OpenZFS encrypts datasets, not the whole pool. Pool labels and metaslabs stay visible; tank/secret contents do not. This is the TrueNAS / Proxmox / Linux path.

Background: Ars native encryption, ZFS encrypted backups.

Create

1
2

zfs create -o encryption=on -o keyformat=passphrase -o keylocation=prompt tank/encrypted
zfs create tank/encrypted/child1

child1 inherits encryption. Do not set encryption=off on a child: OpenZFS will not let you punch a plaintext hole under an encrypted parent.

Keyfile instead of prompt:

1
2

zfs create -o encryption=on -o keyformat=passphrase \
  -o keylocation=file:///root/zfs.key tank/encrypted

The key file does not live on the encrypted dataset. USB, TPM, or a path on another pool.

Load the key at boot

1
2

zfs load-key tank/encrypted
zfs mount tank/encrypted

Without load-key the dataset exists and zfs list shows it, but it will not mount.

Receive plaintext as encrypted

On the first recv you can set encryption properties:

1
2
3

zfs send tank/test@snap1 \
  | zfs recv -o encryption=on -o keyformat=passphrase \
      -o keylocation=file:///path/to/keyfile tank/encrypted

That receive is without -w. Raw -w copies the source wrapping key: only valid if the source was already encrypted. Details: unencrypted send into encrypted.

Rotate the passphrase (OpenZFS)

On Solaris the command was zfs key -c. On OpenZFS / Linux / TrueNAS:

1
2

zfs change-key tank/encrypted
zfs get keyformat,keylocation,keystatus tank/encrypted

New keyfile:

1

zfs change-key -o keylocation=file:///media/stick/key tank/encrypted

Wrapping-key rekey (does not rewrite every block; rotates the key that wraps master keys) is zfs change-key -i depending on version — read your zfs change-key man page before production.

See also: snapshot holds, off-host backups.