LUKSbox v0.4.0
/ Documentation / Getting started / Quickstart

Quickstart

Your first encrypted vault, mounted as a drive, in under 60 seconds.

This page assumes you've installed LUKSbox via your platform's package or pulled a release binary. If not, see Install on Linux, macOS, or Windows first.

Heads-up before you start. A LUKSbox vault is a travelling copy of your data (cloud sync, shared drive, USB stick), not a master copy. If the .lbx file is corrupted or every keyslot becomes inaccessible, the data is gone. Always keep an unencrypted copy of anything you cannot afford to lose somewhere you trust. See the docs intro for the full why and the Disclaimer for the no-warranty / no-liability details.

1. Create a vault

luksbox create my-vault.lbx
# Prompts for a passphrase. Twice.

That's it. You now have a 1 MB file at my-vault.lbx containing an empty encrypted vault. Default cipher: AES-256-GCM-SIV. Default KDF: Argon2id "interactive" preset (256 MiB memory, 540 ms per unlock on modern hardware).

2. Add some files

luksbox put my-vault.lbx /etc/hostname        # add a file
luksbox put my-vault.lbx report.pdf docs/2026-q1.pdf   # rename on the way in
luksbox ls my-vault.lbx /                     # list root
luksbox ls my-vault.lbx /docs                 # list a subdir

3. Mount as a drive

mkdir /tmp/v
luksbox mount my-vault.lbx /tmp/v             # daemonizes
ls /tmp/v                                     # transparent file access
cat /tmp/v/hostname                            # works like any file
luksbox umount /tmp/v                         # clean unmount

Same mount works on macOS (with macFUSE installed) and Windows (with WinFsp installed). Just point at a mountpoint or drive letter.

4. Add a hardware key

If you have a YubiKey, Google Titan, or other CTAP2 device:

luksbox enroll my-vault.lbx --fido2
# Touch the key when prompted, enter PIN if requested.

Now the vault has two keyslots: passphrase (slot 0) and FIDO2 (slot 1). Either can unlock it. Lose the passphrase, your YubiKey still opens the vault; lose the YubiKey, your passphrase still does.

5. Where to next

<- PreviousInstall on Linux