---
name: "pam_systemd_loadkey"
section: "8"
platform: "linux"
package: "systemd"
version: "262.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/pam_systemd_loadkey"
---

# pam\_systemd\_loadkey(8)

Read password from kernel keyring and set it as PAM authtok

## NAME

pam\_systemd\_loadkey - Read password from kernel keyring and set it as PAM authtok

## SYNOPSIS

pam\_systemd\_loadkey.so

## DESCRIPTION

**pam\_systemd\_loadkey** reads a NUL-separated password list from the kernel keyring, and sets the last password in the list as the PAM authtok, which can be used by e.g. [**pam\_get\_authtok**(3)](/pam_get_authtok/3.md).

The password list is supposed to be stored in the "user" keyring of the root user, by an earlier call to [**systemd-ask-password**(1)](/systemd-ask-password/1.md) with **--keyname=**. You can pass the keyname to **pam\_systemd\_loadkey** via the **keyname=** option.

## OPTIONS

The following options are understood:

*keyname=*

Takes a string argument which sets the keyname to read. The default is "cryptsetup". During boot, **systemd-cryptsetup@.service**(8) stores a passphrase or PIN in the keyring. The LUKS2 volume key can also be used, via the **link-volume-key** option in [**crypttab**(5)](/crypttab/5.md).

**Table 1.  Possible values for *keyname*.**

| | |
| --- | --- |
| **Value** | **Description** |
| cryptsetup | Passphrase or recovery key |
| fido2-pin | Security token PIN |
| luks2-pin | LUKS2 token PIN |
| tpm2-pin | TPM2 PIN |

Added in version 255.

*debug*

The module will log debugging information as it operates.

Added in version 255.

## EXAMPLE

This module is intended to be used when you use LUKS with a passphrase, enable autologin in the display manager, and want to unlock Gnome Keyring / KDE KWallet automatically. So in total, you only enter one password during boot.

You need to set the password of your Gnome Keyring/KWallet to the same as your LUKS passphrase. Then add the following lines to your display manager's PAM config under /etc/pam.d/ (e.g. sddm-autologin):

```
-auth       optional    pam_systemd_loadkey.so
-auth       optional    pam_gnome_keyring.so
-session    optional    pam_gnome_keyring.so auto_start
-session    optional    pam_kwallet5.so auto_start
```

And add the following lines to your display manager's systemd service file, so it can access root's keyring:

```
[Service]
KeyringMode=inherit
```

In this setup, early during the boot process, **systemd-cryptsetup@.service**(8) will ask for the passphrase and store it in the kernel keyring with the keyname "cryptsetup". Then when the display manager does the autologin, **pam\_systemd\_loadkey** will read the passphrase from the kernel keyring, set it as the PAM authtok, and then **pam\_gnome\_keyring** and **pam\_kwallet5** will unlock with the same passphrase.