Encrypt Debian 12 Swap with a Fresh Key at Every Boot

On Debian 12, a dedicated swap partition can be encrypted with a fresh random key each time the system starts. Add a random-key mapping in /etc/crypttab, then point /etc/fstab at the mapped device; the setup below uses the existing partition and does not require reinstalling Debian.

This procedure is for ordinary swap, not suspend-to-disk (hibernation). Because the key is discarded at shutdown, a hibernation image cannot be decrypted on the next boot. If you need hibernation, use a persistent-key design with its own resume configuration instead.

Before you change the swap configuration

Make sure you have a separate partition whose filesystem type is swap. Do not use the root partition, a data partition, or a disk that contains files you need. The example device names below are illustrative: replace them with values from your own system.

Check the active swap areas and match them to the block-device list:

swapon --show --output=NAME,TYPE,SIZE,USED,PRIO
lsblk -o NAME,PATH,TYPE,FSTYPE,UUID,PARTUUID,SIZE

Find the row where TYPE is part and FSTYPE is swap. Record its PARTUUID and confirm that it is the same partition shown by swapon --show. A PARTUUID identifies the partition itself and stays stable when the swap area is recreated. The swap filesystem UUID can change because the encrypted mapping is initialized again at startup.

Back up /etc/fstab before editing it. If the partition is in use, turn off only that swap area:

sudo cp -a /etc/fstab "/etc/fstab.before-cryptswap.$(date +%s)"
sudo swapoff /dev/nvme0n1p3

Replace /dev/nvme0n1p3 with the verified device. Disabling swap moves any pages stored there back into memory. If the command fails or the machine is under heavy memory pressure, stop here, close memory-heavy workloads, and retry when there is enough available RAM.

Configure a random-key encrypted mapping

Open the crypttab file with a root editor:

sudoedit /etc/crypttab

Add one line, replacing YOUR-PARTUUID with the actual partition identifier. Keep the mapping name cryptswap consistent in the next step.

cryptswap PARTUUID=YOUR-PARTUUID /dev/urandom plain,cipher=aes-xts-plain64,size=256,hash=sha1,swap

/etc/crypttab tells Debian which encrypted block device to create at startup. The PARTUUID= source points to the raw partition; /dev/urandom supplies a new key; plain selects dm-crypt without a persistent LUKS header; and swap asks the crypttab helper to initialize the mapped device as swap. The cipher, key size, and hash are specified explicitly, following the Debian Bookworm crypttab example. The mapping appears as /dev/mapper/cryptswap. The swap option runs mkswap on that mapped device at startup, so its contents are reinitialized each boot. Point the source only at the dedicated swap partition you verified; this option is destructive if aimed at a partition holding files.

Now open /etc/fstab. Comment out or remove the old line that enables the raw swap partition, including any line that refers to its current swap UUID. Add this entry instead:

/dev/mapper/cryptswap none swap sw 0 0

Do not leave both entries active: that could enable the unencrypted partition alongside the encrypted mapping. The fstab file describes swap areas enabled during startup, while Debian's systemd cryptsetup generator reads /etc/crypttab and creates the corresponding units. See the Bookworm systemd cryptsetup generator manual and Debian's fstab manual.

Reboot and verify the encrypted swap

Save both files and reboot so Debian can create the mapping during startup:

sudo reboot

After logging in again, check both the active swap path and the dm-crypt mapping:

swapon --show
sudo cryptsetup status cryptswap

The swap listing should name /dev/mapper/cryptswap, not the raw partition. The cryptsetup status output should show an active plain mapping and the expected underlying partition. This second check matters: a swap entry appearing in swapon --show alone does not prove that it is encrypted.

If the mapping is missing, check the spelling of the PARTUUID against lsblk and inspect the boot log with sudo journalctl -b -u systemd-cryptsetup@cryptswap.service. Confirm that the old raw-device entry is no longer active in /etc/fstab. Do not run mkswap directly on the raw partition after setting up the mapping.

Know what this change protects

With a new key generated at each boot, the contents written to swap during that session are encrypted on the block device, and the previous session's key is not retained after shutdown. This is useful when a device may be powered off and its storage examined. It does not encrypt the rest of the disk, protect data while Debian is running, or automatically erase plaintext that may have been left on the partition before conversion. If old swap contents are sensitive, treat sanitizing them as a separate storage-specific task; a filesystem-level reformat is not a guaranteed secure erase, especially on SSDs.

Debian's Bookworm installation guide describes random-key encryption as suitable for swap and notes that it prevents restoring a hibernation image after reboot. See the Debian 12 installation guide's encrypted-volume section. For the active device, use the two verification commands above: the mapper should be active, and its backing device should match the partition you selected.