Securely encrypt files with age – The modern alternative to PGP

Securely encrypt files with age – The modern alternative to PGP

If you want to send confidential files, you often first think of PGP. However, there is now a modern encryption tool called age that is much easier to use while still relying on current cryptography.

In this tutorial, I will show you step by step how to create a key pair, receive encrypted files, and encrypt files for others yourself.

What is age?

age is a free open-source program for file encryption.

Unlike PGP, age deliberately foregoes many complex functions and focuses on the essentials:

• Easy to use
• Modern cryptography
• Small keys
• No key servers
• No complicated key management

This makes age excellent for private use, but also for whistleblower systems or secure document exchange.

Installation

Debian / Ubuntu / Linux Mint

1

sudo apt install age

Fedora

1

sudo dnf install age

Arch Linux

1

sudo pacman -S age

Next, you can check if the installation was successful:

1

age --version

Generate a key pair

A key pair consists of:

• a private key (keep secret!)
• a public key (can be published)

It is created with:

1

age-keygen -o key.txt

The content looks approximately like this:

1
2
3

# created: 2026-08-02T08:30:00Z
# public key: age1abcxyz123456789...
AGE-SECRET-KEY-1XXXXXXXXXXXXXXXXXXXXXXXXXXXX

The public key always starts with:

1

age1...

The private key always starts with:

1

AGE-SECRET-KEY-1...

Important: Store the private key securely. Whoever possesses it can decrypt all files encrypted for you.

Publish the public key

You can publish the public key on your website, for example:

1

age1abcxyz123456789...

Anyone can use it to encrypt files for you. The public key does not allow decryption of the data.

Encrypt a file for a recipient

If someone has given you their public key, you encrypt a file like this:

1
2
3
4

age \
-r age1abcxyz123456789... \
-o geheim.pdf.age \
geheim.pdf

An encrypted file is created:

1

geheim.pdf.age

Only the owner of the matching private key can open this file again.

Decrypt a file

To decrypt, the private key is required:

1
2
3
4

age -d \
-i key.txt \
-o geheim.pdf \
geheim.pdf.age

Subsequently, the original file lies unencrypted again.

Encrypt for multiple recipients

One of age’s greatest strengths is support for multiple recipients.

1
2
3
4
5
6

age \
-r age1Alice... \
-r age1Bob... \
-r age1Christian... \
-o bericht.age \
bericht.pdf

Still, only a single encrypted file is created.

Each of the specified recipients can decrypt this file with their own private key.

Practical example: Whistleblower

You publish your public key on your website:

1

age1abcdefghijk...

A whistleblower encrypts their documents:

1
2
3
4

age \
-r age1abcdefghijk... \
-o hinweis.zip.age \
hinweis.zip

They then send you only the file:

1

hinweis.zip.age

You decrypt it with your private key:

1
2
3
4

age -d \
-i key.txt \
-o hinweis.zip \
hinweis.zip.age

The whistleblower never needs your private key.

Encrypt files with a password

If no keys are to be used, age can also work with passwords.

Encrypt file:

1
2
3

age -p \
-o geheim.age \
geheim.pdf

Decrypt file:

1

age -d geheim.age

In both cases, a password is requested.

Advantages over PGP

Security tips

• Publish only your public key.
• Never give away your private key.
• Create an encrypted backup of your private key.
• Use multiple secure storage locations for backups.
• Regularly test whether you can still use your private key.

Conclusion

With age, files can be encrypted quickly, securely, and simply. The software deliberately focuses on pure file encryption and avoids the complexity of classic PGP solutions.

Especially for Linux users, open-source projects, or secure exchange of sensitive documents, age is an excellent choice. Whoever publishes their public key can receive encrypted files at any time – without having to exchange passwords and without additional infrastructure.