# Age encrypt

Encrypt small text into an ASCII-armored age ciphertext with a passphrase or native X25519 recipients.

## Run it

- **CLI:** `gizza tool age-encrypt "Paste the message to encrypt" 'passphrase=Use a strong passphrase'`
- **Web:** https://gizza.ai/tools/age-encrypt/
- **Agents:** machine-readable descriptor (parameters JSON Schema) at https://gizza.ai/tools/age-encrypt/tool.json

## Inputs

- `text` — Plaintext _(field)_
- `mode` — Encryption mode _(field)_
- `passphrase` — Passphrase _(field)_
- `recipients` — Recipients _(field)_
- `work_factor` — Scrypt work factor _(field)_

## Output

- Armored age ciphertext (text)

## Query parameters

Open the tool pre-filled and auto-run via URL:

- `text` — Plaintext
- `mode` — Encryption mode
- `passphrase` — Passphrase
- `recipients` — Recipients
- `work_factor` — Scrypt work factor

Example: `https://gizza.ai/tools/age-encrypt/?text=Paste%20the%20message%20to%20encrypt&mode=passphrase&passphrase=Use%20a%20strong%20passphrase&recipients=age1...%20%28one%20per%20line%2C%20comma%2C%20or%20space%20separated%29&work_factor=14`

---

## About this tool

Encrypt small text snippets into an ASCII-armored age file. The output starts with
`-----BEGIN AGE ENCRYPTED FILE-----`, so it can be copied into chat, tickets, or a
terminal and later decrypted by compatible age clients.

Use passphrase mode when the recipient already knows a shared secret. Use
recipients mode when you have one or more native age X25519 public keys beginning
with `age1`. Recipient mode accepts keys on separate lines, spaces, commas, or
semicolons, and ignores `#` comments in pasted recipient files.

Example passphrase run:

1. Paste `Deploy key rotates at 17:00 UTC.` as the plaintext.
2. Leave mode set to `passphrase`.
3. Enter a strong passphrase and keep the work factor at `14`.
4. Copy the armored age ciphertext from the result.

Limits and edge cases: this page encrypts text up to 1 MiB. Passphrase work
factor is capped at 15 because higher scrypt settings exceed the wasm memory
sandbox. The tool does not decrypt, generate identities, encrypt files, or accept
SSH recipients; use the age CLI for those workflows.

## FAQ

<details>
<summary>Can I decrypt the result on this page?</summary>

No. This tool only encrypts plaintext to age ciphertext. Decrypt with a compatible
age client using the same passphrase or a matching `AGE-SECRET-KEY-1...` identity.

</details>

<details>
<summary>What kind of recipient key does this accept?</summary>

Recipient mode accepts native age X25519 public recipients that start with
`age1`. It rejects private identities and SSH public keys so they are not pasted
into the wrong field by mistake.

</details>

<details>
<summary>Why is the work factor limited to 15?</summary>

The work factor controls scrypt memory use in passphrase mode. Higher values can
be useful on a desktop age CLI, but they exceed the memory available to this wasm
tool. The range 10-15 keeps encryption and later decryption practical here.

</details>

<details>
<summary>Why does the same input produce different ciphertext each time?</summary>

Age encryption uses fresh randomness for every file. Different ciphertext for the
same plaintext and passphrase is expected and prevents repeated messages from
looking identical.

</details>

## Related tools

- [Age Key Generator](https://gizza.ai/tools/age-keygen/): Generate an age X25519 identity and its shareable age1 public recipient in your browser, or derive the recipient from an identity you already have.
- [ECDSA secp256k1 sign & verify](https://gizza.ai/tools/ecdsa-secp256k1/): Generate secp256k1 keypairs and sign or verify messages with ECDSA (the Bitcoin/Ethereum curve). RFC 6979 deterministic, DER + compact — in your browser.
- [ECDSA sign](https://gizza.ai/tools/ecdsa-sign/): Sign a message with an ECDSA private key (NIST P-256 or P-384) and get a DER or raw r||s signature in base64 and hex, in your browser. Nothing is uploaded.
- [Ed25519 sign & verify](https://gizza.ai/tools/ed25519-sign-verify/): Sign a message with an Ed25519 private key, or verify a signature with the public key — hex, base64, or PEM keys, entirely in your browser.
- [PEM → JWK converter](https://gizza.ai/tools/pem-to-jwk/): Convert a PEM-encoded RSA or EC key into a JSON Web Key (JWK), in your browser. Nothing is uploaded.