age

What it is

age — a file-encryption CLI, format, and Go library. The catalog summary covers the feature set; what follows is the operational detail the page actually gives: exact key/encrypt/decrypt commands, the post-quantum workflow, passphrase behavior, and how to verify the binaries.

How it works

Keys are explicit files. age-keygen emits a secret key (AGE-SECRET-KEY-1...) and prints the public recipient (age1...). You encrypt to one or more recipients and decrypt with an identity file:

$ age-keygen -o key.txt
$ tar cvz ~/data | age -r age1ql3z7... > data.tar.gz.age
$ age --decrypt -i key.txt data.tar.gz.age > data.tar.gz

Multiple recipients: repeat -r, or list them one-per-line in a file passed with -R (lines starting # are comments). Every listed recipient can decrypt.

Post-quantum keys use hybrid crypto and a separate flag. Note the identities start AGE-SECRET-KEY-PQ-1..., recipients age1pq1..., and PQ recipients are ~2000 characters long:

$ age-keygen -pq -o key.txt
$ age-keygen -y key.txt > recipient.txt
$ age -R recipient.txt example.jpg > example.jpg.age
$ age -d -i key.txt example.jpg.age > example.jpg

Passphrase mode (-p) will autogenerate a secure passphrase by default if you leave the prompt empty; passphrase-protected files are auto-detected at decrypt time. An identity file can itself be a passphrase-encrypted age file, decrypted automatically on use. When --encrypt is explicit, -i can encrypt symmetrically to an identity file instead of/in addition to recipients.

Preconditions / Affected

PQ support is built into age v1.3.0 and later; for older versions or other implementations, install age-plugin-pq in $PATH — recipients work out of the box, but identities must be converted with age-plugin-pq -identity. SSH keys (ssh-ed25519, ssh-rsa) work directly as recipients/identities.

What to do

Install via pre-built binaries (Windows/Linux/macOS/FreeBSD) or from source:

go install filippo.io/age/cmd/...@latest

If you use the pre-built binaries, verify their Sigsum proofs (transparency-log proofs) rather than trusting the download blindly.

Caveats

• -pq "may become the default in the future" — the flag and key prefixes are current, not guaranteed stable defaults.
• The page text is cut off mid-sentence on passphrase-protected identity files, noting they are "not necessary for most use cases, where access to the encrypted identity file implies access to the" — treat encrypted-identity-at-rest protection as marginal, per the authors.
• If OUTPUT exists it is overwritten silently.