{"slug": "age", "name": "age", "category": "security", "category_name": "Security and passwords", "description": "A simple, modern command-line file encryption tool and format with small explicit keys.", "recommenders": 7, "commenters": 7, "warners": 0, "score": 5.965, "rising": -0.96, "first": "2025-11-13", "latest": "2026-10-21", "why": "Liked as a simpler drop-in replacement for GPG encryption, especially paired with SOPS for secrets in git and for reusing existing SSH keys.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 7, "neutral": 0, "compare": 0, "warn": 0}, "spark": [2, 2, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1], "listed": true, "loved": ["Simpler than GPG", "Works with SOPS"], "caveat": "No signing", "short_quote": "I love that age lets one reuse ssh identities and thus identity sharing systems.", "icon": true, "domain": null, "github_repo": "github.com/filosottile/age", "official_url": "https://age-encryption.org", "pricing": "open source", "aliases": ["age"], "verdict": [{"text": "Liked as a simpler drop-in replacement for GPG encryption", "cites": [{"id": 742490928, "item_id": 46405683, "url": "https://news.ycombinator.com/item?id=46405683", "by": "some_furry", "date": "2025-12-27", "stance": "recommend", "quote": "That's literally age.", "excerpt": "> I need an alternative to \"gpg --encrypt --armor --recipient <foo>\" That's literally age. https://github.com/FiloSottile/age", "context": "", "use_case": "file encryption", "switched_from": "", "story": "Gpg.fail"}, {"id": 734658160, "item_id": 45916135, "url": "https://news.ycombinator.com/item?id=45916135", "by": "networked", "date": "2025-11-13", "stance": "recommend", "quote": "I have also switched from GPG to age.", "excerpt": "> I'm now experimenting with `age`, which touts itself as \"simple, modern, and secure encryption\". If needed, I will use `minisign` for signatures. I have also switched from GPG to age. When I wanted to start signing my open-source software releases because of recent supply-chain attacks, I first thought of Minisign, too. I tried it for binaries and even found a few third-party Git integrations (https://codeberg.org/", "context": "open-source developer", "use_case": "file encryption", "switched_from": "GnuPG", "story": "Switching from GPG to Age"}, {"id": 802846291, "item_id": 50177893, "url": "https://news.ycombinator.com/item?id=50177893", "by": "LeBit", "date": "2026-10-21", "stance": "recommend", "quote": "A yubikey can hold an age key.", "excerpt": "I too use (multiple) yubikey to hold my private gpg keys. But I am not sure I will stick with gpg though. Even with my system to extend their expiration or renew them. I have found handling them to be a pain. I use them for 2 things: encrypt/decrypt gopass secrets and sign git commits. Gopass now has more than decent age support. A yubikey can hold an age key. Most git forges accept a ssh key to sign commits. A yubik", "context": "", "use_case": "encrypting secrets", "switched_from": "GnuPG", "story": "Setting Up SSH Keys on macOS with Touch ID"}]}, {"text": ", especially paired with SOPS for secrets in git and for reusing existing SSH keys.", "cites": [{"id": 771031553, "item_id": 48189472, "url": "https://news.ycombinator.com/item?id=48189472", "by": "epistasis", "date": "2026-05-18", "stance": "recommend", "quote": "It would be nice to use something like SOPS[1] + age right from the start", "excerpt": "Great timing, I was just getting frustrated about this today. I've got a pyinfra secrets.py and another project with an .env for logins for grabbing and moving data. I use LLMs on both of them extensively (having an LLM setup all my proxmox VMs and LXC containers and configure them without doing that yak shaving has been amazing.) It would be nice to use something like SOPS[1] + age right from the start, so I don't f", "context": "", "use_case": "secrets encryption", "switched_from": "", "story": "Sieve \u2013 scans Cursor/Claude chat history for leaked API keys"}, {"id": 746148145, "item_id": 46634259, "url": "https://news.ycombinator.com/item?id=46634259", "by": "geoffeg", "date": "2026-01-15", "stance": "recommend", "quote": "I use sops and age", "excerpt": "I use sops and age, originally loosely based on this article: https://devops.datenkollektiv.de/using-sops-with-age-and-git-like-a-pro.html I originally set up the git filters, but later disabled them.", "context": "", "use_case": "encryption for secrets", "switched_from": "", "story": "Bubblewrap: A nimble way to prevent agents from accessing your .env files"}, {"id": 735095424, "item_id": 45943464, "url": "https://news.ycombinator.com/item?id=45943464", "by": "tarasglek", "date": "2025-11-15", "stance": "recommend", "quote": "I love that age lets one reuse ssh identities and thus identity sharing systems.", "excerpt": "I love that age lets one reuse ssh identities and thus identity sharing systems. The single most useful thing I ever wrote was a tool to sync github identities with age. https://github.com/tarasglek/github-to-sops This way you get git for change tracking on your secrets and who-has-access-to-secrets and key rotation and this can be trivially expanded to other forges. Its easy to introduce age this way into any modern", "context": "", "use_case": "encrypting secrets", "switched_from": "GPG", "story": "Switching from GPG to Age"}, {"id": 739074864, "item_id": 46192179, "url": "https://news.ycombinator.com/item?id=46192179", "by": "mhitza", "date": "2025-12-08", "stance": "recommend", "quote": "You can use the age tool to encrypt secrets based on ssh public keys.", "excerpt": "You can use the age tool to encrypt secrets based on ssh public keys. Here's a small shell script I use https://github.com/mhitza/toolbox/blob/main/scripts/encrypt-for encrypt-for github_username file", "context": "", "use_case": "encrypting shared secrets", "switched_from": "", "story": "Show HN: Lockenv \u2013 Simple encrypted secrets storage for Git"}]}, {"text": " The main limit is that it only encrypts", "cites": [{"id": 734658160, "item_id": 45916135, "url": "https://news.ycombinator.com/item?id=45916135", "by": "networked", "date": "2025-11-13", "stance": "recommend", "quote": "I have also switched from GPG to age.", "excerpt": "> I'm now experimenting with `age`, which touts itself as \"simple, modern, and secure encryption\". If needed, I will use `minisign` for signatures. I have also switched from GPG to age. When I wanted to start signing my open-source software releases because of recent supply-chain attacks, I first thought of Minisign, too. I tried it for binaries and even found a few third-party Git integrations (https://codeberg.org/", "context": "open-source developer", "use_case": "file encryption", "switched_from": "GnuPG", "story": "Switching from GPG to Age"}]}, {"text": ", so commenters sign separately with minisign or SSH keys.", "cites": [{"id": 734658160, "item_id": 45916135, "url": "https://news.ycombinator.com/item?id=45916135", "by": "networked", "date": "2025-11-13", "stance": "recommend", "quote": "I have also switched from GPG to age.", "excerpt": "> I'm now experimenting with `age`, which touts itself as \"simple, modern, and secure encryption\". If needed, I will use `minisign` for signatures. I have also switched from GPG to age. When I wanted to start signing my open-source software releases because of recent supply-chain attacks, I first thought of Minisign, too. I tried it for binaries and even found a few third-party Git integrations (https://codeberg.org/", "context": "open-source developer", "use_case": "file encryption", "switched_from": "GnuPG", "story": "Switching from GPG to Age"}, {"id": 802846291, "item_id": 50177893, "url": "https://news.ycombinator.com/item?id=50177893", "by": "LeBit", "date": "2026-10-21", "stance": "recommend", "quote": "A yubikey can hold an age key.", "excerpt": "I too use (multiple) yubikey to hold my private gpg keys. But I am not sure I will stick with gpg though. Even with my system to extend their expiration or renew them. I have found handling them to be a pain. I use them for 2 things: encrypt/decrypt gopass secrets and sign git commits. Gopass now has more than decent age support. A yubikey can hold an age key. Most git forges accept a ssh key to sign commits. A yubik", "context": "", "use_case": "encrypting secrets", "switched_from": "GnuPG", "story": "Setting Up SSH Keys on macOS with Touch ID"}]}], "praise": [{"label": "Simpler than GPG", "summary": "Commenters switched from GPG to age to escape GPG's operational complexity.", "quotes": [{"id": 802846291, "item_id": 50177893, "url": "https://news.ycombinator.com/item?id=50177893", "by": "LeBit", "date": "2026-10-21", "stance": "recommend", "quote": "A yubikey can hold an age key.", "excerpt": "I too use (multiple) yubikey to hold my private gpg keys. But I am not sure I will stick with gpg though. Even with my system to extend their expiration or renew them. I have found handling them to be a pain. I use them for 2 things: encrypt/decrypt gopass secrets and sign git commits. Gopass now has more than decent age support. A yubikey can hold an age key. Most git forges accept a ssh key to sign commits. A yubik", "context": "", "use_case": "encrypting secrets", "switched_from": "GnuPG", "story": "Setting Up SSH Keys on macOS with Touch ID"}, {"id": 734658160, "item_id": 45916135, "url": "https://news.ycombinator.com/item?id=45916135", "by": "networked", "date": "2025-11-13", "stance": "recommend", "quote": "I have also switched from GPG to age.", "excerpt": "> I'm now experimenting with `age`, which touts itself as \"simple, modern, and secure encryption\". If needed, I will use `minisign` for signatures. I have also switched from GPG to age. When I wanted to start signing my open-source software releases because of recent supply-chain attacks, I first thought of Minisign, too. I tried it for binaries and even found a few third-party Git integrations (https://codeberg.org/", "context": "open-source developer", "use_case": "file encryption", "switched_from": "GnuPG", "story": "Switching from GPG to Age"}, {"id": 742490928, "item_id": 46405683, "url": "https://news.ycombinator.com/item?id=46405683", "by": "some_furry", "date": "2025-12-27", "stance": "recommend", "quote": "That's literally age.", "excerpt": "> I need an alternative to \"gpg --encrypt --armor --recipient <foo>\" That's literally age. https://github.com/FiloSottile/age", "context": "", "use_case": "file encryption", "switched_from": "", "story": "Gpg.fail"}]}, {"label": "Works with SOPS", "summary": "Commonly paired with SOPS to keep encrypted secrets in git repositories.", "quotes": [{"id": 746148145, "item_id": 46634259, "url": "https://news.ycombinator.com/item?id=46634259", "by": "geoffeg", "date": "2026-01-15", "stance": "recommend", "quote": "I use sops and age", "excerpt": "I use sops and age, originally loosely based on this article: https://devops.datenkollektiv.de/using-sops-with-age-and-git-like-a-pro.html I originally set up the git filters, but later disabled them.", "context": "", "use_case": "encryption for secrets", "switched_from": "", "story": "Bubblewrap: A nimble way to prevent agents from accessing your .env files"}, {"id": 771031553, "item_id": 48189472, "url": "https://news.ycombinator.com/item?id=48189472", "by": "epistasis", "date": "2026-05-18", "stance": "recommend", "quote": "It would be nice to use something like SOPS[1] + age right from the start", "excerpt": "Great timing, I was just getting frustrated about this today. I've got a pyinfra secrets.py and another project with an .env for logins for grabbing and moving data. I use LLMs on both of them extensively (having an LLM setup all my proxmox VMs and LXC containers and configure them without doing that yak shaving has been amazing.) It would be nice to use something like SOPS[1] + age right from the start, so I don't f", "context": "", "use_case": "secrets encryption", "switched_from": "", "story": "Sieve \u2013 scans Cursor/Claude chat history for leaked API keys"}, {"id": 735095424, "item_id": 45943464, "url": "https://news.ycombinator.com/item?id=45943464", "by": "tarasglek", "date": "2025-11-15", "stance": "recommend", "quote": "I love that age lets one reuse ssh identities and thus identity sharing systems.", "excerpt": "I love that age lets one reuse ssh identities and thus identity sharing systems. The single most useful thing I ever wrote was a tool to sync github identities with age. https://github.com/tarasglek/github-to-sops This way you get git for change tracking on your secrets and who-has-access-to-secrets and key rotation and this can be trivially expanded to other forges. Its easy to introduce age this way into any modern", "context": "", "use_case": "encrypting secrets", "switched_from": "GPG", "story": "Switching from GPG to Age"}]}, {"label": "SSH key reuse", "summary": "Can encrypt to existing SSH public keys, including GitHub users' keys.", "quotes": [{"id": 735095424, "item_id": 45943464, "url": "https://news.ycombinator.com/item?id=45943464", "by": "tarasglek", "date": "2025-11-15", "stance": "recommend", "quote": "I love that age lets one reuse ssh identities and thus identity sharing systems.", "excerpt": "I love that age lets one reuse ssh identities and thus identity sharing systems. The single most useful thing I ever wrote was a tool to sync github identities with age. https://github.com/tarasglek/github-to-sops This way you get git for change tracking on your secrets and who-has-access-to-secrets and key rotation and this can be trivially expanded to other forges. Its easy to introduce age this way into any modern", "context": "", "use_case": "encrypting secrets", "switched_from": "GPG", "story": "Switching from GPG to Age"}, {"id": 739074864, "item_id": 46192179, "url": "https://news.ycombinator.com/item?id=46192179", "by": "mhitza", "date": "2025-12-08", "stance": "recommend", "quote": "You can use the age tool to encrypt secrets based on ssh public keys.", "excerpt": "You can use the age tool to encrypt secrets based on ssh public keys. Here's a small shell script I use https://github.com/mhitza/toolbox/blob/main/scripts/encrypt-for encrypt-for github_username file", "context": "", "use_case": "encrypting shared secrets", "switched_from": "", "story": "Show HN: Lockenv \u2013 Simple encrypted secrets storage for Git"}]}, {"label": "YubiKey support", "summary": "A YubiKey can hold an age key.", "quotes": [{"id": 802846291, "item_id": 50177893, "url": "https://news.ycombinator.com/item?id=50177893", "by": "LeBit", "date": "2026-10-21", "stance": "recommend", "quote": "A yubikey can hold an age key.", "excerpt": "I too use (multiple) yubikey to hold my private gpg keys. But I am not sure I will stick with gpg though. Even with my system to extend their expiration or renew them. I have found handling them to be a pain. I use them for 2 things: encrypt/decrypt gopass secrets and sign git commits. Gopass now has more than decent age support. A yubikey can hold an age key. Most git forges accept a ssh key to sign commits. A yubik", "context": "", "use_case": "encrypting secrets", "switched_from": "GnuPG", "story": "Setting Up SSH Keys on macOS with Touch ID"}]}], "caveats": [{"label": "No signing", "summary": "Users rely on minisign or SSH keys for signatures alongside age.", "quotes": [{"id": 734658160, "item_id": 45916135, "url": "https://news.ycombinator.com/item?id=45916135", "by": "networked", "date": "2025-11-13", "stance": "recommend", "quote": "I have also switched from GPG to age.", "excerpt": "> I'm now experimenting with `age`, which touts itself as \"simple, modern, and secure encryption\". If needed, I will use `minisign` for signatures. I have also switched from GPG to age. When I wanted to start signing my open-source software releases because of recent supply-chain attacks, I first thought of Minisign, too. I tried it for binaries and even found a few third-party Git integrations (https://codeberg.org/", "context": "open-source developer", "use_case": "file encryption", "switched_from": "GnuPG", "story": "Switching from GPG to Age"}, {"id": 802846291, "item_id": 50177893, "url": "https://news.ycombinator.com/item?id=50177893", "by": "LeBit", "date": "2026-10-21", "stance": "recommend", "quote": "A yubikey can hold an age key.", "excerpt": "I too use (multiple) yubikey to hold my private gpg keys. But I am not sure I will stick with gpg though. Even with my system to extend their expiration or renew them. I have found handling them to be a pain. I use them for 2 things: encrypt/decrypt gopass secrets and sign git commits. Gopass now has more than decent age support. A yubikey can hold an age key. Most git forges accept a ssh key to sign commits. A yubik", "context": "", "use_case": "encrypting secrets", "switched_from": "GnuPG", "story": "Setting Up SSH Keys on macOS with Touch ID"}]}], "who": [{"by": "networked", "context": "open-source developer", "url": "https://news.ycombinator.com/item?id=45916135", "date": "2025-11-13"}], "tags": ["for secrets in git", "for teams", "for GPG switchers", "for YubiKey users"], "use_cases": ["encrypting secrets", "file encryption", "secrets encryption", "encryption for secrets", "encrypting shared secrets"], "compared": [{"slug": "gnupg", "name": "GnuPG", "co": 4, "switched_from": 2, "switched_to": 0}, {"slug": "gpg", "name": "GPG", "co": 1, "switched_from": 1, "switched_to": 0}, {"slug": "sops", "name": "sops", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=45825040", "title": "Switching from GPG to Age", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=50175882", "title": "Setting Up SSH Keys on macOS with Touch ID", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48188727", "title": "Sieve \u2013 scans Cursor/Claude chat history for leaked API keys", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46626836", "title": "Bubblewrap: A nimble way to prevent agents from accessing your .env files", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46403200", "title": "Gpg.fail", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46189480", "title": "Show HN: Lockenv \u2013 Simple encrypted secrets storage for Git", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 2}, "2025-12": {"recommend": 2}, "2026-01": {"recommend": 1}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {"recommend": 1}, "2026-06": {}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {"recommend": 1}}, "quotes": [{"id": 802846291, "item_id": 50177893, "url": "https://news.ycombinator.com/item?id=50177893", "by": "LeBit", "date": "2026-10-21", "stance": "recommend", "quote": "A yubikey can hold an age key.", "excerpt": "I too use (multiple) yubikey to hold my private gpg keys. But I am not sure I will stick with gpg though. Even with my system to extend their expiration or renew them. I have found handling them to be a pain. I use them for 2 things: encrypt/decrypt gopass secrets and sign git commits. Gopass now has more than decent age support. A yubikey can hold an age key. Most git forges accept a ssh key to sign commits. A yubik", "context": "", "use_case": "encrypting secrets", "switched_from": "GnuPG", "story": "Setting Up SSH Keys on macOS with Touch ID"}, {"id": 771031553, "item_id": 48189472, "url": "https://news.ycombinator.com/item?id=48189472", "by": "epistasis", "date": "2026-05-18", "stance": "recommend", "quote": "It would be nice to use something like SOPS[1] + age right from the start", "excerpt": "Great timing, I was just getting frustrated about this today. I've got a pyinfra secrets.py and another project with an .env for logins for grabbing and moving data. I use LLMs on both of them extensively (having an LLM setup all my proxmox VMs and LXC containers and configure them without doing that yak shaving has been amazing.) It would be nice to use something like SOPS[1] + age right from the start, so I don't f", "context": "", "use_case": "secrets encryption", "switched_from": "", "story": "Sieve \u2013 scans Cursor/Claude chat history for leaked API keys"}, {"id": 746148145, "item_id": 46634259, "url": "https://news.ycombinator.com/item?id=46634259", "by": "geoffeg", "date": "2026-01-15", "stance": "recommend", "quote": "I use sops and age", "excerpt": "I use sops and age, originally loosely based on this article: https://devops.datenkollektiv.de/using-sops-with-age-and-git-like-a-pro.html I originally set up the git filters, but later disabled them.", "context": "", "use_case": "encryption for secrets", "switched_from": "", "story": "Bubblewrap: A nimble way to prevent agents from accessing your .env files"}, {"id": 742490928, "item_id": 46405683, "url": "https://news.ycombinator.com/item?id=46405683", "by": "some_furry", "date": "2025-12-27", "stance": "recommend", "quote": "That's literally age.", "excerpt": "> I need an alternative to \"gpg --encrypt --armor --recipient <foo>\" That's literally age. https://github.com/FiloSottile/age", "context": "", "use_case": "file encryption", "switched_from": "", "story": "Gpg.fail"}, {"id": 739074864, "item_id": 46192179, "url": "https://news.ycombinator.com/item?id=46192179", "by": "mhitza", "date": "2025-12-08", "stance": "recommend", "quote": "You can use the age tool to encrypt secrets based on ssh public keys.", "excerpt": "You can use the age tool to encrypt secrets based on ssh public keys. Here's a small shell script I use https://github.com/mhitza/toolbox/blob/main/scripts/encrypt-for encrypt-for github_username file", "context": "", "use_case": "encrypting shared secrets", "switched_from": "", "story": "Show HN: Lockenv \u2013 Simple encrypted secrets storage for Git"}, {"id": 735095424, "item_id": 45943464, "url": "https://news.ycombinator.com/item?id=45943464", "by": "tarasglek", "date": "2025-11-15", "stance": "recommend", "quote": "I love that age lets one reuse ssh identities and thus identity sharing systems.", "excerpt": "I love that age lets one reuse ssh identities and thus identity sharing systems. The single most useful thing I ever wrote was a tool to sync github identities with age. https://github.com/tarasglek/github-to-sops This way you get git for change tracking on your secrets and who-has-access-to-secrets and key rotation and this can be trivially expanded to other forges. Its easy to introduce age this way into any modern", "context": "", "use_case": "encrypting secrets", "switched_from": "GPG", "story": "Switching from GPG to Age"}, {"id": 734658160, "item_id": 45916135, "url": "https://news.ycombinator.com/item?id=45916135", "by": "networked", "date": "2025-11-13", "stance": "recommend", "quote": "I have also switched from GPG to age.", "excerpt": "> I'm now experimenting with `age`, which touts itself as \"simple, modern, and secure encryption\". If needed, I will use `minisign` for signatures. I have also switched from GPG to age. When I wanted to start signing my open-source software releases because of recent supply-chain attacks, I first thought of Minisign, too. I tried it for binaries and even found a few third-party Git integrations (https://codeberg.org/", "context": "open-source developer", "use_case": "file encryption", "switched_from": "GnuPG", "story": "Switching from GPG to Age"}]}