PAGES
← all tools
◆ Password & Credential Cracking

bruteforce-luks

1.1 open-source

bruteforce-luks tries to find the password of a LUKS encrypted volume via exhaustive charset enumeration or dictionary file.

source ↗ rss ↗ What is a cyber toolchain?

Summary

bruteforce-luks is an open-source command-line tool that tries passwords against a LUKS-encrypted volume until one unlocks it, whether generated from a character set and length range or read from a dictionary file. It runs as a single-threaded process by default, though the number of threads is configurable, and long sessions can be checkpointed and resumed with a state file, with progress reported periodically or on demand via a USR1 signal. This puts it in the password-cracking category rather than general recovery software, aimed at penetration testers and forensic examiners auditing disk-encryption passphrase strength rather than end users who forgot a password. First committed in 2014 and still on GitHub with 280+ stars, the project has had no commits in the past year and its last release was over two and a half years ago, so treat it as stable but not actively maintained.

bruteforce-luks tries to find the password of a LUKS encrypted volume via exhaustive charset enumeration or dictionary file.

How bruteforce-luks helps

Can a weak passphrase on this encrypted volume be found by guessing alone?

tries passwords generated from a character set and length range, or read line by line from a dictionary file, against the volume's key slots until one opens it, giving a direct yes/no on guessability

How long will testing every combination up to a certain length actually take?

reports progress and cracking speed periodically or on demand via a USR1 signal, so the observed rate can be used to estimate time to exhaustion for the chosen character set and length range

Can a multi-day cracking run survive a reboot or a killed process without starting over?

checkpoints its position to a state file roughly every minute and reloads it at startup, resuming from where it left off instead of restarting the search

Will throwing more CPU cores at the problem speed up the search?

runs single-threaded by default but accepts a configurable thread count, letting the same search be split across cores to raise the tested-passwords-per-second rate

Does this technique work against the newer LUKS2 header format or only the original one?

supports both LUKS1 and LUKS2 volumes, so the same guessing approach applies regardless of which on-disk format the target uses

Which slot and passphrase actually unlocked the drive?

stops as soon as a working password is found and prints the last tried password along with progress info, identifying the successful guess

all 4 features, with the evidence for each →

Languages

Not documented

Features

4 capabilities · 4 backed by code, an API document or a real run

Built from bruteforce-luks's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What bruteforce-luks offers you

  • Command-line interface2
All capabilities 4 capabilities
Brute-force password cracking verified Attempts to recover a LUKS volume password by trying combinations drawn from a configurable character set up to a specified maximum length. 2 releases · 6 other sources · first seen Oct 2015

release

  • Supports all characters of the current locale (e.g. UTF-8) for password generation. 1.1 · Oct 2015 · source · release history
  • Adds the ability to read passwords from a file instead of stdin. 1.1 · Oct 2015 · source · release history

docs

  • =============== - try all the possible passwords given a charset - try all the passwords in a file ## Exhaustive mode - the minimum password length to try - the maximum password length to try - the beginning of the password - the end of the password - the character set to use (among the characters of the current… seen Sep 2026 · source
  • Find all pull requests that aren't related to any open issues with -linked:issue seen Aug 2026 · source
  • glv2 / bruteforce-luks Public Notifications You must be signed in to change notification settings Fork 35 Star 282 Tried passwords Remains at Zero #45 Copy link Copy link Open Open Tried passwords Remains at Zero #45 Copy link seen Aug 2026 · source
  • glv2 / bruteforce-luks Public Notifications You must be signed in to change notification settings Fork 35 Star 281 Branches navigation Search Branch Updated Check status Behind Ahead Pull request Action menu master Copy branch name to clipboard Mar 1, 2024 Delete branch Branch menu seen Jul 2026 · source

command line

  • -s — Password character set. Default: "0123456789ABCDEFGHIJKLMNOPQRSTU VWXYZabcdefghijklmnopqrstuvwxyz" 1.1.1 · Nov 2015 · command-line history
  • -m — Maximum password length (beginning and end included). Default: 8 1.1.1 · Nov 2015 · command-line history
Progress reporting verified Outputs attack progress information on a timed interval or when a USR1 signal is sent to the process. 1 release · 2 other sources · first seen Oct 2015

release

  • Prints progress info when sending a USR1 signal to the process. 1.1 · Oct 2015 · source · release history

command line

  • -v — Print progress info every n seconds. 1.3.0 · Jul 2017 · command-line history
  • -t — Number of threads to use. Default: 1 Sending a USR1 signal to a running bruteforce-luks process makes it print progress info to standard error and continue. 1.1.1 · Nov 2015 · command-line history
Multi-threaded execution verified Runs the brute-force attack across multiple threads to increase throughput. 2 other sources · first seen Nov 2015

Also counts toward: Command-line interface

docs

  • glv2 / bruteforce-luks Public Notifications You must be signed in to change notification settings Fork 35 Star 282 Crashes with threads > physical cores - 2 #42 Copy link Copy link Open Open Crashes with threads > physical cores - 2 #42 Copy link seen Aug 2026 · source

command line

  • -t — Number of threads to use. Default: 1 Sending a USR1 signal to a running bruteforce-luks process makes it print progress info to standard error and continue. 1.1.1 · Nov 2015 · command-line history
Session save and restore verified Persists the current attack state to a file at regular intervals so a previous session can be resumed. 1 other source · first seen Jul 2017

Also counts toward: Command-line interface

command line

  • -w — Restore the state of a previous session if the file exists, then write the state to the file regularly (~ every minute). 1.3.0 · Jul 2017 · command-line history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for bruteforce-luks, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail bruteforce-luks puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

1 entry

  1. October 20151

    1 entry

    1. 1.1 Oct 31, 2015 · release notes

      bruteforce-luks 1.1 adds locale support, USR1 progress, and file-based password input

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.1 https://github.com/glv2/bruteforce-luks.git
# already have the repo? check out this version:
$ git checkout 1.1
      • Adds the ability to read passwords from a file instead of stdin.
      • Supports all characters of the current locale (e.g. UTF-8) for password generation.
      • Prints progress info when sending a USR1 signal to the process.

      3 details in Everything

    Project health

    Issue, contributor and maintainer activity in glv2/bruteforce-luks, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 0 ±0 vs prior 12 months
    2. Maintainers 0 +0 joined · −0 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog 17 of 39 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 17
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 283
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback