Skip to content

Encrypting Volumes with LUKS 🔒

Need to protect confidential personal files, sensitive research, or cryptocurrency wallets on a portable USB drive or MicroSD card? fparted includes native support for LUKS (Linux Unified Key Setup), the battle-tested disk encryption standard used across the entire Linux ecosystem.

Because LUKS is a universal standard, encrypted drives formatted in fparted can be unlocked seamlessly on any Linux PC, Ubuntu laptop, Steam Deck, or Android device running fparted.

1. Creating a New Encrypted Volume

When you format a partition with LUKS, fparted uses the native cryptsetup engine to generate an encrypted container with military-grade AES-256 cipher suites.

┌────────────────────────────────────────────────────────────────────────┐
│  Create LUKS Encrypted Partition: /dev/block/mmcblk1p2                 │
│                                                                        │
│  Passphrase:        [ ************************ ]                       │
│  Confirm:           [ ************************ ]                       │
│                                                                        │
│  LUKS Format:       ◉ LUKS2 (Argon2id KDF, Modern)   ○ LUKS1 (PBKDF2)   │
│  Cipher Suite:      [ aes-xts-plain64 (512-bit key) ▼ ]                │
│  Inner Filesystem:  [ ext4 (Journaled) ▼ ]                             │
│  Filesystem Label:  [ SecureVault ]                                    │
│                                                  [ Cancel ]  [ Format ]│
└────────────────────────────────────────────────────────────────────────┘

Step-by-Step

  1. Select an unmounted partition or create a new partition slice.
  2. Tap Encrypt / Format (or press Ctrl + Shift + E).
  3. Set up your cryptographic parameters:
  4. Passphrase: Choose a strong, memorable passphrase.
  5. LUKS Format: Select LUKS2 (uses modern memory-hard Argon2id key derivation resisting GPU cracking) or LUKS1 (for backward compatibility with older Linux kernels).
  6. Cipher: Default is aes-xts-plain64 with a 512-bit key (providing 256-bit AES encryption strength).
  7. Inner Filesystem: Select the filesystem to create inside the encrypted container (ext4, F2FS, or Btrfs).
  8. Tap Format to stage the encryption operation into your queue.

[!CAUTION] No Backdoors or Password Recovery: If you forget your LUKS passphrase, your data is mathematically unrecoverable. There are no reset keys or cloud recoveries. Write down your passphrase in a secure password manager!

2. Unlocking an Encrypted Partition

When you attach a drive containing an encrypted container, fparted detects the crypto_LUKS header signature and displays a 🔒 lock badge.

flowchart LR
    A["Encrypted Raw Block (/dev/block/mmcblk1p2)"] --> B["cryptsetup open (Enter Passphrase)"]
    B --> C["Plaintext Mapper (/dev/mapper/secure_vault)"]
    C --> D["Mount Filesystem (/mnt/runtime/default/secure_vault)"]

How to Unlock

  1. Select the encrypted partition in the list.
  2. Tap Unlock (or press Ctrl + Shift + L).
  3. Enter your Passphrase.
  4. Specify a mapper name (e.g. secure_vault) or use the auto-generated default.
  5. Tap Unlock. The Linux kernel initializes the dm-crypt virtual block mapper at /dev/mapper/<mapper_name>.
  6. You can now tap Mount to browse files in your favorite root file manager.

3. Locking & Securing the Volume

When you are finished working with your encrypted files:

  1. Tap Unmount on the active mounted filesystem.
  2. Select the unlocked mapper volume in fparted and tap Lock (or press Ctrl + Shift + L).
  3. fparted flushes all pending memory buffers, wipes encryption keys from RAM, and closes the /dev/mapper device node.
  4. Your drive is now locked and safe to disconnect.