You have a file that should not sit in plaintext. age encrypts it to a public key, or to a passphrase, and that is the interface.
age is a file encryption tool. You generate a key, encrypt to the public half, and decrypt with the private half. It also accepts an SSH public key as a recipient. Checked on age 1.3.2: age-keygen, encrypt with -r, armor with -a, and decrypt with -d -i. The passphrase mode exists. It prompts. This page does not pretend a non-interactive paste can type the passphrase for you.
install
# macOS
brew install age
# Ubuntu 24.04+ and recent Debian ship the binary package age. Older apt will say no package — use the GitHub release
sudo apt install age
# in the default repos
sudo dnf install age
# in the default repos
sudo pacman -S age
examples
# Write a new identity to key.txt in this directory. The public key prints to the terminal
age-keygen -o key.txt
# Print the public key from an identity file
age-keygen -y key.txt
# Encrypt secret.txt to that public key
age -r "$(age-keygen -y key.txt)" -o secret.age secret.txt
# Decrypt. -i is the identity file
age -d -i key.txt secret.age
# ASCII armor, for a paste or a mail body. Output starts with BEGIN AGE ENCRYPTED FILE
age -a -r "$(age-keygen -y key.txt)" secret.txt
pro tip
An SSH public key (ssh-ed25519 AAAA...) is a valid recipient. You can encrypt to a key you already publish, and decrypt with the matching private key via -i. Do not point -i at a key you do not control.
honest limits
age encrypts a file. It does not sync it, sign it, or manage a team. -p asks for a passphrase on the terminal. Pasting that line into a script will sit there waiting. If -o names a file that already exists, age overwrites it. Lose key.txt and the ciphertext is gone. There is no recovery email.