age decrypt
Decrypt a file produced by age encrypt (or the real age CLI), with the matching identity or passphrase, on your device.
age decrypt reverses age encrypt, reading an AGE-SECRET-KEY identity or a shared passphrase and restoring the file, named by dropping the .age suffix or adding .dec. Passphrase mode ignores every identity line. A wrong identity, a wrong passphrase, and a file that was never age-encrypted all produce the exact same decryption-failed error, with no clue which one went wrong.
Questions
What can I decrypt with?
Either one or more AGE-SECRET-KEY identities, one per line, in identity mode, or the shared passphrase used to encrypt, in passphrase mode. The two modes cannot mix.
Why did I get "decryption failed"?
It covers three separate causes with one message: a wrong identity, a wrong passphrase, or a file that was never age-encrypted at all. The tool does not distinguish between them.
How is the output named?
By dropping the .age suffix if the file has one, or by adding .dec otherwise.
What if I leave the identity box blank?
The tool refuses with "mode=identity needs at least one AGE-SECRET-KEY-1... identity, one per line".
Can I use this from the command line?
Yes, the same code runs on the page, the CLI and MCP.