age

Use it to protect a file before storing or sending it, then decrypt it with the matching identity or passphrase. Its small command set works well in scripts and terminal workflows.

If you need an encrypted vault for files in a synchronised folder, compare the different workflow offered by Cryptomator.

When it is useful

age fits workflows where a file needs protection before it is copied to another machine or storage location. Recipient-based encryption lets someone send you an encrypted file using your public recipient string, while the secret identity needed to open it stays with you. Passphrase mode is useful for a one-off archive when exchanging public keys would be inconvenient. These are different ways to unlock a file, so decide which recovery information you can reliably keep.

A practical way to get started

Try a harmless text file first. Create an identity, record its public recipient separately, encrypt the sample and decrypt it to a different filename. Compare the result before applying the process to important documents. For a folder, create an archive first; age encrypts a stream or file rather than presenting a browsable encrypted drive. Keep a recoverable copy of the secret identity away from the only encrypted copy of your data.

What to consider before choosing

Encryption does not remove the original plaintext, schedule backups or prove who sent a document. Choose output names carefully and check which files you intend to share. If you lose the required identity or passphrase, there is no account-reset workflow to recover the contents. For routine editing inside an encrypted folder, a vault application may require fewer manual steps than repeatedly encrypting and decrypting individual files.