NWIPE(8)

💖 NWIPE — the manual page, but make it cute 💖

okay bestie, so nwipe is a system administration command (section 8 of the manual, for the nerds keeping score 🧚) and it's about to become your new obsession. buckle up, we're wiping disks. 🦋

---

✨ NAME ✨

nwipe — securely erase disks. that's it. that's the whole vibe. 💅

---

✨ SYNOPSIS ✨

nwipe [options] [device1] [device2] ...

---

✨ DESCRIPTION ✨

so like, nwipe is a command that will securely erase disks using a whole buffet of recognized methods. it's a fork of the dwipe command used by Darik's Boot and Nuke (DBAN). and nwipe is included with ShredOS if you want a quick and easy bootable USB/CD/DVD/PXE version — iconic, honestly. 🌈

the lore? nwipe was created out of a need to run the DBAN dwipe command outside of DBAN, so you could use it with any host distribution, which gives you better hardware support. the user interface is similar to dwipe, but nwipe has so many more features, no cap:

• pthreads is used instead of fork.
• The parted library is used to detect drives.
• The code is designed to be compiled with gcc.
• SIGUSR1 can be used to log the stats of the current wipe.
• Additional wiping methods and PRNGs.
• Configurable I/O modes (cached, direct, auto) using large I/O buffers for higher throughput.
• Support for stable device paths such as /dev/disk/by-id/.
• Generates two types of PDF certificates, single disc per PDF and system focused PDF

and the glow-up detail you're gonna love: all PRNG implementations are seeded using the Linux getrandom(2) system call instead of reading from /dev/urandom via a file descriptor. main character energy fr fr. ✨

---

🎀 DEVICES 🎀

you can specify devices either as block device nodes — for example /dev/sda, /dev/nvme0n1, /dev/mapper/cryptroot — or via stable symlinks under /dev/disk/by-id/. nwipe will resolve these paths and operate on the underlying block device. she's smart like that. 💜

---

💅 OPTIONS 💅

• -V, --version — prints the version number. short and sweet, periodt.
• -v, --verbose — logs more messages, super useful for debugging. she's chatty and we love her for it. 🗣️
• -h, --help — prints a help summary.
• --force — also allows wiping of devices that are considered in use (mounted). ⚠️ beware: this option is considered dangerous and is disabled by default. that means by default even --autonuke will exclude any such devices. not me warning you twice. 🙈
• --autonuke — if no devices have been specified on the command line, it starts wiping all devices immediately. if devices have been specified, it starts wiping only those specified devices immediately. zero chill, zero waiting.
• --autopoweroff — powers off the system on completion of the wipe, delayed for one minute. during that one-minute delay you can abort the shutdown by typing sudo shutdown -c. so you can change your mind, bestie. 💖
• --sync=NUM — specifies how often nwipe performs an fdatasync() during cached I/O mode. the value refers to the number of device hardware blocks (commonly 512 or 4096 bytes) written before triggering a sync. since nwipe now writes using large multi-megabyte buffers, this value is automatically scaled so the sync interval in bytes is consistent with historic behaviour.

the default value (100000) results in a sync approximately every 50–400 MB, similar to earlier nwipe releases. this ensures timely detection of I/O errors while maintaining good throughput.

this setting has no effect when using --directio, because write() returns errors immediately under direct I/O.

• 0 — perform one sync only at the end of the pass. not advised; errors may only be detected after the entire wipe. 😬
• 1 — sync immediately after each write. extremely safe but extremely slow.
• 1000 — sync after the equivalent of 1000 hardware blocks. useful for testing or more aggressive error detection.

• --verify=TYPE — whether to perform verification of erasure (default: last).
  • off — do not verify.
  • last — verify after the last pass.
  • all — verify every pass.

please mind that HMG IS5 enhanced always verifies the last (PRNG) pass regardless of this option. she does what she wants. 💅

• --directio — use direct I/O with large write buffers. this opens devices with O_DIRECT to bypass the page cache. it can be useful when running multiple wipes in parallel or when you do not want to pollute the system page cache. on some devices this may be slower than cached I/O. 👀
• --cachedio — use buffered I/O with large write buffers (page cache enabled). this is the default on most systems and generally gives the best performance for rotational disks. old faithful. 🫶
• --io-mode=MODE — select the I/O mode explicitly. MODE can be:
  • auto — (default) automatically choose the best supported mode for the device and kernel.
  • cached — force buffered I/O.
  • direct — force direct I/O (O_DIRECT).

large I/O buffers are used in all modes to maximise throughput.

• -m, --method=METHOD — the wiping method (default: prng).
  • dod522022m / dod — 7 pass DOD 5220.22-M method
  • dodshort / dod3pass — 3 pass DOD method
  • gutmann — Peter Gutmann's algorithm
  • ops2 — RCMP TSSIT OPS-II
  • random / prng / stream — PRNG Stream
  • zero / quick — Overwrite with zeros (0x00)
  • one — Overwrite with ones (0xFF)
  • verify_zero — Verifies disk is zero (0x00) filled
  • verify_one — Verifies disk is one (0xFF) filled
  • is5enh — HMG IS5 enhanced
  • bruce7 — Schneier Bruce 7-pass mixed pattern
  • bmb — Chinese BMB21-2019 State Secrets Bureau standard.
• -l, --logfile=FILE — filename to log to. default is STDOUT.
• -P, --PDFreportpath=DIR — directory to write the PDF nwipe reports/certificates to. defaults to ".". if DIR is set to noPDF no report PDF files are written. 📄✨
• -p, --prng=METHOD — the PRNG option (default: fastest for your hardware). (mersenne|twister|isaac|isaac64|add_lagg_fibonacci_prng|xoroshiro256_prng|splitmix64|aes_ctr_prng|chacha20)

aes_ctr_prng uses the Linux kernel AF_ALG interface to AES-CTR as a cryptographically strong stream generator. it is seeded via getrandom(2) and requires kernel crypto support for AES-CTR. 🔐

• --prng=auto|default
  • auto — Automatically benchmark all available PRNGs at startup and select the fastest one for the current hardware. (default=auto)
  • default|manual — Disable auto-selection and use the built-in default PRNG choice (CPU-based heuristic; no benchmarking).
• --prng-benchmark — run a RAM-only PRNG throughput benchmark and exit. prints a sorted leaderboard (MB/s). no wipe is performed. just vibes and numbers. 📊
• --prng-bench-seconds=N — seconds per PRNG during benchmarking (default: 1.0). for --prng=auto this is automatically reduced unless set.
• -q, --quiet — anonymize serial numbers, GUI & logs display:
  • XXXXXXXX = S/N obtained & anonymized.
  • ???????? = S/N not available.
• -r, --rounds=NUM — number of times to wipe the device using the selected method (default: 1).
• --noblank — do not perform the final blanking pass after the wipe (default is to blank, except when the method is RCMP TSSIT OPS-II).
• --nowait — do not wait for a key before exiting (default is to wait).
• --nosignals — do not allow signals to interrupt a wipe (default is to allow).
• --nogui — do not show the GUI interface. can only be used with the autonuke option. nowait option is automatically invoked with the nogui option. SIGUSR1 can be used to retrieve the current wiping statistics. 👑
• --nousb — do not show or wipe any USB devices, whether in GUI, --nogui or autonuke mode. (default is to allow USB devices to be shown and wiped).
• --reverse — reverse the I/O direction (from the end of the device towards the start). helpful when bad blocks otherwise prevent wiping major areas of the device. beware: throughput may be degraded as it writes against the spin direction. she's going backwards but she's doing her best. 🌀
• --scatter — use scattered I/O direction (random segmented order across the device). more mechanical exercise; good for burning-in or stress-testing devices. beware the throughput may be degraded due to random access patterns used.
• --no-retry-on-io-errors — do NOT retry single failed read/write operations; immediately error or skip the failing block. (default is retry 3 times with 5s sleep in-between)
• --no-abort-on-block-errors — do NOT abort passes on block write errors; skip the failing block and continue. (default is to abort the wipe for that device) ⚠️ beware: faulty devices can take a very long time to wipe without the --no-retry-on-io-errors option, due to the many retries.
• --pdftag — enables a field on the PDF that holds a tag that identifies the host computer. 🏷️
• --pdfduplex — enables insertion of intentionally blank pages between sections on PDFs.
• -e, --exclude=DEVICES — up to ten comma separated devices to be excluded, examples:

--exclude=/dev/sdc
--exclude=/dev/sdc,/dev/sdd
--exclude=/dev/sdc,/dev/sdd,/dev/mapper/cryptswap1
--dev/disk/by-path/pci-0000:00:17.0-ata-1

---

💀 BUGS 💀

please see the GitHub site for the latest list: (https://github.com/martijnvanbrummelen/nwipe/issues). yeah we're being honest about it, that's growth. 🙈

---

👑 AUTHOR 👑

nwipe is maintained by Martijn van Brummelen <github@brumit.nl> and Nick Law (@PartialVolume, collaborator) shredos.eraser@gmail.com. other major contributors are @knogle, @desertwitch. legends only. 🫶

---

🌸 SEE ALSO 🌸

ShredOS, shred(1), dwipe(1), dd(1), dcfldd(1), dc3dd(1)

---

and that's the whole page bestie 💖 this was nwipe version 0.43, from Oct 2026, living her best life in section NWIPE(8). go forth and securely erase responsibly, mwah. 💅✨🎀