= cryptsetup-luksHeaderBackup(8)
:doctype: manpage
:manmanual: Maintenance Commands
:mansource: cryptsetup {release-version}
:man-linkstyle: pass:[blue R < >]
:COMMON_OPTIONS:
:ACTION_LUKSHEADERBACKUP:

== Name

cryptsetup-luksHeaderBackup - store a binary backup of the LUKS header and keyslot area

== SYNOPSIS

*cryptsetup _luksHeaderBackup_ --header-backup-file <file> [<options>] <device>*

== DESCRIPTION

Stores a binary backup of the LUKS header and keyslot area.

Using '-' as a filename writes the header backup to a file named '-'.

The backup file and a passphrase valid at the time of backup allow decryption of the LUKS data area, even if the passphrase was later changed or removed from the LUKS device.
Note that with a header backup, you lose the ability to wipe the LUKS device securely by just overwriting the header and keyslots.
You must either securely erase all header backups or overwrite the encrypted data area.

*<options>* can be [--header, --header-backup-file, --disable-locks].

include::man/common_options.adoc[]
include::man/common_footer.adoc[]