LUKS
Hacker ApprovedRanked 3 of 7 disk encryptions by recommenders
Linux's standard disk encryption, praised for flexible multiple keys, transparent kernel-level operation and years of reliable use. Critics point to recurring flaws and an unencrypted header.
Linux's standard disk encryption, praised for flexible multiple keys, transparent kernel-level operation and years of reliable use. Critics point to recurring flaws and an unencrypted header.
38 people gave an opinion
- recommend it
- 32
- criticize it
- 6
- approval share
- 84%
Recommended in 13 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: recommended (month in progress)
Why it carries the badge
- 32 people recommend itNeeds 10 or more, met.
- 5.3 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 13 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Best practice for at-rest encryption
“I would recommend, just in case, to set up LUKS on your server.”
Comment from 13 Nov 2025 in “We cut our Mongo DB costs by 90% by moving to Hetzner” “use LUKS unless you really need the features of ZFS native enc”
Comment from 30 Aug 2026 in “FreeCORE TrueNAS Core – Continued” “best practice is always to encrypt with luks”
Comment from 5 Feb 2026 in “Secure erase for Samsung PM951 NVMe drive (2024)” Multiple keys, any one unlocks
“Keyslots are alternatives, not requirements, so a TPM slot and a passphrase slot coexist and either one alone unwraps the master key.”
Comment from 11 Sep 2026 in “Copying login keychains between Macs fails on Secure Enclave Macs with Tahoe” “LUKS allows you to set up multiple entry keys, so use two, either of which will grant access to the drive.”
Comment from 17 May 2026 in “Security researcher says Microsoft built a Bitlocker backdoor, releases exploit” Reliable for years of use
“used LUKS encryption on a system76 laptop for 7 years and it worked fine”
Comment from 15 Jun 2026 in “Windows 11 users are tired of MS account requirements creeping into everything” “was using LUKS + EXT4 -- with no issues whatsoever”
Comment from 30 Jun 2026 in “CachyOS June 2026 Release” Easy to understand and robust
“or LUKS on Linux.. heck, even Veracrypt is actually easier to understand and more robust.”
Comment from 2 Jul 2026 in “Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory” “LUKS2 + Systemd make it so easy to implement.”
Comment from 25 Oct 2026 in “Full Disk Encryption on Fedora with TPM2”
What people warn about
Each mark is one comment
Known flaws and information disclosure
“LUKS isn't all rainbows and butterflies either. This vulnerability has been known for years, and despite this, nothing has been done to address it.”
Comment from 24 Jan 2026 in “Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops” “loaded with caveats and gotchas especially related to LUKS2 information disclosure”
Comment from 11 Feb 2026 in “Gnome leaks thumbnails from encrypted and external drives” “TPM-based encryption on Linux remains quite flawed, and has been for years now”
Comment from 24 Jan 2026 in “Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops”
Other disk encryptions people recommend
The four most recommended other disk encryptions, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| VeraCrypt | 45 | 18 | 71% | 10 | — | Approved |
| Microsoft BitLocker | 45 | 115 | 28% | 8 | 10.7 yrs3 owners | — |
| LUKSThis page | 32 | 6 | 84% | 13 | — | Approved |
| TrueCrypt | 9 | 7 | 56% | 6 | — | — |
| FileVault | 8 | 9 | 47% | 3 | — | — |
What people said
38 of the 41 comments that mention it, newest first. Each links to the original comment.
“It seems like only open source solutions actually provide encryption, like LUKS and Veracrypt.”
“If you use LUKS or BitLocker (w/o MS backup) you do not have this risk avenue”
“LUKS2 + Systemd make it so easy to implement.”
“The way Linux does it is far more flexible and secure”
“Keyslots are alternatives, not requirements, so a TPM slot and a passphrase slot coexist and either one alone unwraps the master key.”
“For FDE I prefer LVM-over-LUKS and a dedicate partition”
“It's not the application's job to do encryption at rest, it's the filesystem's.”
“use LUKS unless you really need the features of ZFS native enc”
“Not that would work in proper forensic operations.”
“I'd want to then be able to have that encrypted with LUKS myself”
“a 2nd partition as Linux LUKS may work just a good”
“I built a CLI program that wraps luks + btrfs”
“LUKS still keeps unencrypted header on the harddrive”
“or LUKS on Linux.. heck, even Veracrypt is actually easier to understand and more robust.”
“was using LUKS + EXT4 -- with no issues whatsoever”
“used LUKS encryption on a system76 laptop for 7 years and it worked fine”
“LUKS allows you to set up multiple entry keys, so use two, either of which will grant access to the drive.”
“It's not tied to the motherboard.”
“Linux+LUKS enables FIDO2, which uses sha256, meets the requirements of "never leaves the device"”
“Nobody is going to bypass LUKS or FileVault like this.”
“regular LUKS with a password is enough on its own”
“That + full-disk encryption is why I went with BTRFS inside LUKS for my NAS.”
“this is certainly something Linux can with LUKS et. al.”
“loaded with caveats and gotchas especially related to LUKS2 information disclosure”
“best practice is always to encrypt with luks”
“LUKS + F2FS for /home with an external key file imported into initrd solves a lot of issues.”
“there's no comparison, it's damn easier and clearer”
“add luks root, then it's not that bad”
“This is a failure and doesn't happen on systems like LUKS.”
“LUKS isn't all rainbows and butterflies either. This vulnerability has been known for years, and despite this, nothing has been done to address it.”
“When you really want to be safe”
“TPM-based encryption on Linux remains quite flawed, and has been for years now”
“Agree, use Linux, use LUKS.”
“This is by far one of the best advertisements for LUKS/VeraCrypt I've ever seen.”
“You need Luks encryption in place for that”
“Secure Boot + LUKS + SELinux gives anyone a pretty airtight userspace.”
“Kernel level, leverages acceleration, transparent to anything you run on top of it.”
“I would recommend, just in case, to set up LUKS on your server.”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.