AGE-PLUGIN-BATCHPASS(1)

💅 AGE-PLUGIN-BATCHPASS(1) 💅

okay so you found the age-plugin-batchpass page in the General Commands Manual section and you're like "bestie what is this" — don't worry, I got you 🫶

---

✨ NAME ✨

age-plugin-batchpass — a non-interactive passphrase encryption plugin for age(1). that's it, that's the vibe. it does passphrases without ever asking you to type one 💅

---

🎀 SYNOPSIS 🎀

age -e -j batchpass
age -d -j batchpass

literally those two. encrypt mode and decrypt mode, both with the plugin flag. iconic honestly.

---

🦋 DESCRIPTION 🦋

age-plugin-batchpass is an age(1) plugin that makes non-interactive passphrase-based encryption and decryption happen, powered entirely by environment variables. no prompts, no typing, no "Enter passphrase:" staring at you. it's giving automation 💖

---

🚨 WARNING 🚨

okay bestie, read this part, it's important, no cap:

this functionality is not built into the age CLI, and there's a reason for that — most applications should be using native keys instead of scripting passphrase-based encryption. periodt.

humans are notoriously bad at remembering and generating strong passphrases. age uses scrypt to partially mitigate this, which is necessarily very slow 😭 like, that's the tradeoff, that's the whole deal.

if a computer will be doing the remembering anyway, you can and should use native keys instead. there is no need to manage separate public and private keys — you encrypt directly to the private key:

$ age-keygen -o key.txt
$ age -e -i key.txt file.txt > file.txt.age
$ age -d -i key.txt file.txt.age > file.txt

likewise, you can store a native identity string in an environment variable or through your CI secrets manager and use it to encrypt and decrypt files non-interactively:

$ export AGE_SECRET=$(age-keygen)
$ age -e -i <(echo "$AGE_SECRET") file.txt > file.txt.age
$ age -d -i <(echo "$AGE_SECRET") file.txt.age > file.txt

the age CLI also natively supports passphrase-encrypted identity files, so you can use that functionality to non-interactively encrypt multiple files such that you'll be able to decrypt them later by entering the same passphrase 🔥 look at this:

$ age-keygen -pq | age -p -o encrypted-identity.txt
Public key: age1pq1cd[... 1950 more characters ...]
Enter passphrase (leave empty to autogenerate a secure one):
age: using autogenerated passphrase "eternal-erase-keen-suffer-fog-exclude-huge-scorpion-escape-scrub"
$ age -r age1pq1cd[... 1950 more characters ...] file.txt > file.txt.age
$ age -d -i encrypted-identity.txt file.txt.age > file.txt
Enter passphrase for identity file "encrypted-identity.txt":

and finally — and this is the part that matters for safety, don't skip it 🙈 — when using this plugin, care should be taken not to let the password be persisted in the shell history or leaked to other users on multi-user systems. like, genuinely. keep that passphrase safe.

---

🌸 ENVIRONMENT 🌸

these are the literal environment variables the plugin reads, one per bullet, no surprises:

• AGE_PASSPHRASE — the passphrase to use for encryption or decryption. mutually exclusive with AGE_PASSPHRASE_FD 💜
• AGE_PASSPHRASE_FD — a file descriptor number to read the passphrase from. trailing newlines are stripped from the file contents. mutually exclusive with AGE_PASSPHRASE 🎀
• AGE_PASSPHRASE_WORK_FACTOR — the scrypt work factor to use when encrypting. it must be between 1 and 30. default is 18. higher values are more secure but slower ⭐ — and heads up: the age CLI refuses to decrypt files above 22, and so does this plugin unless AGE_PASSPHRASE_MAX_WORK_FACTOR is set to at least the same value 👑
• AGE_PASSPHRASE_MAX_WORK_FACTOR — the maximum scrypt work factor to accept when decrypting. it must be between 1 and 30. default is 22. you can use it to avoid very slow decryptions, or to allow slower ones 😌

---

🧚 EXAMPLES 🧚

encrypt a file with a passphrase:

$ AGE_PASSPHRASE=secret age -e -j batchpass file.txt > file.txt.age

decrypt a file with a passphrase:

$ AGE_PASSPHRASE=secret age -d -j batchpass file.txt.age > file.txt

read the passphrase from a file descriptor:

$ AGE_PASSPHRASE_FD=3 age -e -j batchpass file.txt 3< passphrase.txt > file.txt.age

---

🌈 SEE ALSO 🌈

• age(1) — the main character, honestly. go read it 💖

---

👑 AUTHORS 👑

Filippo Valsorda — age@filippo.io ✨

---

that's the whole page bestie, you ate that 🫶 this was the August 2026 edition of the <rainbow>AGE-PLUGIN-BATCHPASS(1)</rainbow> manual — go forth and encrypt responsibly 💅💖