age — simple file encryption tool

💬 "age Command"

age is an easy-to-use file encryption tool. It is a file encryption tool with usage that is extremely simple compared to GnuPG.

It encrypts directly with an SSH public key (no need to generate a GPG key). It has no dependencies as a single binary.

• Concept: Encrypts directly with an SSH public key (no need to generate a GPG key).
• Main Feature: It has no dependencies as a single binary.
• Advantage: Supports various key types like X25519, SSH, and YubiKey.
• Usage: Usage is much simpler compared to GPG.

Installation and Download

age is installed via a package manager or the official script.

Verify the installation using age --version.

Commonly Used Options

3 Essential Command Combinations

• age -r age1... file.txt > file.txt.age — Encrypt with a public key
• age -d -i key.txt file.txt.age > file.txt — Decrypt with a private key
• age -r $(cat ~/.ssh/id_ed25519.pub) secrets.env — Use an SSH public key

💬 "Show me an example of using age on a real server"

Here is a step-by-step guide for common situations encountered on a live production server.

Step 1 · Key Generation

Generate an age key pair.

age-keygen -o key.txt

Step 2 · Encryption

Encrypt a file with a public key.

age -r age1... secrets.env > secrets.env.age

Step 3 · Decryption Verification

Decrypt with the private key.

age -d -i key.txt secrets.env.age

Actual Execution Output

This is the result of generating an age key and encrypting a file with a public key.

!age command execution result

Live production server

How It's Used in Practice

1. Backup Encryption with SSH Key

Situation — Encrypt a file with an SSH public key.

age -r $(cat ~/.ssh/id_ed25519.pub) secrets.env > secrets.env.age

Result — The secrets.env.age file is created.

Key Point — Encryption is done directly with the SSH key, so no GPG key generation is needed.

2. Decryption on a Remote Server

Situation — Decrypt an encrypted file remotely.

scp secrets.env.age root@backup:/backups/
ssh backup 'age -d -i /root/key.txt /backups/secrets.env.age > /backups/secrets.env'

Result — Decryption is completed on the remote server.

Key Point — The private key is stored only on the remote server.

Actual Execution Output

This is the result of decrypting with age on a remote server.

!age command execution result 2

Live production server

Important Notes

• Never commit the private key (key.txt) to git. This would nullify the encryption.
• Lost key = lost data. Backing up the private key is essential.
• age also supports symmetric encryption (passphrase), but the public key method is superior in terms of reusability and manageability.

Source (HTML): https://games.aidebatehub.com/programs/linux/security/age.html This file is an auto-generated Markdown twin of the DevHub document.