Local file encryption

How to use it

1. Drop a file in, click to choose one, or paste some text into the box below. The tool reads the start to decide: an age file or an age text file gets decrypted, anything else gets encrypted.
2. Type a passphrase. When encrypting, "Draw a passphrase" picks six words from the Asian Diceware list. Write it down. It is gone when you close the page.
3. Press "Encrypt and download". The page decrypts the output again with the same passphrase and checks it against the original before offering the download. The file name is the original with .age added. Decrypting removes the .age. In a slow environment the page shows an estimate first and lets you decide. If you go on, the check pass is skipped.

The output is a standard age file. Any computer with the command-line tool opens it, without this site:

age -d -o backup.tar backup.tar.age

What age is, what the format looks like and how it differs from PGP are on What is age?.

For what the whole path looks like, see handing a list to an outside partner and a file from a source.

Across devices, through your password manager

Paste text to encrypt, or tick "Output as text" when encrypting a file, and you get plain text starting with -----BEGIN AGE ENCRYPTED FILE-----. Store it together with the passphrase in the password manager you already use (a secure note in Bitwarden, Proton Pass or 1Password all work). Open this page on another device, paste it back, type the passphrase, and it decrypts. Your manager does the syncing. This site stores nothing. The downloaded .age file is an ordinary file; any cloud drive will hold it, with the passphrase kept elsewhere.

Saved to a file, the text form is still a standard age file and the command-line tool recognises it on its own:

age -d -o note.txt note.txt.age

The text form is a third larger than the binary, so files over 64 KB only get the binary download. Password manager notes rarely hold more than that anyway.

Using a passkey as the key

Switch the key to "Passkey" when encrypting and there is no passphrase to remember. The browser shows a prompt, you approve once with a fingerprint or PIN, and the file is encrypted to your passkey. Before the first use, go to Passkey as your key to create one and generate a backup key. "Also add a backup key" is ticked by default, and that public key goes in the field below. If the passkey is lost or you move to an unsupported environment, only the backup secret opens the file. Untick it when your situation does not need that way out, and the cost is spelled out on screen. When decrypting, the tool reads the header to decide whether to ask for a passphrase, the passkey or the backup secret. Files encrypted with the age command line to an age1 public key can be opened here by pasting the secret. Files in passkey mode only open on this site. The reasons are on What is a passkey?. Whether this environment can derive the key, check first with "Test an unlock" on the key page.

Under the backup key and recipient fields there is an address book: give a frequently used age1 public key a name and it is kept in your passkey-encrypted stash, the same ciphertext as my preparation checklist. Next time, pick one and it fills the field. Saving and deleting both take a deliberate press. The list itself is a record of who you correspond with; like the checklist it lives in the stash, and its security equals the password manager's.

Encrypting to someone else's public key

Switch the key to "Public keys" and list recipients one per line. Both X25519 keys starting with age1 and post-quantum hybrid keys starting with age1pq1 are accepted, and each recipient opens the file with their own secret key. Add your own public key as a line if you want to open it too. If you have no key yet, press "Generate a key": the public key is added to the recipients and the secret key can only be downloaded as key.txt. This page keeps nothing; close it and the key is gone. The file has the same format as age-keygen on the command line, so the two are interchangeable.

After encrypting, the tool checks that the number of header stanzas matches the number of recipients; that is a count only, and a mistyped public key passes it. If the key just generated is among the recipients, it also decrypts the output with it and compares. With other people's public keys alone there is nothing local to decrypt with, so send a test file and have the recipient confirm it opens before sending the real one.

When a file's header has only public-key stanzas, the tool asks for a secret key: paste it into the field, pick key.txt, or drop key.txt onto the drop zone.

The passphrase is everything

Passphrase mode has no keys to manage, at the cost that the strength of the encryption is exactly the strength of the passphrase. scrypt makes every guess cost a fraction of a second, which holds against brute force but not against a guessable passphrase. Six words or more, not a quote or a lyric, never used elsewhere. The reasoning is in Asian Diceware. Nobody can recover a forgotten passphrase, so back up the passphrase too, on paper, somewhere other than where the backup is.

Things to keep in mind

• The whole file is processed in memory, and anything over 200 MB is refused up front. Split large backups, or use the command-line tool directly; installation is on What is age?.
• The file name is not inside the ciphertext. The output name is the original plus .age, visible to anyone. Give backups a name that gives nothing away.
• Files encrypted to a key (a public key starting with age1) cannot be opened here. That needs the private key and the command-line tool.
• The first use needs a connection to fetch the code. After that it stays on the device.
• Browsers with the JavaScript JIT off compute scrypt fifty times slower or more. One pass took 50 seconds on a desktop in testing. IronFox turns the JIT off by default (Settings, Security), and Tor Browser's Safer level does too. The tool measures first and shows an estimate. The page stays usable while it works.

Works offline

Like the rest of this section, the code stays on your device once stored and works without a network. That is the most direct proof that neither the file nor the passphrase was sent anywhere.

To take this page with you, see offline reading.