Agemin

Support

Help with Agemin and answers to common questions.

Contact

When reporting a problem, include your macOS version, the Agemin version from About Agemin, the kind of key involved (age, ssh-ed25519, or ssh-rsa), and clear steps to reproduce. Never attach a private key, a passphrase, or a file you encrypted. A public key, or a small test file encrypted for a throwaway key, is fine.

Common questions

What does Agemin need?

An Apple silicon Mac running macOS 14 or later. Agemin implements the age format itself, so you do not need the age command line tool, Homebrew, or any other software. Files Agemin writes open with the age tool and other age software, and theirs open in Agemin.

Is Agemin in my language?

Agemin follows your Mac's language settings and ships in thirty-one languages, including Serbian in both scripts. If a translation reads badly, open an issue or send a correction; the catalogs live in the repository.

Where do my keys go?

Agemin works with two folders you choose. The recipients folder holds the public keys you encrypt for, one .pub file per person; ~/.age is the usual choice, and any folder works. The identities folder holds your private keys, usually ~/.ssh. Choose them with Choose Folder on the Recipients and Identities pages or in the Keys menu; the Open panel shows hidden folders. Agemin remembers both until you choose Forget Folder Access… from the Agemin menu. A key kept somewhere else can be added on its own with Add Key File.

Which keys work?

Recipients: age1… public keys, and ssh-ed25519 and ssh-rsa public keys as they appear in .pub files. Identities: age identity files (AGE-SECRET-KEY-1…), OpenSSH private keys for Ed25519 and RSA with or without a passphrase, and legacy PEM RSA keys without a passphrase. RSA keys work up to 16384 bits, the largest OpenSSH makes. These are the key types age itself supports. ECDSA, DSA, and security-key (sk-) SSH keys cannot be used with age, and keys from age plugins are not supported in this version.

My SSH key has a passphrase

That is fine. Agemin lists the key with a passphrase badge and asks for the passphrase when it decrypts with that key. The passphrase is used once and not stored. Passphrase-protected keys in the legacy PEM format (the file starts with -----BEGIN RSA PRIVATE KEY----- and mentions ENCRYPTED) are not supported; convert such a key with ssh-keygen -p -o or use an unprotected copy kept somewhere safe. A key made with more than 4096 key derivation rounds (ssh-keygen -a) is refused, so a damaged or hostile key file cannot keep Agemin busy for hours.

How do I give someone my public key, or get theirs?

To receive files, share a public key: the .pub file of your SSH key, or the age1… line Agemin shows after New age Key on the Identities page, with a Copy button beside it. To encrypt for someone, click Add Recipient on the Recipients page and paste the key they sent you under a name; the Add Recipient chip on the Encrypt page takes you there. Agemin saves it as <name>.pub in your recipients folder.

Can I give keys faces?

Yes. On the Recipients and Identities pages, click a key's avatar to pick one of twelve drawn symbols, initials in a color, or an image of your own with Choose Image; you can also drop an image onto the avatar. The choice is stored in Agemin, keyed by the key's fingerprint, so the same key looks the same everywhere, including the chips on the Encrypt page. Nothing in your key folders changes, and Use Initials removes a stored choice.

Agemin says none of my identities can decrypt the file

The file was encrypted for keys you do not have. The Decrypt page lists every recipient entry in the file's header: SSH entries carry a short tag that must match one of your keys, and age entries are tried with every age identity you have. Ask the sender to encrypt for the public key you actually use, or add the right private key with Add Key File. A wrong passphrase, a corrupt file, and a file that is not an age file at all each get their own message.

Can I use a passphrase instead of keys?

Yes. Switch Encrypt for to Passphrase on the Encrypt page. Anyone with the passphrase can open the file; age stretches it with scrypt, so a long passphrase matters more than a complex one. Generate fills in a random one and shows it once so you can store it in a password manager. A passphrase file cannot also have key recipients; that is a rule of the age format.

What is ASCII armor?

A text form of the same encrypted file, between -----BEGIN AGE ENCRYPTED FILE----- and -----END AGE ENCRYPTED FILE----- lines, for email, chat, and configuration files. Turn on ASCII armor under Options before encrypting. Agemin reads both forms, and accepts armored text whose lines were rewrapped by a mail client or chat app.

Where does the result go, and why does it ask every time?

Agemin runs in the App Sandbox, so it can write only where you let it. Encrypt and Decrypt open a Save panel with the usual name filled in: the original name plus .age, or the name without .age for a decrypted file. The panel asks before replacing an existing file. Results are created readable only by your user account, and a failed or canceled run removes its partial file.

What is the checksum under a decrypted file?

The SHA-256 of the decrypted bytes, the same value shasum -a 256 prints. If the sender gave you a checksum, compare the two.

What happens after the first 30 days?

The 30-day trial includes full access. No subscription starts and there is no charge. After the trial, Agemin still encrypts or decrypts one file per local day, counted when the operation starts. Reading keys, inspecting a file's recipients, copying keys, and creating new keys stay unlimited. Pro removes the daily limit and is sold as a yearly subscription or a one-time lifetime purchase through the Mac App Store.

Does Agemin send anything anywhere?

No. Agemin has no network entitlement, no account, no analytics, and no developer server. All encryption and decryption happens on your Mac, and keys and passphrases stay in memory only while they are used. See the privacy policy for details.

Where is the source?

The app repository holds the public app source under the PolyForm Strict License 1.0.0 with added permissions, including the age implementation and the tests that check it against the age tool. Bug reports and contributions are welcome there.

How do I cancel or restore Agemin Pro?

Subscriptions are managed in your App Store settings (App Store → your name → Subscriptions). To restore a purchase on another Mac, choose Agemin Pro… from the Agemin menu and click Restore Purchases while signed in with the same Apple Account.