age for sysadmins.
If your infrastructure already speaks age, AgePony is the piece that lets you handle those encrypted files away from your desk — encrypt a credential to the right recipients, sign an artifact, and authorize it all with a security key you tap against the phone.
The workflow this addresses.
A teammate is locked out and needs a credential, now, and you're not at your workstation. Or a deploy is waiting on a signed artifact. age is already a common backbone for encrypted config in modern infra; AgePony gives you a mobile front end to it that produces the exact same files your tooling consumes.
What age does for you here, and what it doesn't.
Recipient-encrypted files, hardware-signed
Encrypt a credential or config file to one or several recipients' keys. Sign a release or artifact with SSHSIG, optionally backed by a FIDO security key tapped over NFC so the signing key stays off the device. Everything is standard age and SSHSIG, ready for your pipeline.
Not in scope
AgePony isn't a secrets manager. It doesn't store credentials, enforce access policy, audit access, or rotate keys on a schedule. It's the encrypt-and-sign step, not the vault, the CI runner, or the policy engine.
A concrete workflow.
- An on-call engineer needs a service credential. Pull the file, or its plaintext, into AgePony.
- Encrypt it to their key — by pasted age recipient, SSH key, or GitHub username — and to your own key too so you keep access.
- Send the
.agefile through your normal channel. Only the intended recipients can open it. - For a release artifact, sign it in AgePony. If policy requires hardware, tap your FIDO security key over NFC to authorize the signature.
- Publish the artifact and its
.sig. Your deploy step verifies withssh-keygen -Y verifybefore trusting it.
Is AgePony right for your ops workflow?
- Your infrastructure already uses age for encrypted config.
- You want to handle those files from a phone during an incident.
- You sign artifacts and want a hardware-key option.
- You value standard, tool-compatible output.
- You need a full secrets manager with policy, audit, and rotation.
- Your stack is built on OpenPGP rather than age — use PGPony.
- You need automated, unattended encryption in a pipeline — that's the CLI's job.
Related material.
See encrypting to an SSH key and signing with a hardware security key. To weigh age against your current setup, read AgePony vs the age CLI.
Get AgePony
Free file encryption for iOS and Android. No accounts, no tracking, no servers.