Skip to content

Local file encryption

How to use it

  1. Drop a file in, or click to choose one. The tool reads the start of the file to decide: an age file gets decrypted, anything else gets encrypted.
  2. Type a passphrase. When encrypting, "Draw a passphrase" picks six words from the Asian Diceware list. Write it down. It is gone when you close the page.
  3. Press "Encrypt and download". The page decrypts the output again with the same passphrase and checks it against the original before offering the download. The file name is the original with .age added. Decrypting removes the .age.

The output is a standard age file. Any computer with the command-line tool opens it, without this site:

age -d -o backup.tar backup.tar.age

What age is, what the format looks like and how it differs from PGP are on What is age?.

The passphrase is everything

This page does passphrase mode only, so there are no keys to manage, at the cost that the strength of the encryption is exactly the strength of the passphrase. scrypt makes every guess cost a fraction of a second, which holds against brute force but not against a guessable passphrase. Six words or more, not a quote or a lyric, never used elsewhere. The reasoning is in Asian Diceware. Nobody can recover a forgotten passphrase, so back up the passphrase too, on paper, somewhere other than where the backup is.

Things to keep in mind

  • The whole file is processed in memory, and anything over 200 MB is refused up front. Split large backups, or use the command-line tool directly.
  • The file name is not inside the ciphertext. The output name is the original plus .age, visible to anyone. Give backups a name that gives nothing away.
  • Files encrypted to a key (a public key starting with age1) cannot be opened here. That needs the private key and the command-line tool.
  • The first use needs a connection to fetch the code. After that it stays on the device.

Works offline

Like the rest of this section, the code stays on your device once stored and works without a network. That is the most direct proof that neither the file nor the passphrase was sent anywhere.

To take this page with you, see offline reading.