age

Files (1)

• SKILL.md

SKILL.md (first lines)

# age

Encrypt and decrypt files using the `age` tool.

## Orientation

Run the following commands before proceeding:

```bash
which -a age age-keygen
age --version
age-keygen --help
```

## Key Concepts

- **Recipient**: a public key (age or SSH) used to encrypt. Anyone with the matching private key can decrypt.
- **Identity**: a private key file (`-i`) used to decrypt.
- A file can have multiple recipients; any one matching identity can decrypt it.
- `age` and `age-keygen` are separate binaries; verify both are present.

## Workflow

1. Confirm the tool is present: `age --version`
2. Generate a key pair: `age-keygen -o key.txt` (prints public key to stderr; secret key goes to `key.txt`)
3. Extract just the public key: `age-keygen -y key.txt`
4. Encrypt to a recipient: `age -r <public-key> -o output.age input.txt`
5. Encrypt from stdin: `echo "secret" | age -r <public-key> > output.age`
6. Decrypt: `age -d -i key.txt -o output.txt input.age`
7. Decrypt from stdin: `age -d -i key.txt < output.age`

## Common Workflows

### Generate a key pair

```bash
# Generate and save to a file (public key printed to stderr)
age-keygen -o key.txt

# Print the public key only (useful for scripting)
age-keygen -y key.txt

# Generate a post-quantum hybrid key (ML-KEM-768 + X25519)
age-keygen -pq -o pq_key.txt
```

The key file format:
```
# created: 2026-01-01T00:00:00Z
# public key: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
AGE-SECRET-KEY-1...
```

### Encrypt to a single recipient

```bash
# From a file
age -r age1ql3z7... -o secret.age plaintext.txt

# From stdin
echo "my secret" | age -r age1ql3z7... > secret.age

# Armor (PEM output, safe for text/email embedding)
echo "my secret" | age -r age1ql3z7... --armor > secret.age.pem
```

### Encrypt to multiple recipients

```bash
# Inline — any recipient can decrypt
age -r age1alice... -r age1bob... -o secret.age plaintext.txt

# From a recipients file (one public key per line; # = comment)
age -R public-age-keys.txt -o secret.age plaintext.txt
```

Recipients file format:
```
# Alice
age1alice...
# Bob
age1bob...
```

### Decrypt

```bash
# To a file
age -d -i key.txt -o output.txt secret.age

# To stdout (pipe to consumer — avoids writing plaintext to disk)
age -d -i key.txt secret.age | some-command

# Multiple identity files (unused ones are silently ignored)
age -d -i key1.txt -i key2.txt secret.age
```

### Use SSH keys as recipients

`age` natively supports `ssh-ed25519` and `ssh-rsa` public keys as recipients.
`ecdsa-sha2-nistp256` and other types are **not supported** and produce an error.

```bash
# Encrypt to an SSH public key
age -r "$(cat ~/.ssh/id_ed25519.pub)" -o secret.age plaintext.txt

# Decrypt with the SSH private key
age -d -i ~/.ssh/id_ed25519 secret.age
```

### Pipe workflows (no files on disk)

```bash
# Encrypt a directory into a single encrypted archive, never touching disk
tar -czf - ~/data | age -r age1ql3z7... > backup.tar.gz.age

# Decrypt and extract directly
age -d -i key.txt backup.tar.gz.age | tar -xzf -
```

From jason-riddle/agent-skills, MIT.

More from jason-riddle/agent-skills