---
name: "tpm_sealdata"
section: "1"
platform: "linux"
package: "tpm-tools"
version: "1.3.9.2-0.2"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/tpm_sealdata"
---

# tpm\_sealdata(1)

seal input data to the system's TPM

TPM Management - tpm\_sealdata

## NAME

tpm\_sealdata - seal input data to the system's TPM

## SYNOPSIS

**tpm\_sealdata** \[**OPTION**\]

## DESCRIPTION

**tpm\_sealdata** seals sensitive input data to the SRK of the system's TPM and optionally a PCR configuration.  Backup your data, it is unrecoverable from this format if the SRK changes or the specified PCR configuration is unreproducable.  The result can be unsealed by functions in libtpm\_unseal, such as [**tpmUnsealFile**(3)](/tpmUnsealFile/3.md).

- **-h**, **--help**

  Display command usage info.

- **-v**, **--version**

  Display command version info.

- **-l**, **--log** \[none\|error\|info\|debug\]

  Set logging level.

- **-i**, **--infile FILE**

  File containing input data to seal.

- **-o**, **--outfile FILE**

  Output file.  Default is STDOUT.

- **-p**, **--pcr NUMBER**

  Seal data to the current value of the specified pcr. This option can be given NUM\_PCRS times.  The specified pcr is in the range of 0 to NUM\_PCRS-1. NUM\_PCRS is at least 16 but may vary by platform.

- **-z**, **--well-known**

  Use TSS\_WELL\_KNOWN\_SECRET (20 zero bytes) as the SRK password. You will not be prompted for the SRK password with this option.

- **-u**, **--unicode**

  Use TSS UNICODE encoding for the SRK password to comply with applications using TSS popup boxes.

## SEE ALSO

[**tpm\_takeownership**(8)](/tpm_takeownership/8.md), [**tpmUnsealFile**(3)](/tpmUnsealFile/3.md)

## REPORTING BUGS

Report bugs to \<trousers-users@lists.sourceforge.net\>