Age

lastmod 2026-02-20created 2026-02-193 edits

age (Actually Good Encryption) is a modern file encryption tool developed by FiloSottile, designed to replace the complexity of GPG. It features a simple CLI and a clear key format, and can encrypt with native keys or SSH keys. It is also the recommended key backend for sops.

Key features

A simple, modern, and secure file encryption tool, format, and Go library
Features small explicit keys, no config options, and UNIX-style composability
Also supports hardware PIV tokens such as YubiKeys through plugins
- Various other plugins exist : Apple Secure Enclave, TPM, FIDO, SSS, Trezor Hardware Wallet,..
Implementations in various languages : Go, Rust, TypeScript, Java, WASM, Elixir, Dart, etc.
Provides binaries for macOS, Linux, FreeBSD, and Windows
The format is public age-encryption.org/v1
Simple design - no config files, minimal options, intuitive key format
SSH key compatible - encrypt/decrypt directly with existing ~/.ssh/id_ed25519, ~/.ssh/id_rsa
Multiple recipients - encrypt to several public keys at once (repeat the -r flag)
Passphrase mode - encrypt with only a passphrase, without keys (-p flag)
Stream encryption - pipeline-friendly, supports stdin/stdout

Key format

# 공개키 (Public Key) — 공유 가능
age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p

# 개인키 (Secret Key) — 절대 비공개
AGE-SECRET-KEY-1QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ

Unlike GPG, there are no complex concepts such as key servers, a trust model (Web of Trust), expiration dates, or subkeys.

Installation

# Linux
sudo apt install age
# 또는
curl -LO https://github.com/FiloSottile/age/releases/download/v1.2.1/age-v1.2.1-linux-amd64.tar.gz

# macOS
brew install age

# Docker (멀티스테이지 빌드에서 복사)
COPY --from=ghcr.io/FiloSottile/age:latest /age /usr/local/bin/age

Key generation

# age 네이티브 키 생성
age-keygen -o ~/.sops/age-key.txt
# Public key: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p

# 공개키만 추출
age-keygen -y ~/.sops/age-key.txt > ~/.sops/age-key.pub

Basic usage

# age 키로 암호화
age -r age1ql3z7hjy54pw3h... -o secret.age secret.txt

# 복호화
age -d -i ~/.sops/age-key.txt -o secret.txt secret.age

# SSH 공개키로 암호화 (별도 age 키 불필요)
age -R ~/.ssh/id_ed25519.pub -o secret.age secret.txt

# SSH 개인키로 복호화
age -d -i ~/.ssh/id_ed25519 -o secret.txt secret.age

# 패스프레이즈 모드 (키 파일 없이)
age -p -o secret.age secret.txt

# 다중 수신자
age -r age1xxx... -r age1yyy... -o secret.age secret.txt

# 파이프라인
cat secret.txt | age -r age1xxx... | base64 > encrypted.b64
echo "hello" | age -r age1xxx... | age -d -i key.txt

Comparison with GPG

Item	GPG	age
Key generation	`gpg --full-generate-key` (interactive, complex)	`age-keygen` (one line)
Key format	Keyring binary (pubring.kbx)	Plain text file
Key management	Subkeys, expiration dates, trust model, key servers	None (only manage public/private key files)
SSH key compatibility	❌ (can be worked around with gpg-agent)	✅ Native support
Signing	✅	❌ (encryption only; minisign recommended for signing)
Config files	Many, such as `~/.gnupg/gpg.conf`	None

Using in Docker containers

# age 키 파일만 마운트하면 동작
docker run --rm \
  -v ~/.sops/age-key.txt:/run/age-key.txt:ro \
  -v $(pwd):/work \
  myapp age -d -i /run/age-key.txt -o /work/secret.txt /work/secret.age

Python integration

import subprocess

def age_encrypt(data: bytes, recipient: str) -> bytes:
    """age로 데이터 암호화 / Encrypt data with age"""
    result = subprocess.run(
        ["age", "-r", recipient],
        input=data, capture_output=True, check=True
    )
    return result.stdout

def age_decrypt(data: bytes, key_file: str) -> bytes:
    """age로 데이터 복호화 / Decrypt data with age"""
    result = subprocess.run(
        ["age", "-d", "-i", key_file],
        input=data, capture_output=True, check=True
    )
    return result.stdout

Favorite site

GitHub — FiloSottile/age — Official repository
age-encryption.org — Official site and spec documents
rage — Rust implementation of age
pyrage — Native Python age library (no subprocess needed)

author Zer0 sitemap

Age