Changing the LUKS Disk Encryption Passphrase on Fedora

This how-to covers changing the full-disk encryption passphrase on a Fedora system that uses LUKS (the default since the installer’s “Encrypt my data” option). It applies to LUKS2 setups, including LVM-on-LUKS and Btrfs-on-LUKS layouts.

The passphrase is stored in a keyslot inside the LUKS header, separate from the encrypted data and from the running filesystem. Because of this, you can change it on a live, mounted system without rebooting, reinstalling, or touching the bootloader.

Prerequisites

• A Fedora system with LUKS full-disk encryption
• The current (existing) passphrase
• sudo / root privileges
• An external location to store a header backup (USB stick, another machine)

Step 1 — Identify the encrypted partition

List your block devices and filesystem types:

lsblk -f

Look for the partition with the crypto_LUKS type. On a typical NVMe install it is /dev/nvme0n1p3; on SATA disks it may be /dev/sda3. The mapped device under it (luks-<uuid>) is the unlocked volume — you act on the underlying partition, not the mapper.

Confirm the version and keyslots in use:

sudo cryptsetup luksDump /dev/nvme0n1p3

The output shows the LUKS version and which keyslots (0–31 for LUKS2) are occupied. Note the slot numbers — you will need them if you remove an old passphrase later.

Step 2 — Back up the LUKS header

A corrupted header makes the entire disk permanently unreadable, so always back it up before modifying it:

sudo cryptsetup luksHeaderBackup /dev/nvme0n1p3 --header-backup-file ~/luks-header-backup.img

Move this file off the encrypted disk immediately. A backup that lives only on the disk it protects is useless if the disk fails.

cp ~/luks-header-backup.img /run/media/$USER/USBKEY/
shred -u ~/luks-header-backup.img

Step 3 — Change the passphrase

There are two approaches. Pick one.

Option A — Direct change (simplest)

This replaces the passphrase in the same keyslot in a single atomic operation. You are prompted for the existing passphrase, then the new one (twice):

sudo cryptsetup luksChangeKey /dev/nvme0n1p3

Option B — Add then remove (safest)

Add the new passphrase into a free keyslot first, verify it works, then delete the old one. This lets you fall back to the old passphrase if anything goes wrong.

Add the new passphrase:

sudo cryptsetup luksAddKey /dev/nvme0n1p3

Verify the new passphrase unlocks the volume before removing the old one. The safest test is to reboot and unlock with the new passphrase. If you cannot reboot now, you can test against the header without unmounting:

sudo cryptsetup open --test-passphrase /dev/nvme0n1p3

Once the new passphrase is confirmed, remove the old keyslot (replace 0 with the slot number shown by luksDump):

sudo cryptsetup luksKillSlot /dev/nvme0n1p3 0

Step 4 — Verify

Re-run the dump to confirm the keyslot layout is what you expect:

sudo cryptsetup luksDump /dev/nvme0n1p3

Then reboot and confirm the system unlocks with the new passphrase at boot.

sudo systemctl reboot

Notes and good practices

• No reboot required to change the passphrase. cryptsetup operates on the LUKS header, not on the mounted filesystem. The reboot is only to validate that boot-time unlock works.
• LUKS2 supports up to 32 keyslots. You can keep multiple passphrases (e.g. a personal one and a recovery one) and manage them independently with luksAddKey / luksKillSlot.
• Keep the header backup current. If you significantly change keyslots, take a fresh backup and discard the stale one.
• luksKillSlot is destructive. Make sure you are removing the correct slot and that at least one working passphrase remains before you delete anything.

Quick reference