---
name: "cryptsetup-luksKillSlot"
section: "8"
platform: "linux"
package: "cryptsetup"
version: "2.8.8-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/cryptsetup-luksKillSlot"
---

# cryptsetup-luksKillSlot(8)

wipe a keyslot from the LUKS device

## NAME

cryptsetup-luksKillSlot - wipe a keyslot from the LUKS device

## SYNOPSIS

**cryptsetup** *luksKillSlot* **\[\<options\>\] \<device\> \<number\>**

## DESCRIPTION

*Wipe the keyslot with the number from the LUKS device.*

*Except running in batch-mode (-q), a remaining passphrase must be supplied, either interactively or via --key-file.* *This command can remove the last remaining keyslot, but requires an interactive confirmation when doing so.* *Removing the last passphrase makes a LUKS container permanently inaccessible.*

*If you read the passphrase from stdin (without further argument or with '-' as an argument to --key-file), batch-mode (-q) will be implicitly switched on and no warning will be given when you remove the last remaining passphrase from a LUKS container.* *Removing the last passphrase makes the LUKS container permanently inaccessible.*

*If no passphrase is provided (on stdin or through --key-file argument) and batch-mode (-q) is active, the keyslot is removed without any other warning.*

*This operation removes only the key in a particular keyslot; it does not wipe any encrypted data.*

**\<options\>** *can be \[--key-file, --keyfile-offset, --keyfile-size, --header, --disable-locks, --type, --verify-passphrase, --timeout\].*

## OPTIONS

**--batch-mode***,* **-q**

*Suppresses all confirmation questions.* *Use with care!*

*If the --verify-passphrase option is not specified, this option also switches off the passphrase verification.*

**--debug** *or* **--debug-json**

*Run in debug mode with full diagnostic logs.* *Debug output lines are always prefixed by* **#***.*

*If --debug-json is used, additional LUKS2 JSON data structures are printed.*

- **--disable-locks**

  *Disable lock protection for metadata on disk.* *This option is valid only for LUKS2 and is ignored for other formats.*

  **WARNING:** *Do not use this option unless you run cryptsetup in a restricted environment where locking is impossible to perform (where /run directory cannot be used).*

**--header** *\<device or file storing the LUKS header\>*

*Use a detached (separated) metadata device or file where the LUKS header is stored.* *This option allows one to store the ciphertext and LUKS header on different devices.*

*For commands that change the LUKS header (e.g., luksAddKey), specify the device or file with the LUKS header directly as the LUKS device.*

**--help***,* **-?**

*Show help text and default parameters.*

**--key-file***,* **-d** *file*

*Read the passphrase from the file.*

*If the name given is "-", then the passphrase will be read from stdin.* *In this case, reading will not stop at newline characters.*

*See section NOTES ON PASSPHRASE PROCESSING in* **cryptsetup***(8) for more information.*

**--keyfile-offset** *value*

*Skip value bytes at the beginning of the key file.*

**--keyfile-size***,* **-l** *value*

*Read a maximum of value bytes from the key file.* *The default is to read the whole file up to the compiled-in maximum that can be queried with --help.* *Supplying more data than the compiled-in maximum aborts the operation.*

*This option is useful to cut trailing newlines, for example.* *If --keyfile-offset is also given, the size count starts after the offset.*

**--timeout***,* **-t** *seconds*

*The number of seconds to wait before a timeout on passphrase input via terminal.* *It is relevant every time a passphrase is asked.* *It has no effect if used in conjunction with --key-file.*

*This option is useful when the system should not stall if the user does not input a passphrase, e.g., during boot.* *The default is a value of 0 seconds, which means to wait forever.*

**--type** *type*

*Specifies required device type, for more info, read the BASIC ACTIONS section in* **cryptsetup***(8).*

- **--usage**

  *Show short option help.*

**--verify-passphrase***,* **-y**

*When interactively asking for a passphrase, ask for it twice and complain if both inputs do not match.* *Ignored on input from file or stdin.*

**--version***,* **-V**

*Show the program version.*

## REPORTING BUGS

*Report bugs at* *cryptsetup mailing list \<cryptsetup@lists.linux.dev\>* *or in* *Issues project section \<https://gitlab.com/cryptsetup/cryptsetup/-/issues/new\>.*

*Please attach the output of the failed command with --debug option added.*

## SEE ALSO

*Cryptsetup FAQ \<https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions\>*

**cryptsetup***(8),* **integritysetup***(8) and* **veritysetup***(8)*

## CRYPTSETUP

*Part of* *cryptsetup project \<https://gitlab.com/cryptsetup/cryptsetup/\>.*