Signed bundle.
One file that is both signed and encrypted, in that order. AgePony puts your payload and its signature in a small tar, then encrypts the tar. Nothing about the signer is visible from outside, and the recipient learns who signed only once they can already read the file.
A signed bundle is AgePony's sign-then-encrypt container: a small uncompressed USTAR .tar holding the payload plus a detached SSHSIG over that payload, with the whole tar then age-encrypted.
What it is
AgePony signs the payload first, producing a detached SSHSIG signature. Both the payload and that signature go into an uncompressed USTAR tar, the same plain format AgePony uses for multi-file bundles, and the tar is encrypted with age. The result is a single file. Decrypting it yields the tar, the tar yields the payload and the signature, and the signature is checked against the payload.
Why it matters
The ordering is the whole point. Encrypt-then-sign leaves a detached signature lying outside the ciphertext, and an SSHSIG signature carries the signer's public key. Anyone who intercepts the pair, a mail server, a cloud sync provider, whoever seizes the drive, can read that public key and learn who produced the file, even though they cannot read a byte of the contents. That is a metadata leak on the one fact you were probably most careful about.
Sign-then-encrypt closes it. The signature lives inside the encrypted container, so the ciphertext reveals nothing: no signer, no key, no hint that the file is signed at all. The recipient learns who signed only after decrypting, which is the correct moment, since they already hold the plaintext by then. It also keeps the two artefacts together, so a signature cannot be lost, stripped or swapped in transit.
The signature never appears outside the encryption.
Related terms
Common questions.
Why sign inside the encryption instead of outside?
A detached signature sitting next to the ciphertext leaks the signer's public key to anyone who intercepts the pair. Sealing the signature inside means the ciphertext reveals nothing about who sent it.
Do I still need to run a separate verify step?
No. AgePony verifies the enclosed SSHSIG automatically while decrypting and tells you who signed the file. Older AgePony 2.0 output, a .age file next to a .age.sig, still verifies too.
Get AgePony
Free file encryption for iOS and Android. No accounts, no tracking, no servers.