Time to Ditch GPG: A Guide to Using age for Ultra-Compact File Encryption on Linux – ITFROMZERO

Table of Contents

The Nightmare Called GPG and a Worthy Alternative

After auditing security for over 10 different server systems, I discovered a paradox. GPG (GNU Privacy Guard) might be the gold standard for encryption, but in reality, few people use it daily. The reason is simple: GPG is too hard to use. Managing keyrings, verifying trust, or memorizing command-line arguments as long as a grocery list is a nightmare for any SysAdmin.

I’ve seen many folks prefer weak ZIP password compression over touching GPG. That’s why age (Actually Good Encryption) was born. Created by Filippo Valsorda, a former Google security engineer, age follows a minimalist philosophy. It’s compact, requires no configuration, and most importantly, it’s almost impossible to use incorrectly.

Deploy age in Just 30 Seconds

Forget the dry theory; let’s get to the installation. age is designed to run immediately without system tweaking.

1. Quick Installation

On Ubuntu or Debian, simply run:

sudo apt update && sudo apt install age

For macOS users, Homebrew is the fastest choice:

brew install age

2. Generating a Key Pair (Public/Private Key)

Forget complex keyring management. With age, your key is just a plain text file.

age-keygen -o my_key.txt

When you open my_key.txt, you’ll see something like this:

# created: 2023-10-27T10:00:00+07:00
# public key: age1ql3z7hjy74nz3t2... (Share this to receive encrypted files)
AGE-SECRET-KEY-1... (This is the secret key, keep it safe)

3. Real-world Encryption and Decryption

Try encrypting database_backup.sql using the Public Key:

age -r age1ql3z7hjy74nz3t2... -o backup.sql.age database_backup.sql

To decrypt, simply point to your saved secret key file:

age -d -i my_key.txt backup.sql.age > backup_restored.sql

Why I Chose age Over GPG

When running automated scripts, GPG often fails because it requires user interaction (tty) to enter a passphrase. age solves this completely. It works seamlessly in automated pipelines without manual intervention.

Goodbye configuration files: GPG stores keys in ~/.gnupg, which is prone to permission errors. age doesn’t care about that. Wherever you put the key file, it works.
Modern algorithms: Instead of aging RSA, age uses X25519 and ChaCha20-Poly1305. These algorithms are faster and have shorter keys, making them easier to copy-paste.
Optimized for Pipes: age works perfectly with other Linux commands via pipes, allowing you to process data directly in RAM instead of writing temporary files to disk.

3 Real-World Scenarios for DevOps

Here are some ways I apply age to handle work more efficiently.

1. Password-based Encryption for Slack/Telegram

If you need to quickly send a config file to a colleague without generating keys, use symmetric password encryption:

age -p -o config.age config.json

2. Leveraging Existing SSH Keys (Extremely Convenient)

This is the killer feature. You can use your existing SSH Public Key (id_ed25519.pub) to encrypt files. You can even grab a colleague’s key from GitHub:

curl https://github.com/username.keys | age -R - -o secret.age data.txt

3. Backing Up Directories Without Temporary Buffer Space

Instead of compressing and then encrypting, you can stream data directly from tar to age. This saves 50% of temporary disk space when backing up folders tens of gigabytes in size:

tar cvz /var/www/html | age -r age1ql3z... > website_backup.tar.gz.age

Tips to Avoid Shooting Yourself in the Foot

No matter how good the tool, misuse is still dangerous. Here are some hard-won tips from 5 years of system administration:

Separation Principle: Never keep your my_key.txt on the same server as the encrypted data. If a hacker gains access, they’ll have both the lock and the key.
Smart Key Management: Save your Private Key content in a password manager like Bitwarden or Vault. Don’t leave it lying around in the /tmp directory.
Watch Your Command History: When using a password (the flag -p), start your command with a leading space (in Bash) so it isn’t saved to .bash_history.

Since switching to age, I no longer dread securing files. It perfectly follows the Unix philosophy: do one thing and do it well. If you’re tired of GPG’s bloat, try age today. You won’t want to go back.