Encrypting a file with GPG works, but the tool is large, its options are numerous, and its key management confuses even experienced users. age (pronounced like the word, from “Actually Good Encryption”) does one thing: encrypt and decrypt files, with keys short enough to paste into a chat message.

Install

sudo apt install age        # Debian / Ubuntu
sudo dnf install age        # Fedora
sudo pacman -S age          # Arch

This gives you age and age-keygen. A compatible Rust implementation called rage exists too.

Keys

age-keygen -o ~/.config/age/key.txt
chmod 600 ~/.config/age/key.txt

Public key: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p

The public key (age1...) can be shared with anyone who wants to send you encrypted files. The file contains the private key; protect it and back it up, because without it nothing encrypted to you can be decrypted.

Encrypt and decrypt

age -r age1ql3z7hj...ac8p -o report.pdf.age report.pdf
age -d -i ~/.config/age/key.txt -o report.pdf report.pdf.age

Add -a (armor) for text output you can paste into an email or chat.

Several recipients

Encrypt once so several people can decrypt:

age -r age1alice... -r age1bob... -o secrets.tar.age secrets.tar

Or keep recipients in a file, one public key per line:

age -R recipients.txt -o secrets.tar.age secrets.tar

Include your own public key, or you will not be able to decrypt what you encrypted.

Passphrases

For a quick one-off without keys:

age -p -o notes.txt.age notes.txt
age -d -o notes.txt notes.txt.age

age derives the key with scrypt, which makes guessing slow, but a passphrase is still only as strong as you make it. Use a long one.

Use your SSH keys

If someone already has an SSH key, you can encrypt to it:

age -R ~/.ssh/id_ed25519.pub -o file.age file
age -d -i ~/.ssh/id_ed25519 -o file file.age

You can even fetch someone’s public SSH keys from GitHub at https://github.com/USERNAME.keys and encrypt to those. Our SSH keys guide covers creating them.

In pipelines and backups

age reads standard input and writes standard output, so it slots into pipelines:

tar czf - ~/Documents | age -r age1ql3z7hj...ac8p > documents-$(date +%F).tar.gz.age
age -d -i ~/.config/age/key.txt documents-2026-10-18.tar.gz.age | tar xzf -

That is a simple way to encrypt backups before copying them to cloud storage with rclone. Note that the backup machine only needs your public key to encrypt; the private key can stay offline. For full backup tools with built-in encryption and deduplication, see restic vs Borg.

Secrets in Git

SOPS can use age keys to encrypt values in YAML, JSON, and .env files so you can commit them safely, a common pattern for Kubernetes and infrastructure repositories. Only the values are encrypted, so diffs stay readable.

Hardware keys

age plugins extend age to hardware: age-plugin-yubikey, for example, keeps the private key on a YubiKey, so decryption needs the physical key and a touch.

What age does not do

• No signatures. age proves nothing about who encrypted a file. Use minisign, ssh-keygen -Y sign, or GPG for that
• No web of trust or key servers. You exchange public keys however you like
• Not for email. Use GPG or S/MIME for encrypted email

age or GPG?

Task	Better tool
Encrypt a file or backup	age
Secrets in Git (with SOPS)	age
Sign files or commits	GPG, ssh-keygen, or minisign
Verify downloaded software	GPG (most projects sign with it)
Encrypted email	GPG

Our GPG basics guide and GPG command builder cover the signing side.

Frequently Asked Questions

What is age?

age is a small, modern file encryption tool and format designed by Filippo Valsorda. It encrypts files to public keys or with a passphrase, has no configuration options, and is meant to replace common uses of GPG for file encryption.

How do I encrypt a file with age?

Generate a key pair with age-keygen -o key.txt, which prints your public key starting with age1. Encrypt with age -r age1yourpublickey -o file.age file, and decrypt with age -d -i key.txt -o file file.age.

Can age use my SSH keys?

Yes. You can encrypt to an ssh-ed25519 or ssh-rsa public key with -R ~/.ssh/id_ed25519.pub, and decrypt with the matching private key using -i ~/.ssh/id_ed25519. This is convenient for sending files to people whose SSH keys you already have.

Does age sign files?

No. age only encrypts. If you need to prove who created a file, sign it separately with minisign, signify, or ssh-keygen -Y sign, or use GPG, which does both.

Is age secure?

age uses well-studied modern primitives: X25519 for key agreement, ChaCha20-Poly1305 for encryption, and scrypt for passphrases. Its small design leaves little room for misuse. It has had public review, and both the Go reference implementation and the Rust implementation rage are widely used.

Should I use age or GPG?

Use age for encrypting files, backups, and secrets where you control both ends. Use GPG when you need signatures, encrypted email, compatibility with existing OpenPGP users, or verifying software releases that are signed with GPG keys.