Encryption helps protect private research, backups, configuration files, and sensitive notes if a copy is misplaced, exposed, or stored somewhere you do not fully trust.

age (Actually Good Encryption) is a modern file-encryption tool that encrypts files and data streams, meaning it can encrypt data as it receives it, without requiring the entire input to be stored in memory or written to a temporary file. Since a folder contains multiple files, subdirectories, and metadata, we first package it into a tar archive, then encrypt that archive with age.

This tutorial explains how to install age, encrypt an entire folder, verify the encrypted archive, remove the original unencrypted copy, and restore your data when needed.

Install age

macOS (Homebrew):

$ brew install age

Debian or Ubuntu:

$ sudo apt update
$ sudo apt install age

Fedora or RHEL:

$ sudo dnf install age

Confirm that it is installed:

$ age --version

Encrypt a folder

Suppose you have a folder named private-evidence containing several files:

private-evidence/
├── file.txt
├── file_1.txt
├── file_2.txt
├── file_3.txt
├── file_4.txt
└── file_5.txt

Create a compressed, encrypted archive:

$ tar -czf - private-evidence | age -p -o private-evidence.tar.gz.age

You will be prompted to enter and confirm your passphrase.

Here is what the command does:

• tar bundles the folder and its contents into one archive.
• -c creates a new archive.
• -z compresses the archive using gzip.
• -f - writes the archive to standard output instead of creating an intermediate file.
• | pipes the archive directly into the next command.
• age -p encrypts the incoming data using a passphrase.
• -o specifies the encrypted output filename.

The resulting encrypted archive is:

private-evidence.tar.gz.age

Restrict local access to the encrypted archive:

$ chmod 600 private-evidence.tar.gz.age

This gives the file read and write permissions for its owner only, removing group and other-user permissions.

Verify Before Deleting

Before removing the original folder, verify that the archive can be decrypted and that its contents can be read.

Run:

$ set -o pipefail
$ age -d private-evidence.tar.gz.age | tar -tzf -

Enter your passphrase when prompted.

Expected output:

private-evidence/
private-evidence/file.txt
private-evidence/file_1.txt
private-evidence/file_2.txt
private-evidence/file_3.txt
private-evidence/file_4.txt
private-evidence/file_5.txt

The tar -t option lists archive contents without extracting them.

Why use set -o pipefail?

A pipeline normally reports the exit status of its last command. With pipefail, a failure in an earlier command, such as age failing to decrypt, is also reported. It acts as a safety guardrail for your shell scripts or automated workflows. Without it, bugs can easily slip through unnoticed.

Check the exit status:

$ echo $?

Expected result:

0

An exit status of 0 confirms that the decryption and archive-reading pipeline completed successfully.

Decrypt and Restore Your Folder

When you need access to your original files, decrypt and extract the archive.

First, create a destination directory:

$ mkdir restored

Decrypt and extract:

$ age -d private-evidence.tar.gz.age | tar -xzf - -C restored

Enter your passphrase when prompted.

Your restored directory structure will be:

restored/
└── private-evidence/
    ├── file.txt
    ├── file_1.txt
    ├── file_2.txt
    ├── file_3.txt
    ├── file_4.txt
    └── file_5.txt

The encrypted archive remains untouched, so you can decrypt it again whenever needed.

Remove the original unencrypted folder

Once you have successfully verified the encrypted archive, stored your passphrase safely, and confirmed that you no longer need the plaintext copy, you can remove the original directory:

$ rm -r private-evidence

Important: Do not delete the original before verifying the encrypted archive.

Also, rm -r removes directory entries but does not guarantee secure erasure of the underlying data. Copies may remain in SSD storage, APFS snapshots, backups, or other locations.

Encryption protects the encrypted archive; it does not automatically encrypt or securely erase other plaintext copies.

Large folders and already-compressed files

The tar and age pipeline streams data directly between processes. It does not require loading the entire folder into memory or creating an intermediate unencrypted archive.

However, gzip compression is not always beneficial.

For folders containing mostly images, videos, PDFs, ZIP files, or other already-compressed data, you can skip gzip:

$ tar -cf - private-evidence | age -p -o private-evidence.tar.age

The resulting archive will be:

private-evidence.tar.age

To decrypt and extract it:

$ age -d private-evidence.tar.age | tar -xf - -C restored

Skipping gzip can reduce CPU usage and processing time when the contents are already compressed.

Processing time

Encrypting large directories can be time-consuming. The total duration depends on several factors, including the amount and type of data, storage device performance (SSD or HDD), disk I/O throughput, CPU performance, compression overhead, and system workload.
Folders containing millions of small files may also take considerably longer to process than folders containing a few large files.

Keep your passphrase safe

The age -p option uses a passphrase to encrypt the archive. Anyone who obtains the encrypted file and its passphrase can decrypt the contents.

Without the correct passphrase, recovery is not possible.

Follow these recommendations:

• Use a long, unique passphrase.
• Store it in a reputable password manager.
• Do not store the passphrase alongside the encrypted archive.
• Keep a separate copy of important encrypted backups.
• Test decryption periodically to ensure your backups remain recoverable.

Passphrase-based encryption in age uses scrypt for key derivation and ChaCha20-Poly1305 for authenticated encryption.

The authentication mechanism also helps detect modifications to the encrypted data.

Read the age format specification for further technical details.

A tar and age pipeline provides a straightforward way to package, compress, and encrypt an entire directory into one portable encrypted file.

It is particularly useful for protecting configuration files, private research, sensitive documents, and personal backups.

The essential workflow is simple:

1. Package and encrypt the directory.
2. Verify that the archive decrypts successfully.
3. Store the passphrase securely.
4. Remove the original plaintext copy when appropriate.
5. Retain the encrypted archive for future recovery.

Remember: Encryption is only as reliable as your key management and backup strategy. Always verify your encrypted data before deleting the original.

We hope this was helpful.
Keep learning. Keep exploring. Build a safer open-source community.

What's Next?

In Part 2/2: Decrypting Folders with age — Recovery and Cryptography, we'll restore encrypted folders, explore how passphrase-based key derivation works with scrypt, and examine how ChaCha20-Poly1305 provides encryption and authentication.