age: a small, modern tool for encrypting files

age (about 24,000 stars on GitHub) is a file encryption tool written by Filippo Valsorda, a cryptography engineer who led the Go security team for several years, with Ben Cartwright-Cox and others. Development started in 2019 and the format specification was finalised in 2021; a compatible Rust implementation, rage, is maintained separately by Jack Grigg. The project’s aim is a tool that does one thing with sound defaults: encrypt a file to one or more recipients so that only they can decrypt it, with no key servers, no trust web, no algorithm choices and no configuration file.

How it works

A recipient is a short public key that starts with age1, generated by age-keygen, or an existing SSH public key, which means you can encrypt a file to anyone whose key is on GitHub. The matching secret key, or a passphrase for the symmetric mode, decrypts the file. Under the hood age uses X25519 key agreement, ChaCha20-Poly1305 for the payload and scrypt for passphrases, and the format is documented so that other implementations interoperate. Plugins extend it to hardware tokens such as YubiKeys and to cloud key management services. The same code is available as a Go library for programs that need to encrypt data at rest.

Who it is for

• Developers and administrators who need to encrypt a backup, a database dump or a configuration file before storing it somewhere they do not fully control.
• Teams that commit encrypted secrets to Git; tools such as SOPS use age as a backend.
• Anyone who found GPG hard to use correctly and wants a tool with fewer ways to go wrong.
• Go programmers who need a well-reviewed encryption library with a simple API.

How to install and try it

brew install age
age --version
age-keygen -o key.txt
tar czf - ./myproject | age -r age1examplepublickey... > myproject.tar.gz.age

The last command encrypts an archive of your own project directory to a recipient key; age -d -i key.txt decrypts it. Packages exist for most Linux distributions, Homebrew, Scoop and Chocolatey, and binaries are on the releases page. The README documents every option, which is possible because there are so few.

Credit

age is written and maintained by Filippo Valsorda and contributors, and the format is specified in a public document. It is published under the BSD 3-Clause License. For the related task of running your own certificate authority, see the entry on step-ca.