tpm_clear(8)

💖 tpm_clear — TPM Management 💖

okay bestie, buckle up, because tpm_clear is one of those commands that is literally the nuclear option and she does not play 💅 this page lives in section 8 of the System Manager's Manual, which is the big-girl section where all the privileged system management stuff hangs out. slay.

✨ NAME ✨

tpm_clear — send your TPM back to its default state: unowned, disabled, inactive. it's giving factory reset but for your trusted platform module 🎀

🌸 SYNOPSIS 🌸

tpm_clear [OPTION]

that's it. one command, one optional flag situation, infinite emotional damage (to your keys) 💀

🦋 DESCRIPTION 🦋

so here's the tea ☕ — tpm_clear asks your system's TPM to perform a clear through the TPM_OwnerClear API. and when we say clear, we mean it clears. it wipes out all ownership information, which effectively invalidates every single key and every bit of data tied to the TPM, and on top of that it disables and deactivates the TPM. all of it. gone. no cap 😭

this operation will prompt for the owner password. so know your password, bestie.

the --force option, though? she does it differently — she relies on Physical Presence to authorize the command via the TPM_ForceClear API, which means she skips the owner password prompt entirely. no password, just vibes (and physical presence, which is not vibes, it's a whole security thing, iykyk).

okay but here's where it gets spicy 🌶️ — the TPM_OwnerClear API can be disabled until the current owner is cleared, and if that's the case you're gonna need to use --force together with the tpm_setclearable command. and separately, the TPM_ForceClear API can be disabled for the current boot cycle with the tpm_setclearable command too. so basically tpm_setclearable is the gatekeeper and you might need to have a chat with her first 💅

🚨 also super important: this command requires a reboot to complete the operation. so don't sit there refreshing and wondering why nothing happened. reboot. she said what she said. 🔥

and now, the options, one bullet each because we are thorough in this house 👑

• -h, --help — display command usage info. the classic "wait what does this do again" button 🫶
• -v, --version — display command version info. for when you need to know exactly which flavor of tpm_clear you're dealing with ⭐
• -l, --log [none|error|info|debug] — set the logging level. pick your noise level: none, error, info, or debug. debug is the "tell me everything, I want the whole group chat" setting 🙈
• -u, --unicode — use TSS UNICODE encoding for passwords, so you play nice with applications that use TSS popup boxes 🧚
• -f, --force — rely on Physical Presence for authorization; therefore, do not prompt for owner password. skipping the password line, respectfully 💅
• -z, --well-known — authenticate using 20 bytes of zeros as the owner password (that's the default TSS Well Known Secret), instead of prompting for an owner password. yes, 20 zero bytes. she's well known for a reason ✨

🌈 SEE ALSO 🌈

go read these next, bestie, they're the whole friend group:

• tpm_version(1)
• tpm_takeownership(8)
• tpm_setclearable(8)
• tpm_setactive(8)
• tpm_setenable(8)
• tcsd(8)

💜 REPORTING BUGS 💜

found a bug? don't suffer in silence, tell the people 🫶 report bugs to:

trousers-users@lists.sourceforge.net

and that's the whole page, babes 🎀 this was TPM Management, dated 2005-05-05 — iconic, timeless, still relevant, we love to see it. go clear that TPM (after you reboot, obviously). mwah 💖✨