> ## Content Index > Fetch the complete content index at: https://snubmonkey.com/llms.txt > Use this file to discover other available public pages before exploring further. # How to Encrypt and Decrypt Folders with age β€” Part 1/2: on Linux and macOS. - URL: https://snubmonkey.com/encrypt-folders-age-linux-macos/ - Published: 2026-11-11T01:11:00.000Z - Updated: 2026-11-11T01:11:00.000Z - Description: Learn how to encrypt entire directories using age and tar on Linux and macOS. This step-by-step guide covers passphrase protection, archive verification, safe removal, and data recovery. - Author: Scarlett Clarke - Tags: security 🦾🦿, how to πŸͺ„, linux 🐧, macOS, shell πŸ› οΈ # Encryption helps protect private research, backups, configuration files, and sensitive notes if a copy is misplaced, exposed, or stored somewhere you do not fully trust. [age](https://github.com/FiloSottile/age?ref=snubmonkey.com) (Actually Good Encryption) is a modern file-encryption tool that encrypts files and data streams, meaning it can encrypt data as it receives it, without requiring the entire input to be stored in memory or written to a temporary file. Since a folder contains multiple files, subdirectories, and metadata, we first package it into a `tar` archive, then encrypt that archive with `age`. This tutorial explains how to install `age`, encrypt an entire folder, verify the encrypted archive, remove the original unencrypted copy, and restore your data when needed. ## Install age **macOS (Homebrew):** ``` $ brew install age ``` **Debian or Ubuntu:** ``` $ sudo apt update $ sudo apt install age ``` **Fedora or RHEL:** ``` $ sudo dnf install age ``` Confirm that it is installed: ``` $ age --version ``` ## Encrypt a folder Suppose you have a folder named `private-evidence` containing several files: ``` private-evidence/ β”œβ”€β”€ file.txt β”œβ”€β”€ file_1.txt β”œβ”€β”€ file_2.txt β”œβ”€β”€ file_3.txt β”œβ”€β”€ file_4.txt └── file_5.txt ``` Create a compressed, encrypted archive: ``` $ tar -czf - private-evidence | age -p -o private-evidence.tar.gz.age ``` You will be prompted to enter and confirm your passphrase. Here is what the command does: - `tar` bundles the folder and its contents into one archive. - `-c` creates a new archive. - `-z` compresses the archive using gzip. - `-f -` writes the archive to standard output instead of creating an intermediate file. - `|` pipes the archive directly into the next command. - `age -p` encrypts the incoming data using a passphrase. - `-o` specifies the encrypted output filename. The resulting encrypted archive is: ``` private-evidence.tar.gz.age ``` **Restrict local access to the encrypted archive**: ``` $ chmod 600 private-evidence.tar.gz.age ``` This gives the file read and write permissions for its owner only, removing group and other-user permissions. ## Verify Before Deleting Before removing the original folder, verify that the archive can be decrypted and that its contents can be read. Run: ``` $ set -o pipefail $ age -d private-evidence.tar.gz.age | tar -tzf - ``` Enter your passphrase when prompted. Expected output: ``` private-evidence/ private-evidence/file.txt private-evidence/file_1.txt private-evidence/file_2.txt private-evidence/file_3.txt private-evidence/file_4.txt private-evidence/file_5.txt ``` The `tar -t` option lists archive contents without extracting them. **Why use `set -o pipefail`?** A pipeline normally reports the exit status of its last command. With `pipefail`, a failure in an earlier command, such as `age` failing to decrypt, is also reported. It acts as a safety guardrail for your shell scripts or automated workflows. Without it, bugs can easily slip through unnoticed. Check the exit status: ``` $ echo $? ``` Expected result: ``` 0 ``` An exit status of `0` confirms that the decryption and archive-reading pipeline completed successfully. ## Decrypt and Restore Your Folder When you need access to your original files, decrypt and extract the archive. First, create a destination directory: ``` $ mkdir restored ``` Decrypt and extract: ``` $ age -d private-evidence.tar.gz.age | tar -xzf - -C restored ``` Enter your passphrase when prompted. Your restored directory structure will be: ``` restored/ └── private-evidence/ β”œβ”€β”€ file.txt β”œβ”€β”€ file_1.txt β”œβ”€β”€ file_2.txt β”œβ”€β”€ file_3.txt β”œβ”€β”€ file_4.txt └── file_5.txt ``` The encrypted archive remains untouched, so you can decrypt it again whenever needed. ## Remove the original unencrypted folder Once you have successfully verified the encrypted archive, stored your passphrase safely, and confirmed that you no longer need the plaintext copy, you can remove the original directory: ``` $ rm -r private-evidence ``` **Important**: Do not delete the original before verifying the encrypted archive. Also, `rm -r` removes directory entries but does not guarantee secure erasure of the underlying data. Copies may remain in SSD storage, APFS snapshots, backups, or other locations. Encryption protects the encrypted archive; it does not automatically encrypt or securely erase other plaintext copies. ## Large folders and already-compressed files The `tar` and `age` pipeline streams data directly between processes. It does not require loading the entire folder into memory or creating an intermediate unencrypted archive. However, **`gzip`** compression is not always beneficial. For folders containing mostly images, videos, PDFs, ZIP files, or other already-compressed data, you can skip gzip: ``` $ tar -cf - private-evidence | age -p -o private-evidence.tar.age ``` The resulting archive will be: ``` private-evidence.tar.age ``` To decrypt and extract it: ``` $ age -d private-evidence.tar.age | tar -xf - -C restored ``` Skipping gzip can reduce CPU usage and processing time when the contents are already compressed. ## Processing time Encrypting large directories can be time-consuming. The total duration depends on several factors, including the amount and type of data, storage device performance (SSD or HDD), disk I/O throughput, CPU performance, compression overhead, and system workload. Folders containing millions of small files may also take considerably longer to process than folders containing a few large files. ## Keep your passphrase safe The `age -p` option uses a passphrase to encrypt the archive. Anyone who obtains the encrypted file and its passphrase can decrypt the contents. Without the correct passphrase, recovery is not possible. Follow these recommendations: - Use a long, unique passphrase. - Store it in a reputable password manager. - Do not store the passphrase alongside the encrypted archive. - Keep a separate copy of important encrypted backups. - Test decryption periodically to ensure your backups remain recoverable. Passphrase-based encryption in **`age`** uses [scrypt](https://en.wikipedia.org/wiki/Scrypt?ref=snubmonkey.com) for key derivation and [ChaCha20-Poly1305](https://en.wikipedia.org/wiki/ChaCha20-Poly1305?ref=snubmonkey.com) for authenticated encryption. The authentication mechanism also helps detect modifications to the encrypted data. Read the [age format specification](https://c2sp.org/age%40v1.1.0?ref=snubmonkey.com) for further technical details. ## A `tar` and `age` pipeline provides a straightforward way to package, compress, and encrypt an entire directory into one portable encrypted file. It is particularly useful for protecting configuration files, private research, sensitive documents, and personal backups. The essential workflow is simple: 1. Package and encrypt the directory. 2. Verify that the archive decrypts successfully. 3. Store the passphrase securely. 4. Remove the original plaintext copy when appropriate. 5. Retain the encrypted archive for future recovery. **Remember**: Encryption is only as reliable as your key management and backup strategy. Always verify your encrypted data before deleting the original. We hope this was helpful. **Keep learning. Keep exploring. Build a safer open-source community.** ### What's Next? In **Part 2/2: Decrypting Folders with age β€” Recovery and Cryptography**, we'll restore encrypted folders, explore how passphrase-based key derivation works with scrypt, and examine how ChaCha20-Poly1305 provides encryption and authentication.