AGE-KEYGEN(1)

💖 age-keygen(1) — the girlies' guide to making age keys ✨

okay so real talk: this one's a page from the General Commands Manual and it's literally all about age-keygen. if you've ever been like "bestie where do my keys even come from," this is your moment. no cap. 🎀

---

🌸 NAME 🌸

age-keygen — generate age(1) key pairs 💅

✨ SYNOPSIS ✨

age-keygen [-pq] [-o OUTPUT]
age-keygen -y [-o OUTPUT] [INPUT]

🦋 DESCRIPTION 🦋

okay so age-keygen does exactly one thing and it does it flawlessly: it makes you a brand-new native age(1) key pair. the identity gets output to standard output, or, if you're feeling fancy, to the OUTPUT file instead. the output comes with the public key and the current time chilling in there as comments 🫶

and here's the lil detail that gets me: if the output is not going to a terminal, age-keygen lowkey prints the public key to standard error. so like, keep an eye on stderr bestie, it's doing things 💖

👑 OPTIONS 👑

• -pq — generates a post-quantum hybrid ML-KEM-768 + X25519 key pair ✨ the future is now, and apparently in the future this might become the default. so get in on it early, iykyk.
• -o, --output=OUTPUT — writes the identity to OUTPUT instead of standard output 💖 and listen: if OUTPUT already exists, it is not overwritten. respect. she does not destroy your files. 🫶
• -y — reads an identity file from INPUT (or from standard input if you're just piping it in) and outputs the corresponding recipient(s), one per line, with no comments. clean, minimal, no notes. 🎀
• --version — prints the version and exits. that's it, that's the whole option. slay. 💅

🔥 EXAMPLES 🔥

generate a new post-quantum identity 🧚

$ age-keygen -pq
# created: 2025-11-17T13:39:06+01:00
# public key: age1pq167[... 1950 more characters ...]
AGE-SECRET-KEY-PQ-1K30MYPZAHAXHR22YHH27EGDVLU0QNSUH3DSV7J7NR3X6D9LHXNWSDLTV4T

generate a new traditional identity 🍓

$ age-keygen
# created: 2021-01-02T15:30:45+01:00
# public key: age1lvyvwawkr0mcnnnncaghunadrqkmuf9e6507x9y920xxpp866cnql7dp2z
AGE-SECRET-KEY-1N9JEPW6DWJ0ZQUDX63F5A03GX8QUW7PXDE39N8UYF82VZ9PC8UFS3M7XA9

write a new post-quantum identity to key.txt 💜

$ age-keygen -pq -o key.txt
Public key: age1pq1cd[... 1950 more characters ...]

convert an identity to a recipient 🌈

$ age-keygen -y key.txt
age1pq1cd[... 1950 more characters ...]

💀 SEE ALSO 💀

age(1), age-inspect(1)

🌟 AUTHORS 🌟

Filippo Valsorda age@filippo.io

---

ok that's the whole page bestie, and honestly? she ate. 💅✨

and as for the boring-but-important fine print at the bottom — the page was dated August 2026, it's from AGE-KEYGEN(1) in the General Commands Manual. mwah. 🫶🎀💖