systemd-cryptenroll
Ranked 6 of 7 disk encryptions by recommenders
Free Linux tool for setting up TPM-backed LUKS disk encryption, praised as simple to set up. Critics note an unfixed issue, linked to a systemd pull request.
Free Linux tool for setting up TPM-backed LUKS disk encryption, praised as simple to set up. Critics note an unfixed issue, linked to a systemd pull request.
9 people gave an opinion
- recommend it
- 7
- criticize it
- 2
- approval share
- 78%
Recommended in 5 of 13 months
- November 2025: not recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: not recommended
- March 2026: recommended
- April 2026: not recommended
- May 2026: recommended
- June 2026: not recommended
- July 2026: not recommended
- August 2026: not recommended
- September 2026: recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 7 people recommend itNeeds 10 or more, not met.
- 3.5 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 5 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Easy to set up
“I didn't find it too difficult to set up TPM backed encryption on Arch using systemd-cryptenroll”
Comment from 15 May 2026 in “Microsoft BitLocker – YellowKey zero-day exploit” “it's very easy to set up. Quite literally a single command.”
Comment from 22 Dec 2025 in “Microsoft will kill obsolete cipher that has wreaked decades of havoc” Simpler TPM-backed disk encryption
“I didn't find it too difficult to set up TPM backed encryption on Arch using systemd-cryptenroll”
Comment from 15 May 2026 in “Microsoft BitLocker – YellowKey zero-day exploit” “These days with cryptenroll and friends, using the TPM is hardly an issue anymore.”
Comment from 11 Sep 2026 in “Stop making swap partitions—use swap files instead” “seal the LUKS key in TPM2 tied to PCR values using systemd-cryptenroll”
Comment from 6 Mar 2026 in “Remotely unlocking an encrypted hard disk”
What people warn about
Each mark is one comment
Known feature gap not yet fixed
“Cryptenroll doesn't ( https://github.com/systemd/systemd/pull/27502 ), which is bad but has not been fixed.”
Comment from 14 May 2026 in “Microsoft BitLocker – YellowKey zero-day exploit” “Cryptpentroll does not do this at all”
Comment from 14 May 2026 in “Microsoft BitLocker – YellowKey zero-day exploit”
Other disk encryptions people recommend
The four most recommended other disk encryptions, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| VeraCrypt | 45 | 18 | 71% | 10 | — | Approved |
| Microsoft BitLocker | 45 | 115 | 28% | 8 | 10.7 yrs3 owners | — |
| LUKS | 32 | 6 | 84% | 13 | — | Approved |
| TrueCrypt | 9 | 7 | 56% | 6 | — | — |
| systemd-cryptenrollThis page | 7 | 2 | 78% | 5 | — | — |
What people said
All 10 comments that mention it, newest first. Each links to the original comment.
“These days with cryptenroll and friends, using the TPM is hardly an issue anymore.”
“because the TPM returns the actual FVEK, unlike BitLocker, where the VMEK itself depends on the PIN”
“I didn't find it too difficult to set up TPM backed encryption on Arch using systemd-cryptenroll”
“Cryptenroll doesn't ( https://github.com/systemd/systemd/pull/27502 ), which is bad but has not been fixed.”
“Cryptpentroll does not do this at all”
“Can also use systemd-cryptsetup/systemd-cryptenroll for this.”
“seal the LUKS key in TPM2 tied to PCR values using systemd-cryptenroll”
“I've been using this for a few years now, and never had an issue.”
“systemd-cryptenroll for example is just straight up much easier to use for most applications of FDE”
“it's very easy to set up. Quite literally a single command.”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.