123 lines
5.2 KiB
Markdown
123 lines
5.2 KiB
Markdown
---
|
|
obj: application
|
|
repo: https://github.com/FiloSottile/age
|
|
source: https://age-encryption.org/v1
|
|
rev: 2025-01-09
|
|
---
|
|
|
|
# age
|
|
age is a simple, modern and secure file encryption tool, format, and Go library.
|
|
|
|
It features small explicit keys, no config options, and UNIX-style composability.
|
|
|
|
```sh
|
|
$ age-keygen -o key.txt
|
|
Public key: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
|
|
$ PUBLIC_KEY=$(age-keygen -y key.txt)
|
|
$ tar cvz ~/data | age -r $PUBLIC_KEY > data.tar.gz.age
|
|
$ age --decrypt -i key.txt data.tar.gz.age > data.tar.gz
|
|
```
|
|
|
|
## Usage
|
|
For the full documentation, read [the age(1) man page](https://filippo.io/age/age.1).
|
|
|
|
```
|
|
Usage:
|
|
age [--encrypt] (-r RECIPIENT | -R PATH)... [--armor] [-o OUTPUT] [INPUT]
|
|
age [--encrypt] --passphrase [--armor] [-o OUTPUT] [INPUT]
|
|
age --decrypt [-i PATH]... [-o OUTPUT] [INPUT]
|
|
|
|
Options:
|
|
-e, --encrypt Encrypt the input to the output. Default if omitted.
|
|
-d, --decrypt Decrypt the input to the output.
|
|
-o, --output OUTPUT Write the result to the file at path OUTPUT.
|
|
-a, --armor Encrypt to a PEM encoded format.
|
|
-p, --passphrase Encrypt with a passphrase.
|
|
-r, --recipient RECIPIENT Encrypt to the specified RECIPIENT. Can be repeated.
|
|
-R, --recipients-file PATH Encrypt to recipients listed at PATH. Can be repeated.
|
|
-i, --identity PATH Use the identity file at PATH. Can be repeated.
|
|
|
|
INPUT defaults to standard input, and OUTPUT defaults to standard output.
|
|
If OUTPUT exists, it will be overwritten.
|
|
|
|
RECIPIENT can be an age public key generated by age-keygen ("age1...")
|
|
or an SSH public key ("ssh-ed25519 AAAA...", "ssh-rsa AAAA...").
|
|
|
|
Recipient files contain one or more recipients, one per line. Empty lines
|
|
and lines starting with "#" are ignored as comments. "-" may be used to
|
|
read recipients from standard input.
|
|
|
|
Identity files contain one or more secret keys ("AGE-SECRET-KEY-1..."),
|
|
one per line, or an SSH key. Empty lines and lines starting with "#" are
|
|
ignored as comments. Passphrase encrypted age files can be used as
|
|
identity files. Multiple key files can be provided, and any unused ones
|
|
will be ignored. "-" may be used to read identities from standard input.
|
|
|
|
When --encrypt is specified explicitly, -i can also be used to encrypt to an
|
|
identity file symmetrically, instead or in addition to normal recipients.
|
|
```
|
|
|
|
### Multiple recipients
|
|
Files can be encrypted to multiple recipients by repeating `-r/--recipient`. Every recipient will be able to decrypt the file.
|
|
|
|
```
|
|
$ age -o example.jpg.age -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p \
|
|
-r age1lggyhqrw2nlhcxprm67z43rta597azn8gknawjehu9d9dl0jq3yqqvfafg example.jpg
|
|
```
|
|
|
|
#### Recipient files
|
|
Multiple recipients can also be listed one per line in one or more files passed with the `-R/--recipients-file` flag.
|
|
|
|
```
|
|
$ cat recipients.txt
|
|
# Alice
|
|
age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
|
|
# Bob
|
|
age1lggyhqrw2nlhcxprm67z43rta597azn8gknawjehu9d9dl0jq3yqqvfafg
|
|
$ age -R recipients.txt example.jpg > example.jpg.age
|
|
```
|
|
|
|
If the argument to `-R` (or `-i`) is `-`, the file is read from standard input.
|
|
|
|
### Passphrases
|
|
Files can be encrypted with a passphrase by using `-p/--passphrase`. By default age will automatically generate a secure passphrase. Passphrase protected files are automatically detected at decrypt time.
|
|
|
|
```
|
|
$ age -p secrets.txt > secrets.txt.age
|
|
Enter passphrase (leave empty to autogenerate a secure one):
|
|
Using the autogenerated passphrase "release-response-step-brand-wrap-ankle-pair-unusual-sword-train".
|
|
$ age -d secrets.txt.age > secrets.txt
|
|
Enter passphrase:
|
|
```
|
|
|
|
### Passphrase-protected key files
|
|
If an identity file passed to `-i` is a passphrase encrypted age file, it will be automatically decrypted.
|
|
|
|
```
|
|
$ age-keygen | age -p > key.age
|
|
Public key: age1yhm4gctwfmrpz87tdslm550wrx6m79y9f2hdzt0lndjnehwj0ukqrjpyx5
|
|
Enter passphrase (leave empty to autogenerate a secure one):
|
|
Using the autogenerated passphrase "hip-roast-boring-snake-mention-east-wasp-honey-input-actress".
|
|
$ age -r age1yhm4gctwfmrpz87tdslm550wrx6m79y9f2hdzt0lndjnehwj0ukqrjpyx5 secrets.txt > secrets.txt.age
|
|
$ age -d -i key.age secrets.txt.age > secrets.txt
|
|
Enter passphrase for identity file "key.age":
|
|
```
|
|
|
|
Passphrase-protected identity files are not necessary for most use cases, where access to the encrypted identity file implies access to the whole system. However, they can be useful if the identity file is stored remotely.
|
|
|
|
### SSH keys
|
|
As a convenience feature, age also supports encrypting to `ssh-rsa` and `ssh-ed25519` SSH public keys, and decrypting with the respective private key file. (`ssh-agent` is not supported.)
|
|
|
|
```
|
|
$ age -R ~/.ssh/id_ed25519.pub example.jpg > example.jpg.age
|
|
$ age -d -i ~/.ssh/id_ed25519 example.jpg.age > example.jpg
|
|
```
|
|
|
|
Note that SSH key support employs more complex cryptography, and embeds a public key tag in the encrypted file, making it possible to track files that are encrypted to a specific public key.
|
|
|
|
#### Encrypting to a GitHub user
|
|
Combining SSH key support and `-R`, you can easily encrypt a file to the SSH keys listed on a GitHub profile.
|
|
|
|
```
|
|
$ curl https://github.com/benjojo.keys | age -R - example.jpg > example.jpg.age
|
|
```
|