TUI wizard

luksbox wizard - the interactive walkthrough. Same operations as the CLI, with confirmation prompts and inline explanations.

luksbox wizard is the interactive entry point. No arguments to remember; it asks one question at a time and explains each choice before doing anything destructive. Use it on a new machine, when teaching someone else how to use LUKSbox, or when you want confirmation prompts ahead of revoke / rotate operations.

The wizard is purely a UX layer over the same Container core that backs the CLI and GUI, the on-disk bytes are identical no matter which tool you used to write them.

LUKSbox wizard start: a FIDO2 authenticator picked for the session, then the top-level menu What would you like to do? — Top-level wizard menu (older screenshot; current versions also list the three deniable-vault actions). Each action drills into a sub-menu that asks for the parameters it needs and confirms before doing anything destructive.

What the wizard covers

Action	Walks you through
Create a new vault	Every keyslot kind the build supports (passphrase, FIDO2 x2, hybrid PQ x4; TPM 2.0 x7 on Linux and Windows; Secure Enclave x10 on macOS), every cipher suite, header format, anchor, maximum size
Open an existing vault	Unlock with a method that matches the vault's keyslots (optional anchor check), then the vault menu: files, manage keyslots, rotate the master key, upgrade the header, vault size, mount, panic
Show info about a vault (no unlock)	Cipher, layout, header format, slot table with KDF parameters
Generate a strong random passphrase	Prints a 20-character OsRng passphrase, about 99 bits
Create a deniable vault (advanced)	Cipher, Argon2id strength, credential type, metadata and header format, anchor
Mount a deniable vault (advanced)	The cipher, Argon2id strength and credential type used at create time, optional anchor check, mount
Verify a deniable header (advanced)	The same questions; opens the vault and prints its parameters without mounting
PANIC: irreversibly destroy a vault by header path	Overwrites the header (optionally the whole vault) with random bytes
Quit	Returns to the shell

Keyslot kinds the binary cannot use (FIDO2, TPM 2.0 or Secure Enclave missing from the build, as in the passphrase-only static Linux CLI) are not offered (0.6.1+). See the walkthrough for the details.

Launch

luksbox wizard

The wizard requires an interactive terminal (it uses dialoguer for prompts). Pipe input at your own risk, option numbering may change between minor versions.

Walkthrough pages

Page	Covers
Wizard walkthrough	The full flow with screenshot placeholders for each menu / dialog

When to use the TUI vs the CLI vs the GUI

Use the TUI when	Use the CLI when	Use the GUI when
You want guided prompts	You're scripting / automating	You want a click-driven workflow
You're on a remote / SSH session	You need every flag	You're on a desktop session
You're new to LUKSbox or onboarding someone	You want stdin-pipe passphrase entry	You want to mount the vault as a drive and use your file manager
You want explicit confirmation before revoke / rotate	You want minimal startup time	You want the visual slot table + recent-vaults list

All three operate on the same .lbx files, choose per-task.

Wizard walkthrough Screen-by-screen walkthrough of luksbox wizard - menus, prompts, confirmation dialogs.