requested interactively. Otherwise, it's encrypted to one or more
<ahref="#RECIPIENTS-AND-IDENTITIES"title="RECIPIENTS AND IDENTITIES"data-bare-link="true">RECIPIENTS</a> specified with <code>-r</code>/<code>--recipient</code> or
<code>-R</code>/<code>--recipients-file</code>. Every recipient can decrypt the file.</p>
<ahref="#RECIPIENTS-AND-IDENTITIES"title="RECIPIENTS AND IDENTITIES"data-bare-link="true">IDENTITIES</a> specified with <code>-i</code>/<code>--identity</code> are
used to decrypt the file.</p>
<p><code>age</code> encrypted files are binary and not malleable, with around 200 bytes of
overhead per recipient, plus 16 bytes every 64KiB of plaintext.</p>
<h2id="OPTIONS">OPTIONS</h2>
<dl>
<dt><code>-o</code>, <code>--output</code>=<var>OUTPUT</var></dt><dd><p> Write encrypted or decrypted file to <var>OUTPUT</var> instead of standard output.
If <var>OUTPUT</var> already exists it will be overwritten.</p>
<p> If encrypting without <code>--armor</code>, <code>age</code> will refuse to output binary to a
TTY. This can be forced by specifying <code>-</code> as <var>OUTPUT</var>.</p></dd>
<dt><code>--version</code></dt><dd><p> Print the version and exit.</p></dd>
<dt><code>-e</code>, <code>--encrypt</code></dt><dd><p> Encrypt <var>INPUT</var> to <var>OUTPUT</var>. This is the default.</p></dd>
<dt><code>-r</code>, <code>--recipient</code>=<var>RECIPIENT</var></dt><dd><p> Encrypt to the explicitly specified <var>RECIPIENT</var>. See the
<ahref="#RECIPIENTS-AND-IDENTITIES"title="RECIPIENTS AND IDENTITIES"data-bare-link="true">RECIPIENTS AND IDENTITIES</a> section for possible recipient formats.</p>
and the file can be decrypted by all provided recipients independently.</p></dd>
<dt><code>-R</code>, <code>--recipients-file</code>=<var>PATH</var></dt><dd><p> Encrypt to the <ahref="#RECIPIENTS-AND-IDENTITIES"title="RECIPIENTS AND IDENTITIES"data-bare-link="true">RECIPIENTS</a> listed in the
file at <var>PATH</var>, one per line. Empty lines and lines starting with <code>#</code>
are ignored as comments.</p>
<p> If <var>PATH</var> is <code>-</code>, the recipients are read from standard input. In
this case, the <var>INPUT</var> argument must be specified.</p>
<dt><code>-i</code>, <code>--identity</code>=<var>PATH</var></dt><dd><p> Encrypt to the <ahref="#RECIPIENTS-AND-IDENTITIES"title="RECIPIENTS AND IDENTITIES"data-bare-link="true">RECIPIENTS</a> corresponding to the
<ahref="#RECIPIENTS-AND-IDENTITIES"title="RECIPIENTS AND IDENTITIES"data-bare-link="true">IDENTITIES</a> listed in the file at <var>PATH</var>. This
is equivalent to converting the file at <var>PATH</var> to a recipients file with
<code>age-keygen -y</code> and then passing that to <code>-R</code>/<code>--recipients-file</code>.</p>
<p> For the format of <var>PATH</var>, see the definition of <code>-i</code>/<code>--identity</code> in the
<p><code>-e</code>/<code>--encrypt</code> must be explicitly specified when using <code>-i</code>/<code>--identity</code>
in encryption mode to avoid confusion.</p></dd>
<dt><code>-j</code><var>PLUGIN</var></dt><dd><p> Encrypt using the data-less <ahref="#Plugins"title="Plugins"data-bare-link="true">plugin</a><var>PLUGIN</var>.</p>
<p> This is equivalent to using <code>-i</code>/<code>--identity</code> with a file that contains a
single plugin <code>IDENTITY</code> that encodes no plugin-specific data.</p>
<p><code>-e</code>/<code>--encrypt</code> must be explicitly specified when using <code>-j</code> in encryption
<dt><code>-d</code>, <code>--decrypt</code></dt><dd><p> Decrypt <var>INPUT</var> to <var>OUTPUT</var>.</p>
<p> If <var>INPUT</var> is passphrase encrypted, it will be automatically detected
and the passphrase will be requested interactively. Otherwise, the
<ahref="#RECIPIENTS-AND-IDENTITIES"title="RECIPIENTS AND IDENTITIES"data-bare-link="true">IDENTITIES</a> specified with <code>-i</code>/<code>--identity</code>
are used.</p>
<p> ASCII armoring is transparently detected and decoded.</p></dd>
<dt><code>-i</code>, <code>--identity</code>=<var>PATH</var></dt><dd><p> Decrypt using the <ahref="#RECIPIENTS-AND-IDENTITIES"title="RECIPIENTS AND IDENTITIES"data-bare-link="true">IDENTITIES</a> at <var>PATH</var>.</p>
<p><var>PATH</var> may be one of the following:</p>
<p> a. A file listing <ahref="#RECIPIENTS-AND-IDENTITIES"title="RECIPIENTS AND IDENTITIES"data-bare-link="true">IDENTITIES</a> one per line.
Empty lines and lines starting with "<code>#</code>" are ignored as comments.</p>
<p> This option can be repeated. Identities are tried in the order in which are
provided, and the first one matching one of the file's recipients is used.
Unused identities are ignored, but it is an error if the <var>INPUT</var> file is
passphrase-encrypted and <code>-i</code>/<code>--identity</code> is specified.</p></dd>
<dt><code>-j</code><var>PLUGIN</var></dt><dd><p> Decrypt using the data-less <ahref="#Plugins"title="Plugins"data-bare-link="true">plugin</a><var>PLUGIN</var>.</p>
<p>Native <code>age</code> key pairs are generated with <aclass="man-ref"href="age-keygen.1.html">age-keygen<spanclass="s">(1)</span></a>, and provide small
encodings and strong encryption based on X25519. They are the recommended
recipient type for most applications.</p>
<p>A <code>RECIPIENT</code> encoding begins with <code>age1</code> and looks like the following:</p>
