ConfigsApr 13, 2026·3 min read

age — Simple Modern Encryption Tool

age is a simple, modern, and secure file encryption tool. It replaces GPG for everyday encryption with a clean CLI, small explicit keys, no configuration options, and UNIX-style composability. Designed by Filippo Valsorda, a Go security lead.

AI Open Source
AI Open Source · Community
TL;DR
age encrypts files with X25519 keys and zero configuration, replacing GPG for everyday encryption tasks.
§01

What it is

age (pronounced 'ah-geh', from Italian) is a modern file encryption tool designed as a simpler replacement for GPG. Created by Filippo Valsorda, formerly the Go security lead at Google, age focuses on doing one thing well: encrypting and decrypting files. There are no key servers, no web of trust, no configuration files, and no surprising defaults.

age targets developers and system administrators who need to encrypt files, secrets, and backups without the complexity of GPG. It is used as the encryption backend by tools like sops and chezmoi.

§02

How it saves time or tokens

age eliminates GPG's configuration overhead entirely. Key generation is a single command that produces a small, readable key file. Encryption and decryption each take one command with obvious flags. The key format is compact (a single line starting with 'age1...') and easy to share via chat or configuration management tools.

§03

How to use

  1. Install age: brew install age on macOS or sudo apt install age on Debian/Ubuntu.
  2. Generate a key pair: age-keygen -o key.txt (outputs the public key to stdout).
  3. Encrypt a file: age -r age1recipient... -o secret.txt.age secret.txt. Decrypt with age -d -i key.txt secret.txt.age.
§04

Example

# Generate a key pair
age-keygen -o key.txt
# Output: public key: age1ql3z7hjy54pw3hyww5ayf...

# Encrypt for a recipient
age -r age1ql3z7hjy54pw3hyww5ayf... -o secret.txt.age secret.txt

# Decrypt with private key
age -d -i key.txt -o secret.txt secret.txt.age

# Encrypt with passphrase (no keys needed)
age -p -o backup.tar.age backup.tar

# Pipe-friendly (UNIX composability)
tar czf - ./secrets | age -r age1... > secrets.tar.gz.age
§05

Related on TokRepo

§06

Common pitfalls

  • age does not support signing or verification; it only encrypts and decrypts. Use a separate tool like minisign for digital signatures.
  • Losing the private key means losing access to encrypted files permanently; back up key.txt securely.
  • age encrypts individual files but does not manage encrypted repositories; pair it with sops or git-crypt for repository-level secret management.

Frequently Asked Questions

How does age compare to GPG?+

age is dramatically simpler: no configuration, no key servers, no trust model. GPG supports signing, verification, and key management that age deliberately omits. Use age for file encryption and GPG when you need the full PGP ecosystem.

What encryption algorithms does age use?+

age uses X25519 for key agreement and ChaCha20-Poly1305 for authenticated encryption. Passphrase mode uses scrypt for key derivation.

Can I encrypt for multiple recipients?+

Yes. Specify multiple -r flags with different public keys. Each recipient can decrypt the file independently using their own private key.

Does age work with SSH keys?+

Yes. age can encrypt to SSH public keys (ed25519 and RSA) using the -R flag, so recipients do not need to generate separate age keys.

Is age audited?+

The age specification and the Go implementation (filippo.io/age) have received security review. The format was designed by a cryptography expert with a focus on simplicity to minimize attack surface.

Citations (3)
  • age GitHub— age is a simple modern encryption tool designed by Filippo Valsorda
  • age Spec— age specification and format design
  • RFC 7748— X25519 key agreement and ChaCha20-Poly1305 AEAD
Related on TokRepo
AI security toolsAI DevOps toolsFeatured workflows

Discussion

Sign in to join the discussion.
No comments yet. Be the first to share your thoughts.

Related Assets

HumHub — Open-Source Enterprise Social Network

A flexible, open-source social networking platform built on Yii2 for creating private communities, intranets, and collaboration spaces within organizations.

AI Open Source

Dolibarr — Open-Source ERP & CRM for Business Management

A modular open-source ERP and CRM application written in PHP for managing contacts, invoices, orders, inventory, accounting, and more from a single web interface.

AI Open Source

PrestaShop — Open-Source PHP E-Commerce Platform

A widely adopted open-source e-commerce platform written in PHP with a rich module marketplace, multi-language support, and a strong European user base.

AI Open Source
◈Home🔍Search👤Me