= cryptsetup-luksHeaderBackup(8)
:doctype: manpage
:manmanual: Maintenance Commands
:mansource: cryptsetup {release-version}
:man-linkstyle: pass:[blue R < >]
:COMMON_OPTIONS:
:ACTION_LUKSHEADERBACKUP:

== Name

cryptsetup-luksHeaderBackup - store a binary backup of the LUKS header and keyslot area

== SYNOPSIS

*cryptsetup _luksHeaderBackup_ --header-backup-file <file> [<options>] <device>*

== DESCRIPTION

Stores a binary backup of the LUKS header and keyslot area.

*<options>* can be [--header, --header-backup-file, --disable-locks].

*NOTE:* Using '-' as a filename writes the header backup to a file named '-'.

*WARNING:* This backup file and a passphrase valid at the time of backup allow decryption of the LUKS data area, even if the passphrase was later changed or removed from the LUKS device.
Also, note that with a header backup, you lose the ability to wipe the LUKS device securely by just overwriting the header and keyslots.
You must either securely erase all header backups or overwrite the encrypted data area.
The second option is less secure, as some sectors can survive, e.g., due to defect management.

include::man/common_options.adoc[]
include::man/common_footer.adoc[]
