23.6k stars · BSD-3-Clause · v1.3.2 (2026-08-29), read from /releases/latest; the bare date '29 Aug' is in the past, so it is 2026 · Track this in Scout
Locks one file with a single command using short text keys, and unlocks it with another, with no key ring and almost no options.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A file encryption tool with one job and almost no options. It uses short text keys instead of a key ring, it works as an ordinary command you can put in a pipe, and there is a Go library behind it for programs that need the same thing.What it is good for. Everybody who copies a file off their own machine. Edition 8 gave you restic (#11) for backups and Edition 18 gave you pgBackRest (#1) for the database, and both of those encrypt what they store. This is for everything else: the one-off database dump, the export you email to yourself, the secret file a script has to read on a server you do not fully trust. For Grasppy, a pg_dump encrypted before it leaves the Hetzner server is one extra command on the same line, and it is the cheapest safety on this page.
- Two commands and one key file. It is small enough that you will actually use it, which is the whole point.
- The keys are short lines of text, so you can keep one in a password manager and paste it when you need it.
- It also accepts an ordinary SSH key, so you may already have everything you need.
- If you lose the private key, the file is gone forever and nobody on earth can help you. Store the key somewhere separate from the encrypted files.
- It encrypts and does nothing else. There is no signing, no key server and no way to share with a group by name.
- The design is deliberately finished. If you need a feature it does not have, it will not be added, by choice.
- str4d/rage
The same file format and the same commands, written in Rust instead of Go, useful if you already build with Rust.
Track this in Scout - getsops/sops
Solves a nearby problem: it encrypts only the values inside a YAML or JSON settings file, so the file stays readable and reviewable in git.
Track this in Scout 
restic/resticEncrypts as part of a full backup program with snapshots and de-duplication, so it replaces age for backups and is far too heavy for one file.
Track this in Scout
# Debian or Ubuntu sudo apt install age # macOS brew install age # Make your key once. Keep the private key safe; the public key is printed. age-keygen -o ~/age-key.txt # Lock a file, using the public key that age-keygen printed: age -r age1qqq...yourpublickey -o dump.sql.age dump.sql # Unlock it again: age -d -i ~/age-key.txt -o dump.sql dump.sql.age # Or do it in one line, straight out of PostgreSQL: pg_dump yourdb | age -r age1qqq...yourpublickey > dump.sql.age
