Skip to main content

age encryption on macOS

age is a small, modern file-encryption format: one passphrase, one output file, no key management, no key servers, no config. It is excellent, and on macOS it is almost entirely a command-line experience.

Purrchiver is a native Mac app that reads and writes age files directly — so tar.zst.age, iso.age, or any other .age file is a double-click instead of a pipeline.

What a .tar.zst.age file is

That triple extension reads right to left, and each layer does one job:

LayerExtensionWhat it does
1. Archive.tarBundles many files into one stream
2. Compress.zstZstandard-compresses that stream
3. Encrypt.ageWraps the result in an age envelope

So backup.tar.zst.age is a folder, tarred, zstd-compressed, then encrypted. It’s a genuinely good default — tar preserves permissions and symlinks, Zstandard is fast at high ratios, and age handles encryption without the footguns of legacy ZIP crypto.

From a shell, producing one means chaining three tools and getting the order right:

tar -cf - ./project | zstd -T0 | age -p > project.tar.zst.age

And unpacking it means reversing them:

age -d project.tar.zst.age | zstd -d | tar -xf -

In Purrchiver that’s the Create sheet: pick tar, pick Zstandard, pick age, enter a passphrase. Opening one is a double-click and a passphrase prompt — Purrchiver unwraps all three layers and shows you the file list to browse and extract from.

Why age works on formats other Mac archivers can’t encrypt

Most Mac archive tools can only encrypt a ZIP, and maybe a 7z, because they rely on encryption built into the container format. Most containers have none.

age sidesteps this entirely by encrypting the finished file rather than the format’s internals. That makes it universal:

  • A compressed tar — archive.tar.zst → archive.tar.zst.age
  • A disk image or data ISO — disk.iso → disk.iso.age
  • An Apple Archive — bundle.aar → bundle.aar.age
  • A single file of any kind — report.csv → report.csv.age

This is the main reason Purrchiver can hand you an encrypted .tar.zst or .iso at all: there’s no such thing as an “encrypted ISO” in the format itself, but there is an age envelope around one.

It’s a standard, not a lock-in

age is an open format with multiple independent implementations. A file Purrchiver writes opens with the reference age CLI or with rage, on macOS, Linux, or Windows — and vice versa. Purrchiver reads age files it didn’t create.

Purrchiver uses age’s passphrase mode (scrypt), not recipient keys. You choose a passphrase; the output is a single .age file. Nothing touches the network at any point — see privacy & security.

The honest caveats

  • Your recipient needs an age-capable opener. A .age file will not open in Finder’s Archive Utility the way a ZIP does. If maximum compatibility matters more than format coverage, use an encrypted ZIP instead.
  • There is no passphrase recovery. Lose the passphrase and the data is gone. That’s the design, not a limitation to work around.
  • Passphrase mode, not key pairs. If you need recipient public keys or SSH-key recipients, use the age CLI — Purrchiver doesn’t expose that.

Getting it

Purrchiver is free to download, and opening and decrypting .age files is free — if you were sent one, you don’t have to pay anything to read it.

Creating age-encrypted files is part of the one-time $9.99 unlock, along with the rest of the encryption authoring features. No subscription, no account, no tracking.

Get Purrchiver on the Mac App Store →

Going deeper