macOSStandard age filesSource available
age encryption, without the terminal.
Encrypt files for the SSH and age keys of the people who should open them, or with a passphrase, and decrypt what they send you with your own keys. Agemin reads and writes the standard age format in a native Mac app, with nothing to install beside it.
on GitHub
Coming to the Mac App Store
macOS 14 or later on Apple silicon. Files open with the age tool and other age software. 30 days of full access, no subscription.
~/Documents/Board report Q3.pdf~/Documents/Board report Q3.pdf.age- SSH and age keys
- Standard age format
- No age tool needed
- No network entitlement
- Sandboxed
- Mac App Store, Family Sharing
Encrypt, decrypt, and keep the keys straight
Drop a file. Tick the people. Done.
Agemin shows the keys you can encrypt for and the keys that can open a file, so the only decision left is who should read it. Press ⌘O to choose a file, tick the recipients, and press ⌘⏎ to write the age file.
The keys you already have
Encrypt for ssh-ed25519 and ssh-rsa public keys straight from .pub files, or for age1… keys. One file per recipient in a folder of your choice, usually ~/.age.
Decrypt with your SSH key
Agemin finds the private keys in your identities folder, usually ~/.ssh, and your age identity files. It shows which of them match a file before you decrypt it, and asks for a protected key's passphrase only when it needs it.
Passphrases too
Protect a file with a passphrase instead of keys, and open files others protected that way. age stretches passphrases with scrypt; Agemin can generate a strong one and shows it once so you can keep it.
Standard age files
Everything Agemin writes opens with the age command line tool and other age software, and the other way around. Binary or ASCII-armored, large files included, streamed chunk by chunk.
Who can open it, before you open it
Drop an age file on the Decrypt page and Agemin lists every recipient entry in its header, marks the ones your keys match, and selects a matching key for you.
Careful with the result
Output files are readable only by your account, a failed or canceled run leaves no partial file behind, and a decrypted file comes with its SHA-256 checksum to compare with the sender's.
Keys without the terminal
Add a recipient by pasting a key, create a new age key pair, copy public keys, read fingerprints, and reveal any key file in Finder. Give each key a face: one of twelve drawn symbols, initials in a color, or an image of your own, kept in Agemin and never written to your key folders.
Nothing to install beside it
Agemin implements the age format itself, with CryptoKit and its own tested code. No Homebrew, no age binary, no runtime. The test suite checks the implementation against the age tool.
Sandboxed and offline
Agemin reads only the folders and files you choose, never runs a command, and has no network entitlement. There is no Agemin account, no analytics, and no developer server.
Recipients and identities
Two folders. That is the whole setup.
A recipients folder with one .pub file per person you encrypt for, and an identities folder with your own private keys, usually ~/.ssh. Agemin lists what it finds, says what each key is, and never changes an existing key.
Recipients
Every
.pubfile is one recipient, named after the file. Add a key someone sent you under a name and Agemin saves it as<name>.pub. Keys age cannot use are still listed, with the reason.Identities
OpenSSH private keys for Ed25519 and RSA, with or without a passphrase, and age identity files. Add Key File brings in keys kept elsewhere, and New age Key creates a pair.
Matching done for you
SSH entries in an age file carry a short tag of the key they are for. Agemin compares it with your keys, so a file encrypted for your laptop key opens with that key instead of being tried against all of them.
Decrypting
The header tells you who it is for.
An age file lists its recipients before any key is used. Agemin shows that list the moment you drop the file, marks the entries your keys match, and uses the right one. A passphrase file asks for its passphrase instead.
Matching keys first
Matching keys are tried first, then the rest, so a file for an age key, which carries no tag, still opens. Choose a key by hand when you want to.
Protected keys stay protected
A passphrase-protected SSH key is unlocked for one decryption and forgotten. Agemin never writes an unprotected copy.
Wrong key, no file
Agemin verifies the key against the header before it creates the output, so a wrong key or a tampered file leaves nothing on disk.
Private by design
Your keys never leave the Mac.
Agemin has no advertising, analytics, account system, or developer server, and no network entitlement at all. Keys and passphrases stay in memory only while they are used. The only network traffic on its behalf is Apple's own StoreKit, for product and purchase information.
The folders you choose
Agemin remembers its permission for your recipients and identities folders, and for key files you add on their own, and reopens them next time. Beyond those and the files you choose, it reads nothing.
Results where you say
Every encrypted or decrypted file goes through a Save panel, is readable only by your account, and is removed again if the run fails.
Nothing to the developer
No usage tracking, no sync, no logs of files, keys, or passphrases. Apple handles purchases and never shares payment details with the developer.
Built for the keyboard
Open, tick, encrypt.
Choose a file, encrypt or decrypt it, and switch pages without reaching for the mouse.
Agemin Pro
Everything for 30 days. Then choose.
Free to download, with 30 days of full access. After the trial, Agemin still encrypts or decrypts one file a day; reading keys, inspecting files, and creating keys stay unlimited. Pro removes the daily limit.
Free After the trial
Occasional files, fully featured.
- One encryption or decryption per day · every key type, passphrases, and armor
- Recipients and identities without limit
- Inspect any age file's recipients, copy keys, create new keys
- Thirty-one languages, sandboxed, no account
Pro Yearly or lifetime
As many files as you like.
- Unlimited encryption and decryption
- Everything the trial included
- Family Sharing · yearly and lifetime purchases
The trial starts when you first get Agemin from the App Store. It needs no card or additional account, starts no subscription, and charges nothing. Trial information is not sent to the developer.
US base prices are shown in USD. Apple converts prices for other App Store regions and handles purchases, renewals, and refunds. Lifetime purchases do not appear in Apple's subscription settings.
The details
Small things, done carefully.
Requirements
An Apple-silicon Mac running macOS 14 or later. Nothing else: Agemin implements the age format itself, and needs no Homebrew, no age tool, and no administrator access.
Three steps
Choose your recipients folder, usually ~/.age, and your identities folder, usually ~/.ssh. Drop a file on the Encrypt page, tick the recipients, and press ⌘⏎. Drop an age file on the Decrypt page to open it.
The age format
Agemin writes age v1 files: ChaCha20-Poly1305 in 64 KiB chunks, X25519 for age and Ed25519 keys, RSA-OAEP for RSA keys, and scrypt for passphrases. Binary or ASCII-armored, as you choose.
Passphrases
Switch Encrypt for to Passphrase. Generate fills in a random passphrase and shows it once. A passphrase file has no key recipients; the age format allows only one or the other.
Large files
Files are streamed chunk by chunk with a progress bar and a Cancel button, so memory use does not grow with the file and a canceled run leaves nothing behind.
Open With
Agemin registers the .age type, so an age file opened with Agemin from Finder lands on the Decrypt page. Any other file lands on the Encrypt page.
Sandboxed
Agemin runs in the App Sandbox with Hardened Runtime. Its container holds the folder bookmarks, avatars, the trial state, the day's Free count, and the window position.
Source available
The source is on GitHub under the PolyForm Strict License 1.0.0 with added permissions. It includes the age implementation and the tests that check it against the age tool.
Support and policies
Help, privacy, and terms.
Find help and read the app's privacy policy and terms.
Coming to the Mac App Store.
Follow the project on GitHub for launch updates, or visit Support for help.