Identity

Property	Value
Binary	`age`, `age-keygen`
Config	No persistent config — invoked directly
Logs	No persistent logs — output to terminal
Type	CLI tool
Install	`apt install age` / `dnf install age`

Key Operations

Task	Command
Generate a new keypair	`age-keygen -o ~/.age/key.txt`
Show public key from a key file	`age-keygen -y ~/.age/key.txt`
Encrypt a file to a recipient	`age -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac97 -o encrypted.age plaintext.txt`
Encrypt to self (using your own key file)	`age -R ~/.age/key.txt -o encrypted.age plaintext.txt`
Decrypt a file	`age -d -i ~/.age/key.txt -o plaintext.txt encrypted.age`
Encrypt with passphrase (interactive)	`age -p -o encrypted.age plaintext.txt`
Encrypt to multiple recipients	`age -r age1key1... -r age1key2... -o encrypted.age plaintext.txt`
Encrypt stdin, write to stdout	`echo "secret" \| age -r age1key... > encrypted.age`
Decrypt stdin, write to stdout	`age -d -i ~/.age/key.txt < encrypted.age`
ASCII armor output (base64 text)	`age -a -r age1key... -o encrypted.txt plaintext.txt`
Encrypt using an SSH public key	`age -R ~/.ssh/id_ed25519.pub -o encrypted.age plaintext.txt`
Decrypt using an SSH private key	`age -d -i ~/.ssh/id_ed25519 -o plaintext.txt encrypted.age`
Batch encrypt a directory	`tar czf - /path/to/dir \| age -r age1key... > backup.tar.gz.age`

Symptom	Cause	Fix
`age: error: no recipients specified`	Missing `-r` or `-R` flag	Add `-r age1...` for a public key or `-R keyfile` for a key file
`age: error: reading from stdin` with file input	Forgot to specify input file or pipe	Pass the file as the last positional argument, or pipe via stdin
Recipient public key starts with `ssh-ed25519`, not `age1`	Wrong key file — SSH public key format	Use `-R ~/.ssh/id_ed25519.pub` (capital R) for SSH pub key files
Decryption fails with "no identity matched"	Wrong key used for decryption	The file was encrypted to a different public key; use the matching private key
Passphrase decryption is very slow	scrypt KDF is intentionally slow	This is by design for brute-force resistance; wait for it
Binary output breaks terminal	age output is binary by default	Add `-a` for ASCII armor when the output needs to be text-safe
`age-keygen: command not found`	Packaged separately on some distros	Install the `age` package; `age-keygen` is usually included

No key management: age has no keyring, no key ID system, and no way to list which keys can decrypt a file. Store key files yourself (e.g., in ~/.age/) and document which keys encrypted which files.
-r takes the public key string, not a file: The public key (starting with age1...) is passed directly to -r. To read from a file of public keys (one per line), use -R keyfile (capital R).
SSH public keys work as recipients: Any ~/.ssh/id_ed25519.pub or ~/.ssh/id_rsa.pub can be used as an age recipient with -R. This is convenient for homelab use where you already manage SSH keys.
Passphrase mode uses scrypt: The slow KDF is intentional — it makes offline brute-forcing expensive. If decryption feels slow, it's working correctly. For automated workflows, use key-based encryption instead.
age is encryption-only, not signing: age provides confidentiality but not authentication or integrity verification beyond what encryption provides. For signed releases or verification, use minisign or ssh-keygen -Y sign.