To reset the password of an unlocked LUKS encrypted drive in Ubuntu, you must use
cryptsetup luksChangeKey on the underlying block device (such as
/dev/sda1) rather than the decrypted mapper path. This operation updates the key slot directly on the disk header without affecting the mounted filesystem or requiring a reboot.
Prerequisites and Safety Checks
Before modifying any encryption keys, ensure that your data is backed up. While changing a passphrase does not alter the actual data payload, errors during the process can lead to data loss if the system crashes or if the wrong device is targeted. You must have administrative privileges via
sudo to perform these operations.
First, identify the correct block device. Do not guess. Use
lsblk or
fdisk -l to list all disks. Look for the partition type
crypto_LUKS. For example, if your encrypted partition is
sda1, the raw device is
/dev/sda1. The mapped device, typically found at
/dev/mapper/your_volume_name, is the result of decryption and should never be used for header modifications. Using the mapper path can corrupt the volume mapping or fail silently.
Identifying the Correct Device
Run the following command to verify the device status:
sudo cryptsetup status /dev/sda1
This output confirms that
/dev/sda1 is active and provides details about the cipher and key size. If the command returns an error stating the device is not a valid LUKS device, you have selected the wrong partition. Ensure the device is not currently mounted to the root filesystem if it is the boot drive, though changing the key itself does not require unmounting the filesystem because the key change happens at the block level before the filesystem layer reads the data. However, for safety, it is often recommended to perform this task from a live USB environment if possible, especially for system drives.
If you are working with a secondary external drive, simply ensure it is connected and recognized by the kernel. The critical distinction remains: operate on
/dev/sdXn, not
/dev/mapper/name.
Executing the Password Change
The core command for this task is
cryptsetup luksChangeKey. This utility allows you to replace an existing passphrase with a new one. The syntax requires the target block device and optionally specifies which key slot to update.
Run the following command, replacing
/dev/sda1 with your actual device identifier:
sudo cryptsetup luksChangeKey /dev/sda1
The system will prompt you for the current passphrase first. Enter the old password carefully. After verifying the old key, it will ask for the new passphrase twice. Choose a strong, memorable password. LUKS supports multiple key slots, so you can also specify a particular slot if you wish to rotate keys without removing the old one immediately, but
luksChangeKey defaults to updating the first available empty slot or the primary slot depending on the version and configuration.
If you want to explicitly remove the old key after setting the new one, you might consider using
luksRemoveKey separately, but
luksChangeKey effectively replaces the authentication method. Note that if you have other backups or recovery keys stored in different slots, they remain unaffected unless you explicitly modify those slots.
Verifying the Change
After the command completes successfully, verify that the new password works. You can do this by locking and unlocking the volume manually. First, close the mapping:
sudo cryptsetup luksClose /dev/mapper/your_volume_name
Then, reopen it using the new passphrase:
sudo cryptsetup luksOpen /dev/sda1 your_volume_name
Enter the new password when prompted. If the command succeeds and creates the mapper device, your password reset was successful. You can then mount the filesystem as usual. If you encounter an "bad password" error, double-check that you entered the correct old password during the change process and that no typos occurred in the new password.
For more complex scenarios involving multiple encrypted volumes, see
Encrypted MDADM RAID1 Disks Continually Active on Ubuntu 24.04 LTS with SSD and Two Internal HDDs to understand how LUKS interacts with RAID arrays. Additionally, if you ever need to recover access due to connection issues while mounting remotely, refer to
Recovering from Loss of Connection When Mounting LUKS-Encrypted Disk-Containers Remotely for troubleshooting steps that complement key management.
Frequently Asked Questions
Can I reset the password if I have forgotten the old one?
No, you cannot reset the password if you have lost the old passphrase. LUKS encryption is designed such that without one of the valid key slots, the data is mathematically inaccessible. You would need to wipe the LUKS header entirely using
cryptsetup luksFormat, which destroys all data on the partition. Always keep a backup of your recovery key in a secure location separate from the drive.
Does changing the LUKS password affect my data files?
No, the actual data blocks on the disk remain unchanged. Only the metadata in the LUKS header, which stores the hashed passphrases, is updated. Your files, permissions, and directory structure remain intact because the encryption layer decrypts the same data using the new key upon subsequent mounts.
Is it safe to run this command while the drive is mounted?
It is generally safe to run
luksChangeKey while the drive is mounted because the operation modifies the disk header, not the filesystem contents. However, if the system crashes during the write operation to the header, the volume could become corrupted. Performing the task from a live environment or ensuring stable power is the best practice for system drives.
How do I check which key slots are currently in use?
Use the command
sudo cryptsetup luksDump /dev/sda1. This displays a detailed table of all key slots, indicating which ones are enabled (
[active]) and which are empty. This is useful if you want to remove a compromised key or add a new one without overwriting the primary login password.
What happens if I accidentally enter the wrong new password?
If you enter the wrong new password twice, the command will complete, but you will not be able to unlock the drive with either the old or the new password if you removed the old key slot. If you did not remove the old slot, you can still unlock it with the old password. Always verify the new password by attempting to unlock the volume immediately after the change.