Cover image showing the flow of encrypting a team’s secret file with age using public keys (recipients) and decrypting it with a private key

Overview

What is age?

age is a tool for simple file encryption/decryption based on public keys (Recipients).

The output is typically saved as *.age files, and private keys are kept only locally.

Problems age Solves

  • Store sensitive configuration files in a team without sharing them in plaintext
  • Anyone with the recipient (public key) list can encrypt, and only those with the private key can decrypt
  • The workflow is simple enough to easily integrate with CI/scripts

Differences from GPG (Brief)

  • Key Distribution/Discovery
    • GPG: There is a culture of uploading public keys to key servers for search and verification
    • age: The key server model is not common; recipients are often managed in a file like recipients.txt within the project
  • Feature Scope
    • GPG: Wide range of features including signing, web of trust, email encryption, etc.
    • age: Focused on file encryption (simplicity is the advantage)
  • Team Operations
    • age: Adding/removing team member public keys in a recipients file is intuitive in practice

:lock: Never upload private key files (age-key) to remote repositories. Use CI Secrets or a separate secret store when needed.

Installation

macOS

1# Homebrew
2brew install age

Linux

 1# RHEL/CentOS/Amazon Linux
 2sudo yum install age
 3
 4# Debian/Ubuntu
 5# sudo apt install age
 6
 7# Fedora
 8# sudo dnf install age
 9
10# Arch
11# sudo pacman -S age

Windows

1winget install FiloSottile.age
2# Chocolatey: choco install age

Basic Usage Flow

1) Key Generation (Create a Private Key File)

It is recommended to create the key under the user directory.

1age-keygen -o ~/.config/age/key.txt
  • macOS / Linux: ~/.config/age/key.txt
  • Windows: %USERPROFILE%\.config\age\key.txt
1chmod 600 ~/.config/age/key.txt

3) Display the Public Key (Recipient)

1age-keygen -y ~/.config/age/key.txt

Team Sharing Method (The Concept of “Registering” Public Keys)

age typically shares a recipient list file within the project rather than “registering on a key server”.

:technologist: In practice, it works like this.

  1. Each team member adds their public key to the recipients file.
  2. When someone encrypts a secret file, they encrypt it with the public keys in recipients. Then anyone included in recipients can decrypt it with their own private key.
  3. Following the principle of least privilege, only those who need to read the secret are included in recipients.
  4. If someone is removed from recipients, existing *.age files remain as-is, so access is not automatically revoked. After modifying recipients, re-encrypt the files to apply the change.
  5. Therefore, in environments where team members or keys change frequently, re-encryption can be cumbersome.

Recipients File Example

Example: .age/recipients.txt

  • One public key per line
  • Multiple people means multiple lines
1age1xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2age1yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy

Encryption example (specifying recipients via file)

1age -R .age/recipients.txt -o secrets.env.age secrets.env

Decryption example (decrypt with private key)

1age -d -i ~/.config/age/key.txt -o secrets.env secrets.env.age

:white_check_mark: Summary: “Where do I register my public key?” is usually resolved by adding it to the recipients file in the repository.