Need help with age?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

FiloSottile
5.9K Stars 190 Forks BSD 3-Clause "New" or "Revised" License 145 Commits 15 Opened issues

Description

A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.

Services available

!
?

Need anything else?

Contributors list

# 296
Go
golang
Firefox
Chrome
117 commits
# 71,471
mpd
SQLite
reddit
built-a...
4 commits
# 128,122
C
Shell
C++
built-a...
2 commits
# 143,772
Shell
XML
pypi
built-a...
1 commit
# 172,034
Python
built-a...
Go
unix-ph...
1 commit
# 154,118
Go
Homebre...
k8s
built-a...
1 commit
# 98,054
simulat...
Atom
Markdow...
pypi
1 commit
# 32,465
C
centos
vmware
rhel
1 commit
# 111,669
k8s
golang
HTML
Zsh
1 commit
# 83,863
Go
golang
SQLite
unix-ph...
1 commit
# 7,608
stow
yadm
verilog
travis
1 commit
# 33,699
Perl
sed
c-plus-...
ffmpeg
1 commit
# 53,116
Go
Shell
golang
built-a...
1 commit
# 169,297
built-a...
Go
unix-ph...
C
1 commit
# 22,286
Go
gRPC
netlink
golang
1 commit
# 115,941
Rust
kafka
twilio
Django
1 commit
# 43,371
C++
Zsh
React N...
Electro...
1 commit
# 161,360
sqlite3
hugo
elisp
built-a...
1 commit
# 127,457
C++
built-a...
unix-ph...
node-js
1 commit
# 164,233
PHP
CSS
Shell
built-a...
1 commit

age

age is a simple, modern and secure file encryption tool, format, and Go library.

It features small explicit keys, no config options, and UNIX-style composability.

$ age-keygen -o key.txt
Public key: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
$ tar cvz ~/data | age -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p > data.tar.gz.age
$ age --decrypt -i key.txt data.tar.gz.age > data.tar.gz

The format specification is at age-encryption.org/v1. age was designed by @Benjojo12 and @FiloSottile.

An alternative interoperable Rust implementation is available at github.com/str4d/rage.

The author pronounces it

[aɡe̞]
, like the Italian “aghe”.

Usage

Usage:
    age (-r RECIPIENT | -R PATH)... [--armor] [-o OUTPUT] [INPUT]
    age --passphrase [--armor] [-o OUTPUT] [INPUT]
    age --decrypt [-i PATH]... [-o OUTPUT] [INPUT]

Options: -o, --output OUTPUT Write the result to the file at path OUTPUT. -a, --armor Encrypt to a PEM encoded format. -p, --passphrase Encrypt with a passphrase. -r, --recipient RECIPIENT Encrypt to the specified RECIPIENT. Can be repeated. -R, --recipients-file PATH Encrypt to recipients listed at PATH. Can be repeated. -d, --decrypt Decrypt the input to the output. -i, --identity PATH Use the identity file at PATH. Can be repeated.

INPUT defaults to standard input, and OUTPUT defaults to standard output.

RECIPIENT can be an age public key generated by age-keygen ("age1...") or an SSH public key ("ssh-ed25519 AAAA...", "ssh-rsa AAAA...").

Recipient files contain one or more recipients, one per line. Empty lines and lines starting with "#" are ignored as comments. "-" may be used to read recipients from standard input.

Identity files contain one or more secret keys ("AGE-SECRET-KEY-1..."), one per line, or an SSH key. Empty lines and lines starting with "#" are ignored as comments. Multiple key files can be provided, and any unused ones will be ignored. "-" may be used to read identities from standard input.

Multiple recipients

Files can be encrypted to multiple recipients by repeating

-r/--recipient
. Every recipient will be able to decrypt the file.
$ age -o example.jpg.age -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p \
    -r age1lggyhqrw2nlhcxprm67z43rta597azn8gknawjehu9d9dl0jq3yqqvfafg example.jpg

Recipient files

Multiple recipients can also be listed one per line in one or more files passed with the

-R/--recipients-file
flag.
$ cat recipients.txt
# Alice
age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
# Bob
age1lggyhqrw2nlhcxprm67z43rta597azn8gknawjehu9d9dl0jq3yqqvfafg
$ age -R recipients.txt example.jpg > example.jpg.age

If the argument to

-R
(or
-i
) is
-
, the file is read from standard input.

Passphrases

Files can be encrypted with a passphrase by using

-p/--passphrase
. By default age will automatically generate a secure passphrase. Passphrase protected files are automatically detected at decrypt time.
$ age -p secrets.txt > secrets.txt.age
Enter passphrase (leave empty to autogenerate a secure one):
Using the autogenerated passphrase "release-response-step-brand-wrap-ankle-pair-unusual-sword-train".
$ age -d secrets.txt.age > secrets.txt
Enter passphrase:

SSH keys

As a convenience feature, age also supports encrypting to

ssh-rsa
and
ssh-ed25519
SSH public keys, and decrypting with the respective private key file. (
ssh-agent
is not supported.)
$ age -R ~/.ssh/id_ed25519.pub example.jpg > example.jpg.age
$ age -d -i ~/.ssh/id_ed25519 example.jpg.age > example.jpg

Note that SSH key support employs more complex cryptography, and embeds a public key tag in the encrypted file, making it possible to track files that are encrypted to a specific public key.

Encrypting to a GitHub user

Combining SSH key support and

-R
, you can easily encrypt a file to the SSH keys listed on a GitHub profile.
$ curl https://github.com/benjojo.keys | age -R - example.jpg > example.jpg.age

Keep in mind that people might not protect SSH keys long-term, since they are revokable when used only for authentication, and that SSH keys held on YubiKeys can't be used to decrypt files.

Installation

Homebrew (macOS or Linux) brew tap filippo.io/age https://filippo.io/age
brew install age
MacPorts port install age
Ubuntu 21.04+ apt install age
Debian 11+ (Bullseye) apt install age
Arch Linux pacman -Syu age
Fedora 33+ dnf install age
OpenBSD 6.7+ pkg_add age (security/age)
FreeBSD pkg install age (security/age)
NixOS / Nix nix-env -i age

On Windows, Linux, macOS, and FreeBSD you can use the pre-built binaries.

If your system has Go 1.13+, you can build from source.

git clone https://filippo.io/age && cd age
go build -o . filippo.io/age/cmd/...

Help from new packagers is very welcome.

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.