How to Install and Use age in Linux for Simple and Modern File Encryption

For decades, GNU Privacy Guard (GPG) has served as the default standard for command-line file encryption across Unix environments. However, GPG’s Byzantine configuration syntax, complex key servers, bloated feature set, and susceptibility to user error have frustrated developers and system administrators alike. In response, modern cryptographers developed age—a simple, secure, and modern encryption tool designed by Filippo Valsorda.

Featuring small explicit keys, robust cryptographic primitives (X25519, ChaCha20-Poly1305), full UNIX composability, and zero config files, age makes encrypting files as straightforward as running a standard pipeline. Here is a practical tutorial on how to install age across Linux distributions, generate keypairs, and encrypt confidential documents.

Why age Outperforms Legacy Encryption Tools

age replaces legacy complexity with sensible cryptographic defaults:

• Modern Cryptography: Implements modern elliptic curves (X25519), Ed25519 identities, and authenticated encryption via ChaCha20-Poly1305.
• No Config Files: Completely stateless operation; there are no hidden ~/.gnupg trust databases to maintain or corrupt.
• Compact Public Keys: Public keys are short, readable strings (starting with age1...) that fit easily on a single line or inside deployment playbooks.
• SSH Key Compatibility: Can encrypt directly to existing SSH public keys (such as ~/.ssh/id_ed25519.pub), streamlining DevOps access control.

Installing age on Linux Distributions

age is packaged across major distribution repositories and as pre-built binaries.

Method 1: Ubuntu and Debian

On modern Ubuntu (22.04 LTS and newer) and Debian:

sudo apt update
sudo apt install age -y
age --version

Method 2: Arch Linux and Fedora

On Arch Linux:

sudo pacman -S age

On Fedora Linux:

sudo dnf install age -y

Method 3: Direct Standalone Binary

To acquire the latest official static binary:

curl -LO https://github.com/FiloSottile/age/releases/latest/download/age-v1.2.0-linux-amd64.tar.gz
tar -xvf age-v1.2.0-linux-amd64.tar.gz
sudo install age/age age/age-keygen /usr/local/bin/
rm -rf age-v1.2.0-linux-amd64.tar.gz age/

Method 1: Encrypting with a Passphrase

The simplest way to protect a backup archive or confidential document is using a passphrase:

1. To encrypt a file with passphrase protection, use the -p flag:

   age -p -o database_backup.sql.age database_backup.sql

2. Enter and confirm your chosen passphrase when prompted.
3. To decrypt the encrypted payload back to plaintext:

   age -d -o database_backup.sql database_backup.sql.age

Method 2: Asymmetric Encryption with Keypairs

For automated pipelines or team access, asymmetric public/private keys eliminate the risk of sharing passwords:

1. Generate a new age identity (private key) and save it securely:

   age-keygen -o key.txt

2. Inspect the generated public key:

   cat key.txt | grep "public key"

   The output resembles: # public key: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p

3. Encrypt a document using the recipient’s public key (using the -r recipient flag):

   age -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p -o financial_report.pdf.age financial_report.pdf

4. The recipient decrypts the file using their private identity key file (using -i):

   age -d -i key.txt -o financial_report.pdf financial_report.pdf.age

Operation	age Command Syntax	Use Case
Passphrase Encryption	age -p -o secret.age secret.txt	Quick personal archives and USB flash drive backups
Recipient Encryption	age -r age1... -o data.age data.tar	Securely sending files to team members or servers
SSH Key Encryption	age -R ~/.ssh/id_ed25519.pub file	DevOps CI/CD pipelines and Ansible vaults
Standard Input Stream	tar czf - ./dir | age -p > dir.tar.gz.age	Direct pipe encryption without intermediate disk writes

Encrypting Directly with SSH Keys

One of age’s most compelling features is native support for standard OpenSSH public keys:

age -R ~/.ssh/id_ed25519.pub -o production_secret.env.age production_secret.env

Decrypting uses your local SSH private key:

age -d -i ~/.ssh/id_ed25519 -o production_secret.env production_secret.env.age