age encrypt
Encrypt a file with age, to one or more recipients or under a passphrase, on your device.
age encrypt wraps one file for one or more age1 recipients, or under a shared passphrase, and writes the result with .age added to the name. Switching mode to passphrase ignores the recipients box entirely. An invalid recipient line, or an empty passphrase, is refused before any byte is encrypted, and the file carries no hint of which key protects it.
Questions
What is the difference between recipients and passphrase mode?
Recipients mode encrypts to one or more age1... public keys you paste, one per line, so only the matching identities can decrypt it. Passphrase mode locks the file with a shared password instead, and the recipients box is ignored entirely.
What happens if I leave recipients blank?
The tool refuses with "mode=recipients needs at least one age1... recipient, one per line". A blank passphrase in passphrase mode is refused the same way.
How is the output file named?
The original name with .age appended, for example report.pdf becomes report.pdf.age.
What happens with an invalid recipient line?
The tool refuses and names exactly which line failed to parse as a valid age recipient, before anything is encrypted.
Can I use this from the command line?
Yes, the CLI and MCP surfaces run the same code as this page.
How do I decrypt the result?
Use age decrypt with the matching identity, for recipients mode, or the same passphrase, for passphrase mode.