snap-tpmctl is a command-line tool to manage TPM-backed Full Disk Encryption (FDE) on Ubuntu systems.
It provides a single operational interface for:
- checking TPM/FDE status
- creating and validating recovery keys
- managing passphrase and PIN authentication methods
- listing LUKS keyslots metadata
- unlocking and mounting encrypted volumes
Managing TPM and FDE operations often involves multiple low-level tools and repetitive, error-prone steps.
snap-tpmctl centralizes these workflows into clear, auditable commands designed for administrators, support engineers, and automation scenarios.
Check current FDE status:
snap-tpmctl statusCreate a recovery key:
sudo snap-tpmctl create-recovery-key my-recovery-keyAdd PIN authentication:
sudo snap-tpmctl add-pinList configured recovery keys:
snap-tpmctl list-recovery-keysUnlock and mount an encrypted volume:
sudo snap-tpmctl mount-volume /dev/nvme0n1p4 /media/my-volContributions are welcome. Please read CONTRIBUTING.md for more info.