What it does
age encrypts files to one or more recipients (public keys starting with age1…, or SSH public keys) or with a passphrase. There is no web of trust and no config. age-keygen makes a key pair. It is the default key type for SOPS in GitOps repos.
How to write it
age [-r RECIPIENT | -R FILE | -p] [-a] [-o OUT] [IN]
age -d [-i IDENTITY] [-o OUT] [IN]Main parts
Tools
age-keygen[-o FILE]- Make a new key pair.
age-keygen-yFILE- Print the public key of a private key file.
age- Encrypt or decrypt.
Options 7
Most used
age flags
Nothing matches this filter.
Examples 10
$ run as a normal user# run as root (or with sudo)
1Make a key pair
age-keygen -o key.txt Public key: age1qz8x0examplepublickeyonly0000000000000000000000000000q9lc5 chmod 600 key.txt2Encrypt a file for a public key
age -r age1qz8x0examplepublickeyonly0000000000000000000000000000q9lc5 -o backup.tar.gz.age backup.tar.gz3Decrypt it
age -d -i key.txt -o backup.tar.gz backup.tar.gz.age4Encrypt for several people
cat recipients.txt age1qz8x0examplepublickeyonly0000000000000000000000000000q9lc5 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExampleKeyOnly admin@laptop age -R recipients.txt -o db.sql.age db.sql5Use your SSH key to decrypt
age -d -i ~/.ssh/id_ed25519 db.sql.age > db.sql6Encrypt with a passphrase
age -p -o notes.txt.age notes.txt7Encrypt a backup on the fly
8Text output to paste
echo "token=abc" | age -a -r age1qz8x0examplepublickeyonly0000000000000000000000000000q9lc59Show the public key of a key file
age-keygen -y key.txt10Decrypt and restore a backup
Nothing matches this filter.
Watch out
- Lose the private key = lose the data. Keep an offline backup of
key.txt. - age does not sign; it only encrypts. Use
ssh-keygen -Y sign, minisign or cosign for signatures.
Files
key.txt- Private key (AGE-SECRET-KEY-1…). Keep it secret.
Tips to remember
- For many secrets in Git, use SOPS with age instead of encrypting whole files.
Exit codes
0 | Success. |
1 | Error (wrong key, bad file). |