CRYPTSETUP-LUKSKILLSLOT(8)   Maintenance Commands   CRYPTSETUP-LUKSKILLSLOT(8)

NAME
       cryptsetup-luksKillSlot - wipe a keyslot from the LUKS device

SYNOPSIS
       cryptsetup luksKillSlot [<options>] <device> <number>

DESCRIPTION
       Wipe the keyslot with the number from the LUKS device.

       Except running in batch-mode (-q), a remaining passphrase must be
       supplied, either interactively or via --key-file.  This command can
       remove the last remaining keyslot, but requires an interactive
       confirmation when doing so.  Removing the last passphrase makes a LUKS
       container permanently inaccessible.

       If you read the passphrase from stdin (without further argument or with
       '-' as an argument to --key-file), batch-mode (-q) will be implicitly
       switched on and no warning will be given when you remove the last
       remaining passphrase from a LUKS container.  Removing the last
       passphrase makes the LUKS container permanently inaccessible.

       If no passphrase is provided (on stdin or through --key-file argument)
       and batch-mode (-q) is active, the keyslot is removed without any other
       warning.

       This operation removes only the key in a particular keyslot; it does
       not wipe any encrypted data.

       <options> can be [--key-file, --keyfile-offset, --keyfile-size,
       --header, --disable-locks, --type, --verify-passphrase, --timeout].

OPTIONS
       --batch-mode, -q
	   Suppresses all confirmation questions.  Use with care!

	   If the --verify-passphrase option is not specified, this option
	   also switches off the passphrase verification.

       --debug or --debug-json
	   Run in debug mode with full diagnostic logs.	 Debug output lines
	   are always prefixed by #.

	   If --debug-json is used, additional LUKS2 JSON data structures are
	   printed.

       --disable-locks
	   Disable lock protection for metadata on disk.  This option is valid
	   only for LUKS2 and is ignored for other formats.

	   WARNING: Do not use this option unless you run cryptsetup in a
	   restricted environment where locking is impossible to perform
	   (where /run directory cannot be used).

       --header <device or file storing the LUKS header>
	   Use a detached (separated) metadata device or file where the LUKS
	   header is stored.  This option allows one to store the ciphertext
	   and LUKS header on different devices.

	   For commands that change the LUKS header (e.g., luksAddKey),
	   specify the device or file with the LUKS header directly as the
	   LUKS device.

       --help, -?
	   Show help text and default parameters.

       --key-file, -d file
	   Read the passphrase from the file.

	   If the name given is "-", then the passphrase will be read from
	   stdin.  In this case, reading will not stop at newline characters.

	   See section NOTES ON PASSPHRASE PROCESSING in cryptsetup(8) for
	   more information.

       --keyfile-offset value
	   Skip value bytes at the beginning of the key file.

       --keyfile-size, -l value
	   Read a maximum of value bytes from the key file.  The default is to
	   read the whole file up to the compiled-in maximum that can be
	   queried with --help.	 Supplying more data than the compiled-in
	   maximum aborts the operation.

	   This option is useful to cut trailing newlines, for example.	 If
	   --keyfile-offset is also given, the size count starts after the
	   offset.

       --timeout, -t seconds
	   The number of seconds to wait before a timeout on passphrase input
	   via terminal.  It is relevant every time a passphrase is asked.  It
	   has no effect if used in conjunction with --key-file.

	   This option is useful when the system should not stall if the user
	   does not input a passphrase, e.g., during boot.  The default is a
	   value of 0 seconds, which means to wait forever.

       --type type
	   Specifies required device type, for more info, read the BASIC
	   ACTIONS section in cryptsetup(8).

       --usage
	   Show short option help.

       --verify-passphrase, -y
	   When interactively asking for a passphrase, ask for it twice and
	   complain if both inputs do not match.  Ignored on input from file
	   or stdin.

       --version, -V
	   Show the program version.

REPORTING BUGS
       Report bugs at cryptsetup mailing list <cryptsetup@lists.linux.dev> or
       in Issues project section
       <https://gitlab.com/cryptsetup/cryptsetup/-/issues/new>.

       Please attach the output of the failed command with --debug option
       added.

SEE ALSO
       Cryptsetup FAQ
       <https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions>

       cryptsetup(8), integritysetup(8) and veritysetup(8)

CRYPTSETUP
       Part of cryptsetup project <https://gitlab.com/cryptsetup/cryptsetup/>.

cryptsetup 2.8.1		  2025-08-13	    CRYPTSETUP-LUKSKILLSLOT(8)