How to Encrypt Swap With a Random Key Using dm-crypt and crypttab

Updated: 29 September 2026 · Applies to: cryptsetup 2.7 and 2.8 with systemd on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10, Ubuntu 24.04 and 26.04, Debian 13

Swap space can contain anything that was in memory: passwords, keys, customer data. On a server whose disks may be replaced, returned or stolen, encrypting swap keeps that data unreadable. Because swap does not need to survive a reboot, it can be encrypted with a new random key at every boot, so there is no password to type and no key to store. We tested the steps with cryptsetup 2.8 on AlmaLinux 9 and 10.

Before you start

• Use a dedicated partition or logical volume for swap. Everything on it is erased at every boot.
• Refer to it by a stable name, such as /dev/disk/by-partuuid/..., /dev/disk/by-id/... or an LVM path like /dev/vg0/swap. Never use /dev/sdb2-style names: they can change between boots, and the next boot would then format the wrong partition. A UUID= reference does not work either, because the random encryption overwrites the partition's ID.
• Hibernation (suspend to disk) cannot work with a random key. This rarely matters on servers.

1. Turn off the current swap

swapon --show
swapoff /dev/vg0/swap

Remove or comment out the old swap line in /etc/fstab.

2. Add the device to /etc/crypttab

cswap  /dev/vg0/swap  /dev/urandom  swap,cipher=aes-xts-plain64,size=512,sector-size=4096

At boot this opens /dev/mapper/cswap with a random key from /dev/urandom and formats it as swap (the swap option). aes-xts-plain64 with a 512-bit key is AES-256 in XTS mode.

3. Add the swap line to /etc/fstab

/dev/mapper/cswap  none  swap  defaults  0 0

4. Activate it now, without a reboot

systemctl daemon-reload
systemctl start systemd-cryptsetup@cswap.service
swapon -a
swapon --show

swapon --show should list /dev/mapper/cswap. cryptsetup status cswap shows the cipher and key size. Reboot once to confirm it comes up by itself.

Troubleshooting

• If the swap does not appear after a reboot, check systemctl status systemd-cryptsetup@cswap.service and the path in /etc/crypttab.
• On AlmaLinux, Rocky Linux and RHEL, swap on LVM is often also listed on the kernel command line (rd.lvm.lv=vg0/swap) and as resume=. Remove the resume= entry, since hibernation no longer applies: grubby --update-kernel=ALL --remove-args="resume".

An alternative: zram

If you only need a little swap, compressed swap in RAM (zram) avoids writing memory to disk at all. To remove disk swap completely instead, see how to permanently disable swap in Linux.

Official documentation: crypttab(5) manual and cryptsetup project.