age Usage Guide: Encrypt Team Secret Files with Recipients and Decrypt with Private Keys

Fri, 01 May 2026 22:57:00 +0000

Overview

age is a tool for simple file encryption/decryption based on public keys (Recipients).

The output is typically saved as *.age files, and private keys are kept only locally.

Store sensitive configuration files in a team without sharing them in plaintext
Anyone with the recipient (public key) list can encrypt, and only those with the private key can decrypt
The workflow is simple enough to easily integrate with CI/scripts

Key Distribution/Discovery
- GPG: There is a culture of uploading public keys to key servers for search and verification
- age: The key server model is not common; recipients are often managed in a file like recipients.txt within the project
Feature Scope
- GPG: Wide range of features including signing, web of trust, email encryption, etc.
- age: Focused on file encryption (simplicity is the advantage)
Team Operations
- age: Adding/removing team member public keys in a recipients file is intuitive in practice

:lock: Never upload private key files (age-key) to remote repositories. Use CI Secrets or a separate secret store when needed.