How to Install and Use age in Linux for Modern Command-Line File Encryption

Modern system administration and DevOps workflows frequently require encrypting configuration files, database backups, and private credentials before sharing or storing them across untrusted networks. While GNU Privacy Guard (GPG) has historically served as the Unix standard for cryptographic tasks, its extensive feature set, complex keyring management, and legacy cipher configurations can prove unwieldy for everyday scripting. The age tool (Actually Good Encryption), developed by Filippo Valsorda, provides an elegant, modern alternative featuring small explicit keys, no complex configuration files, and UNIX-style composability with standard input and output streams.

What Is age and How Does It Function?

The age utility is a simple, modern, and secure file encryption tool designed with robust cryptography defaults, including ChaCha20-Poly1305 authenticated encryption and X25519 elliptic-curve key exchange. Key characteristics include:

• Streamlined Key Format: Public keys (recipients) begin with age1..., and private keys (identities) begin with AGE-SECRET-KEY-1....
• Passphrase Protection: Native support for scrypt-based password encryption with memory-hard key derivation to resist brute-force attempts.
• Multiple Recipients: A single file can be encrypted simultaneously to multiple public keys or SSH keys without re-encrypting the payload data.
• SSH Key Compatibility: The ability to encrypt files directly to existing public OpenSSH keys (ssh-ed25519 and ssh-rsa).

Step 1: Install age on Your Linux Distribution

The age suite consists of two distinct binaries: age (for encryption and decryption) and age-keygen (for generating cryptographic key pairs). Install the packages using your distribution’s package manager:

On Ubuntu and Debian (22.04 LTS and Newer)

sudo apt update
sudo apt install age -y

On Fedora, RHEL, and Rocky Linux

sudo dnf install age -y

On Arch Linux and Manjaro

sudo pacman -S age

Verify the Installation

Confirm that both utilities are accessible in your environment path:

age --version
age-keygen --version

Step 2: Generate an age Key Pair

While passphrase-based encryption is useful for quick ad-hoc tasks, automated and multi-user workflows require asymmetric key pairs. Use age-keygen to create a new key pair and store the identity in a secure directory with restricted filesystem permissions:

# Create a secure directory for cryptographic keys
mkdir -p ~/.config/age
chmod 700 ~/.config/age

# Generate the key pair and redirect output to a file
age-keygen -o ~/.config/age/key.txt
chmod 600 ~/.config/age/key.txt

Inspect the generated key file to identify the public recipient address and private secret key:

cat ~/.config/age/key.txt

The output includes your public key in the commented header line, formatted as follows:

# created: 2026-10-14T10:00:00Z
# public key: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5wh98qqsq9ecc
AGE-SECRET-KEY-1QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ

Step 3: Encrypt and Decrypt Files Using Asymmetric Keys

To encrypt a file for a specific recipient, use the -r (recipient) flag followed by the public key string or a file containing recipient keys:

# Encrypt a secret archive for a recipient
age -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5wh98qqsq9ecc -o backup.tar.gz.age backup.tar.gz

To decrypt the encrypted file, invoke age with the -d (decrypt) flag and point the -i (identity) option to your private key file:

# Decrypt the file back to plaintext
age -d -i ~/.config/age/key.txt -o backup-restored.tar.gz backup.tar.gz.age

Step 4: Encrypt Files Using Passphrase Protection

When sharing sensitive data with individuals who do not possess an age key pair, symmetric passphrase encryption provides robust protection:

# Encrypt a document with an interactive password prompt
age -p -o database-dump.sql.age database-dump.sql

Terminal output prompts you to enter and confirm your chosen password. To decrypt a passphrase-protected file, simply pass the -d flag without an identity file:

age -d -o database-dump.sql database-dump.sql.age

Step 5: Encrypt to Multiple Recipients and SSH Public Keys

A major operational advantage of age is its ability to encrypt to multiple public keys in a single pass. You can supply multiple -r arguments or point to an external recipients text file:

# Encrypt for multiple team members simultaneously
age -r age1recipientA... -r age1recipientB... -o audit.log.age audit.log

# Alternatively, encrypt using an OpenSSH public key
age -R ~/.ssh/id_ed25519.pub -o secrets.env.age secrets.env

Any individual holding the private key corresponding to either recipient public key or the SSH key can decrypt the file seamlessly.

Step 6: Integrate age into UNIX Shell Pipelines

Because age reads standard input and writes standard output by default when output files are omitted, you can integrate encryption directly into streaming backup commands without writing intermediate unencrypted data to disk:

# Stream a compressed directory directly into an encrypted file
tar -czf - /var/www/html | age -r age1ql3z7hjy... > site-backup.tar.gz.age

# Decrypt and unpack the archive in a single pipeline
age -d -i ~/.config/age/key.txt site-backup.tar.gz.age | tar -xzf - -C /restore/path/

Verifying File Integrity and Key Management Practices

Unlike unauthenticated encryption tools, age enforces AEAD (Authenticated Encryption with Associated Data). If an encrypted file is tampered with or corrupted in transit, decryption will fail immediately with an authentication error, guaranteeing that partial or modified ciphertexts are never processed by downstream applications. Store your master identity files on offline drives or hardware tokens, and distribute recipient public keys freely across your automation playbooks.