token-id option. main character energy: out with the old 💅
• --unbound — creates a new LUKS2 keyring token assigned to no keyslot. usable only with the add action.
• --usage — show short option help.
• --version, -V — show the program version.

---

✨ REPORTING BUGS ✨

found a bug? 😭 report it at the cryptsetup mailing list <cryptsetup@lists.linux.dev> or in the Issues project section <https://gitlab.com/cryptsetup/cryptsetup/-/issues/new>.

pls pls pls attach the output of the failed command with the --debug option added — it helps so much 🫶

---

✨ SEE ALSO ✨

Cryptsetup FAQ <https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions>

cryptsetup(8), integritysetup(8) and veritysetup(8) 🌈

---

✨ CRYPTSETUP ✨

part of the cryptsetup project <https://gitlab.com/cryptsetup/cryptsetup/>. 💜

---

and that's the whole page bestie, you ate that 🎀 this was cryptsetup 2.8.8, dated 2026-09-07 — catch you on the next manpage, mwah 💖🦋