Your Linux drive, unlocked on your Mac.

LuksMac mounts ext2/3/4 drives straight into Finder, whether the filesystem is plain ext or encrypted inside a LUKS1 or LUKS2 container. Readable, writable, journalled, and with nothing installed in the kernel.

Get LuksMac · $9.99 once See how it works

Free read-only · $9.99 unlocks writing · MacOS 26 · Apple Silicon

disk6s1 · LUKS1 · 951.8 GB locked
LUKS header: readable without the passphrase ciphertext ext4 data
Nothing in the kernelNo kext, no macFUSE, no reduced security, no rebooting into Recovery mode.
No network callsNo account, no telemetry, no licence server. Your passphrase stays here.
Journalled writesWrites go through the filesystem's own jbd2 journal.

MacOS offers to eject it.
LuksMac mounts it.

Plug a LUKS drive into a Mac today and the system does not recognise a filesystem at all. It throws it's hands in confusion.

Without LuksMac
The macOS alert shown without LuksMac: “The disk you attached was not readable by this computer,” offering only Eject, Ignore and Initialise.
With LuksMac
A Finder list view of the mounted LUKSMAC-TEST volume: the folders documents, lost+found and photos beside README.txt and other text files, in Name / Date Modified / Size / Kind columns.

Every workaround is a bandaid on the same missing piece: MacOS has no native understanding of LUKS. Alternative solutions aim at trying to be able to access through various means but aren't use friendly to the MacOS UI. LuksMac solves the problem without Virtual Machines, kernel level fileystem extensions, and any sort of digital forensics to just be able to access files on a drive.

From raw sector to Finder window.

LuksMac is a userland file system extension built on Apple's FSKit. MacOS hands it the raw block device, it decrypts sectors in place and walks the ext filesystem with libext2fs.

  1. 1
    ProbeScans for LUKS drives by reading the LUKS header and recognises the container.
  2. 2
    UnlockYour passphrase unwraps a keyslot, which yields the volume key.
  3. 3
    ReadSectors decrypt on demand while libext2fs walks the filesystem.
  4. 4
    MountFSKit publishes it as a volume, and Finder opens it like any disk.
start of partition data offset end magic metadata keyslots encrypted data segment 4C 55 4B 53 primary + secondary PBKDF2 / Argon2 AES-XTS readable without the passphrase the ext2/3/4 filesystem lives here

What it looks like.

The whole app is one window. It comes forward when an encrypted drive is plugged in, takes the passphrase, and hands the volume to Finder.

Step one

Unlock

LuksMac appears on its own when an encrypted drive is plugged in. Type the LUKS passphrase and choose Unlock and Mount. Optionally remember the drive, and pick how carefully writes are flushed.
LuksMac uses Apple's Keychain to securely store your passwhrase.

The LuksMac window with a LUKS1 drive selected, a passphrase field, a Remember this drive checkbox, and a Standard / Full crash-safety choice.
Step two

Mounted

The volume comes up under /Volumes. Open it in Finder, copy its path, or eject the drive. Ejecting unmounts and powers the drive down in one step, so it is safe to unplug.

The LuksMac window showing a mounted LUKS2 volume at /Volumes/LUKS2 with Open in Finder, Copy Path and Eject buttons.
Step three

It is just a disk

In Finder it behaves like any other apple compatiable drive: drag files in and out, apply tags, read and write, inspect it.

A Finder window showing the contents of a mounted LUKS test volume (documents, photos, lost+found and text files) with the volume's Get Info panel open.

Exactly which drives it opens.

LuksMac doesn't support every single way to configure a LUKS drive, but it covers the defaults people use.

LayerSupportedNot supported
ContainerLUKS1, LUKS2, a container on an unpartitioned disk, or no container at allDetached headers, LVM, dm-integrity, reencryption in progress
Key derivationPBKDF2, Argon2i, Argon2idToken or keyfile unlock
CipherAES-XTS-plain64, 512-4096 byte sectorsOther cipher, mode or IV combinations
Filesystemext2, ext3, ext4, read and write, including a dirty journal replayed on mountFilesystems other than ext2/3/4
MacApple Silicon, MacOS 26 or laterIntel Macs, MacOS 15 and earlier

Where the guarantees stop.

LuksMac writes to real filesystems, so it is worth knowing the one place its safety net has a hole.

Eject before unplugging

Writes go through the drive’s own journal, but MacOS does not let the extension force the drive to commit that journal before the data it describes. Ejecting waits for every write to finish and is always safe. Pulling a mounted drive, or losing power while a write is in flight, can leave damage the journal cannot undo and the drive may then need e2fsck on a Linux machine. A mounted but idle drive is never at risk.

Everything else is just scope. LuksMac opens and edits drives that already exist. It does not create, format or resize a LUKS volume, and it does not carry POSIX ACLs or device nodes across. The table above lists exactly which existing drives it opens.

Free to read. $9.99 to write.

Download it and open any supported drive read-only for nothing. The one-time purchase turns on writing, on every Mac you own, with every future update. Buy once, yours forever.

$9.99once
  • Mount LUKS1 and LUKS2 ext drives in Finder
  • Write, create, rename and delete (read-only until you buy)
  • Journalled writes through the filesystem's own jbd2 journal
  • Extended attributes, so Finder tags survive
  • Header inspection and diagnostics
  • Safe eject from the menu bar
  • Any number of Macs, one licence
  • Offline licence key, nothing to activate
  • Every future update, for as long as it exists
  • Pay once, keep forever
Buy direct

Buying from this website:
checkout emails you a licence key. The app itself is a free download (or brew install --cask luksmac); the key unlocks writing. No Apple account needed. Lost your key? Get it re-sent.
Mac App Store:
installs and updates itself through Apple and stays with your Apple Account. Read-write from first launch, no key to enter.
Before buying, check the format list to make sure your drive is supported. If it opens read-only but writing fails, ask and the money comes back.
Paid users can file issues at LuksMac's GitHub issues.

Built on open source.

The cryptography and filesystem work is done by well-established libraries rather than anything homegrown. Every licence text ships inside the app, and each project is linked below.

ComponentVersionWhat it doesLicence
OpenSSL 3.6.3 AES-XTS sector decryption, PBKDF2, digests Apache-2.0
Argon2 20190702 Argon2i and Argon2id keyslot derivation Apache-2.0
e2fsprogs libext2fs 1.47.4 Reading and writing the ext2/3/4 filesystem LGPL-2.0
e2fsprogs libcom_err 1.47.4 Error table support for libext2fs MIT-style
JSON for Modern C++ 3.12.0 Parsing LUKS2 metadata MIT

libext2fs is LGPL, so it ships as a shared library you can replace: build e2fsprogs 1.47.4 yourself, drop your copy into the app bundle, and LuksMac loads it instead. The matching source accompanies every release. Full licence texts are installed in the app bundle, and every project above links to its own upstream repository. LuksMac claims no ownership of these projects or their trademarks.

Questions

Is my passphrase safe?

It is held in the MacOS Keychain, available only when this Mac is unlocked, and shared only with LuksMac's own filesystem extension. It is never written to disk in plaintext and never sent anywhere. The app has no permission enabled for network access, and every passphrase and derived key lives in a locked buffer while in use, then is erased.

Do I have to enable anything after installing?

MacOS requires you to switch on a file system extension by hand, but only once: System Settings → General → Login Items & Extensions → File System Extensions. The app tells you if it is still off and walks you through turning it on.

What if I unplug the drive while it is mounted?

If you were only reading, nothing is lost. If a write was in flight, the journal usually replays on the next mount and the filesystem comes back consistent. With the only caveat that MacOS does not let the extension enforce write ordering on the drive, so a power loss at the wrong moment can leave damage that needs e2fsck on a Linux machine. Either way, whatever was still being copied is gone. Eject first, and wait for the drive to disappear.

Why MacOS 26 and Apple Silicon only?

LuksMac is built on FSKit, which is how a filesystem runs in user space on a modern Apple system without a kernel extension, and the parts it depends on are recent. The alternative, shipping a kernel extension or macFUSE, would mean asking you to lower your Mac's security, and that trade is not worth it. If you are on an Intel Mac: honestly, put Linux on it. Omarchy makes that about as painless as it gets, and then the drive mounts natively anyway.