Decrypt a .age file on your phone

Someone sent you a file ending in .age. It's encrypted with the age protocol — here's how to open it on iOS or Android, no laptop needed.

A .age file is the output of the age encryption tool. To open it you need one of two things: the identity (private key) it was encrypted to, or the passphrase it was locked with. AgePony handles both.

First: how was it encrypted?

There are two common cases, and they decrypt differently:

Encrypted to a key — an age1… recipient or an SSH key (often via the GitHub-username trick). You open it with the matching private key, called an identity.
Encrypted with a passphrase — locked with a password instead of a key. You open it by typing that passphrase.

You don't have to know in advance — AgePony inspects the file and shows you which it needs.

Open it in AgePony

The fast way: straight from Files

Long-press the .age file in the Files app (iOS) or your file manager (Android), choose Open in AgePony, and the file drops straight into the decrypt flow. If it was encrypted to one of your identities, AgePony matches it automatically and decrypts. If it's passphrase-locked, you'll be prompted for the passphrase.

Adding your identity

To decrypt a key-encrypted file, the matching private key has to be in your AgePony vault. If you generated your key in AgePony, it's already there. If your key lives elsewhere (an age-keygen file, or an SSH private key), import it once and it stays available for every future file.

Bit-perfect with the CLI

AgePony reads standard age v1 files, so anything produced by age on macOS, Linux, or Windows opens cleanly — X25519, ssh-ed25519, ssh-rsa, and passphrase files all work. The reverse is true too: a file AgePony makes opens with age -d file.age on the command line.

Common snags

"This file isn't encrypted to any of your identities." The key it was encrypted to isn't in your vault. Import the right private key, or ask the sender which recipient they used.

The passphrase is rejected. Passphrases are case-sensitive and exact. Note that passphrase decryption is intentionally slow — age uses scrypt, which takes a second or so by design to resist brute-forcing.

You deleted the identity. If you removed the key (or reset your vault) after the file was encrypted, it can't be recovered. There's no backdoor; that's the point.