Free tool
Encrypt a file or note with a passphrase
Add a file or type a note, set a passphrase, and save an encrypted copy in the open age format. Anyone with the passphrase can open it here, or with the free age command on Mac, Windows and Linux. The tool also decrypts age files. It works with files up to 2 GB, and nothing leaves this browser.
Runs on this device. Your files and passphrase are not uploaded.
Drop a file to encrypt
Any file up to 2 GB. It stays on this device.
Any file up to 2 GB. It stays on this device.
A short passphrase can be guessed offline. Use 5 or more random words, or Make passphrase.
Write the passphrase down. Nobody can open the file without it.
How it works
The tool writes the same files as the age command with age -p. Each step runs in a background task of this page, so the page stays responsive during a large file.
- Make a file key. The browser picks a random 128-bit key for this file only.
- Lock the file key with the passphrase. scrypt turns your passphrase and a random 16-byte salt into a key, with a work factor of 218, the same as the age command. This step takes about 1 second on a laptop and uses 256 MiB of memory, so every guess at the passphrase costs the same. The locked file key goes into the file header, with a check value over the header.
- Encrypt the content. The file is split into 64 KiB chunks. Each chunk is encrypted with ChaCha20-Poly1305 and gets a 16-byte tag, so a changed, swapped or missing chunk stops the decryption. The last chunk is marked, so a file cut short does not open.
- Save. You download the .age file, or copy it as text. Text output (age calls it armor) is base64 between a BEGIN and an END line, about 35% larger.
To decrypt, the tool reads the header, runs scrypt with your passphrase, and checks the result before it writes a single byte. A wrong passphrase gives a clear message, and a damaged file gives a different one.
Open the file with the age command
| Task | Command |
|---|---|
| Install on a Mac | brew install age |
| Install on Windows | winget install --id FiloSottile.age |
| Install on Debian or Ubuntu | apt install age |
| Decrypt a file from this tool | age -d -o photo.jpg photo.jpg.age |
| Encrypt a file for this tool | age -p -o photo.jpg.age photo.jpg |
A strong passphrase matters more than anything else here, because a copied file can be attacked offline with no limit on guesses. Test one in the password strength checker.
Questions people ask
Does this tool upload my file?
No. Your browser encrypts and decrypts the file on your device, in a background task of this page. No file, text, file name or passphrase goes to our server or to anyone else. To check, load this page, turn off Wi-Fi, and encrypt a file. The tool still works.
How do I decrypt the file without this website?
Install the free age command: brew install age on a Mac, winget install --id FiloSottile.age on Windows, or apt install age on Debian and Ubuntu. Then run age -d -o photo.jpg photo.jpg.age and type the passphrase. age finds the passphrase and the text format by itself. Files made with age -p open here too.
What is the age format?
age is an open file encryption format with a public spec at age-encryption.org. A passphrase goes through scrypt to make the key that locks a random 128-bit file key. The file is then encrypted in 64 KiB chunks with ChaCha20-Poly1305, so any change to any chunk is caught. Go, Rust and TypeScript versions read the same files.
What happens if I forget the passphrase?
Nobody can open the file. The passphrase is not stored in the file or anywhere else, and age has no reset and no master key. scrypt makes each guess slow and needs 256 MiB of memory, but a short or common passphrase can still be guessed. Keep the passphrase in a password manager, or on paper away from the file.
How long should the passphrase be?
The age library asks for at least 8 to 10 random letters and digits, or 4 to 5 random words from a list of 2,000 words or more. Make passphrase gives 6 words from the 7,776-word EFF list, about 77 bits. A phrase you make up yourself is weaker than it looks. Test one in the password strength checker.
Can I send the encrypted file by email or chat?
Yes. Send the .age file, or choose Save as text and paste the text into the message. Send the passphrase in a different app, or say it in person. The encrypted file does not hide the file name you give it or its size, which is about the same as the original. Rename the file first if the name says too much.
Sources
- The age file encryption format, version 1 (C2SP spec) · checked Oct 8, 2026
- age: install and passphrase use (FiloSottile/age on GitHub) · checked Oct 8, 2026
- typage: the TypeScript version of age (FiloSottile/typage on GitHub) · checked Oct 8, 2026
- RFC 7914: The scrypt password-based key derivation function · checked Oct 8, 2026
- RFC 8439: ChaCha20 and Poly1305 for IETF protocols · checked Oct 8, 2026
- EFF dice-generated passphrases (Electronic Frontier Foundation) · checked Oct 8, 2026
Open source code in this tool
- age-encryption (typage) 0.3.1, BSD-3-Clause, the age Authors. Reads and writes the age format
- noble-hashes, noble-ciphers, noble-curves, noble-post-quantum and scure-base, MIT, Paul Miller. scrypt, ChaCha20-Poly1305, HKDF and base64, used by typage
- EFF large word list, CC BY 4.0, Electronic Frontier Foundation. The words of Make passphrase
York Vault
Send photos with a passphrase from York Vault
York Vault keeps your photos, videos and files encrypted on your phone. To send some, it packs them into one password-locked file and makes a one-time passphrase for it. The file opens in York Vault on iPhone or Android.
How York Vault sends a password-locked fileAll featuresMore free tools