# age

> File encryption tool with small explicit keys, post-quantum support, and UNIX-style composability.

Stars: 24.2k · Language: Go · License: BSD-3-Clause · Categories: System

- Repository: https://github.com/FiloSottile/age
- Website: https://age-encryption.org
- Page: https://www.trmn.sh/tools/age
- Demo video: https://media.trmn.sh/demos/95def9d5f2461f5318fd393f2627c89a7718110dbed88729f21e9351e6290ff8.mp4

## Install

- Homebrew: `brew install age`
- APT: `apt install age`
- Go: `go install filippo.io/age/cmd/...@latest`

## Overview

age is a file encryption tool that uses small explicit keys and follows UNIX composition principles. It generates compact public keys (age1...) and encrypts files using the ChaCha20-Poly1305 algorithm. The tool supports multiple recipients, allowing files to be encrypted to several public keys simultaneously using the -r flag or recipient files with -R.

The tool includes post-quantum cryptographic support through hybrid keys that combine traditional elliptic curve cryptography with post-quantum algorithms like ML-KEM-768. Post-quantum keys use the age1pq1... format and provide protection against future quantum computer attacks. Files encrypted with post-quantum keys are compatible across age implementations that support the plugin system.

age integrates with existing SSH infrastructure by accepting ssh-rsa and ssh-ed25519 public keys as recipients. This allows encrypting files directly to SSH keys from GitHub profiles or local ~/.ssh directories. The tool also supports passphrase-based encryption with automatic secure passphrase generation, and can use passphrase-protected identity files for scenarios where the key file itself needs protection. The age-inspect command provides metadata analysis of encrypted files without decryption, showing recipient types, post-quantum usage, and size breakdowns.

### Installation

```bash
# via Homebrew
brew install age
```

```bash
# via APT
apt install age
```

```bash
# via Go
go install filippo.io/age/cmd/...@latest
```

## Alternatives

- [witr](https://www.trmn.sh/tools/witr.md): Traces a process, port, container, or file back to the chain of supervisors, services, and shells that started it. Offers CLI, JSON output, and a TUI. (Go, 22.9k stars)
- [chezmoi](https://www.trmn.sh/tools/chezmoi.md): Dotfile manager that keeps a source state, previews changes with diff, and applies configuration across machines using templates. (Go, 22.1k stars)
- [ctop](https://www.trmn.sh/tools/ctop.md): Top-like interface for monitoring Docker and runC container metrics in real-time (Go, 17.8k stars)
- [duf](https://www.trmn.sh/tools/duf.md): Disk usage utility with colorful output, filtering, and JSON export - replacement for df command (Go, 15.4k stars)
- [Kopia](https://www.trmn.sh/tools/kopia.md): Cross-platform backup tool that creates encrypted, compressed, deduplicated snapshots and stores them on cloud, network, or local storage. Includes CLI and GUI. (Go, 14.6k stars)

## Guides

- [Encrypt files with age](https://www.trmn.sh/guides/encrypt-files-with-age): Encrypt files with age: generate a key, encrypt to one or more recipients or SSH keys, use a passphrase, and encrypt whole directories through tar.
- [Best CLI Tools for Encrypting Files and Configuration](https://www.trmn.sh/best/file-encryption-tools): Compare age, sops, git-crypt: workflows, strengths and tradeoffs.

---

Canonical: https://www.trmn.sh/tools/age