Fix Linux Disk Encryption Password Not Appearing on Boot

Why the encryption password prompt disappears

You expect a password prompt for your encrypted disk at boot. Instead, the system boots straight to the login screen, or hangs with a blank screen. The culprit here is almost always a missing or wrong kernel parameter in GRUB, or an initramfs that doesn't include the cryptsetup modules. I've fixed this on Ubuntu 20.04, Fedora 36, and Debian 11. The trigger is often a kernel update that regenerates the initramfs incorrectly, or a manual GRUB configuration change that drops the cryptdevice parameter.

Root cause in plain English

The bootloader (GRUB) needs to tell the kernel where the encrypted disk is. If you don't pass the cryptdevice=UUID=... root=/dev/mapper/... parameter, the kernel doesn't know it needs to ask for a password. Also, the initramfs (initial ramdisk) must have cryptsetup tools. If those are missing, the prompt never appears. It's not a hardware issue — it's a config problem 9 times out of 10.

The fix — step by step

First, boot from a live USB so you can fix your installed system. Mount your root partition and chroot into it. On Ubuntu/Debian, that looks like:

sudo mount /dev/sda2 /mnt
sudo mount /dev/sda1 /mnt/boot
sudo mount --bind /dev /mnt/dev
sudo mount --bind /proc /mnt/proc
sudo mount --bind /sys /mnt/sys
sudo chroot /mnt

Then do this:

Check GRUB config — open /etc/default/grub and look for GRUB_CMDLINE_LINUX. It must include something like cryptdevice=UUID=your-luks-uuid:cryptroot root=/dev/mapper/cryptroot. If it's missing, add it. Get the UUID from blkid.
Regenerate GRUB — run update-grub on Debian/Ubuntu, or grub2-mkconfig -o /boot/grub2/grub.cfg on Fedora.
Rebuild initramfs — run update-initramfs -u -k all on Debian/Ubuntu, or dracut -f on Fedora. This makes sure cryptsetup is included.
Check initramfs contents — if you're paranoid, extract it with lsinitramfs /boot/initrd.img-$(uname -r) | grep crypt. You should see cryptsetup binaries and scripts.
Reboot — pull the live USB and boot normally. The password prompt should show.

If it still fails

Three things to check. First, verify your LUKS header is intact — run cryptsetup luksDump /dev/sda2 from a live USB. If it says 'Device not found', you've got the wrong partition. Second, check if systemd is delaying the prompt — sometimes systemd-ask-password hangs. Edit /etc/crypttab and add ,noauto to the line for your encrypted device, then rebuild initramfs again. Third, try adding plymouth.enable=0 to your kernel parameters — Plymouth can suppress the prompt on some setups. If none of that works, your initramfs is broken beyond simple repair, and you'll need to reinstall the kernel package entirely. Don't bother with reinstalling GRUB from scratch — it rarely helps unless you messed up the bootloader itself.