How to update disk encryption passphrase?

Ask Fedora
1

Hello, I enabled disk encryption (luks) when I installed Fedora 43 GNOME 49 (through the installation wizard), but I am not finding an option to update the password. Where can I update it?

I don’t use the command line and I am not technical.

2

GUI interfaces rarely provide complete control — only commonly used features, so unless you have support staff you should consider learning some command-line basics.
https://www.baeldung.com/linux/luks-change-passphrase has command-line instructions. My students and colleagues found
https://linuxcommand.org/index.php useful.

Linux users outside large enterprises with support staff must rely on the Linux community for help. The command-line is much more efficient than GUI tools when working through linux problems.

When getting started with command-line tools it can help to have a buddy checking your commands against the documentation. It is a good idea to create a test configuration to practice before changing a working system. For working with luks, you can use a USB key to practice the steps in the Baeldung document.

2 Likes
3

gnome-disks can do this as far as I can see:

image
image1940×1340 181 KB

2 Likes
4

Should you have chosen to use a full disk encryption and not like the password you have set, you can always use the “Disks” application to change it afterwards! Start that by pressing the Super - key and entering “Disks”. After the program has launched, select your drive in the left column, the encrypted partition in the right and then click on the cogs (more actions) and select “Change Passphrase…”

1 Like
5

Thank you all for your help!! Using the disk management GUI worked great :slight_smile:

I’ll ping GNOME to ask that they add this to the settings menu to make it more visible to newbies like me.

1 Like
6

It may still be worthwhile to look into how to do this from the commandline. E.g., with systemd-cryptenroll, you can add a recovery key to your partition:

$ sudo systemd-cryptenroll /dev/nvme0n1p3 --recovery-key

Or add additional keyslots for other users, so they can unlock the partition without having to share the passphrase:

$ sudo systemd-cryptenroll /dev/nvme0n1p3 --password

Or even more advanced things, like unlocking a partition with a FIDO2 token.

1 Like