The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →agevault adds directory-oriented lock and unlock commands to age, which encrypts individual files. Its documented workflow creates a passphrase-protected age identity, then uses that identity to lock and later unlock a named directory. agevault is a convenience layer around age encryption, not an independent replacement for understanding how your identity and passphrase are protected.
What agevault does
agevault is a command-line tool for encrypting a directory using age. The project documents three commands: keygen, lock and unlock. In its example, you generate a passphrase-protected identity file, lock a directory, and later unlock it by supplying the identity’s passphrase.
As an Amazon Associate I earn from qualifying purchases.
The distinction between the two projects matters: age provides file encryption, while agevault supplies a directory-focused workflow. age’s manual describes encrypting or decrypting a single input file; its README shows how to archive a directory and pipe the archive through age. agevault aims to provide the infrastructure for handling a directory without making you assemble that archive-and-encrypt workflow yourself.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to lock and unlock a directory
Use the commands and arguments in the current agevault repository documentation; the example below describes the documented sequence without assuming flags or paths that the project does not specify here.
#1 Best Overall
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Rugged Double-Layer Waterproof* Design - Protects the crypto drive against knocks, drops, break-in and submerging in water. The electronics are shielded by a hardended inner case. The rubberised silicone outer casing provides a final layer of protection
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
- Install agevault. The repository lists prebuilt binaries from its latest release, Nix, Go and Docker as installation routes. Check the current project documentation for the route and platform that fit your system.
- Generate the identity. Run the documented
keygencommand to create a passphrase-protected identity file. Choose and retain a passphrase you can recover later. - Keep the generated filename unchanged. The project’s example specifically says not to rename the generated identity file. Follow that instruction for the documented workflow.
- Lock the directory. Run the documented
lockcommand for the directory you want to protect. The project says a vault can be locked without entering the identity’s passphrase. - Unlock it when needed. Run the documented
unlockcommand for that directory and enter the identity’s passphrase when prompted.
The project material cited here does not establish exact command-line flags, where the identity file is stored, or behavior for every operating system and release. Consult the current README rather than guessing an option or assuming the identity is stored inside the directory.
How the identity and passphrase fit together
agevault’s stated design uses a passphrase-encrypted identity. The project’s rationale is that having only the encrypted identity file or only its passphrase should not be sufficient; it also says locking a vault does not require entering the passphrase. These are the project’s design claims, not an independent security evaluation.
Rank #2
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
- SuperSpeed USB 3.0 - Transfer all your confidential files and folders faster than ever before. Works on both PC & Mac
The README mentions multiple keys as a possible future way to support multiple users. Treat that as a plan, not a currently documented multi-user feature.
Security caveats to consider
The agevault project README states: “This project has been tested, but has not undergone a formal security audit, and none is planned.” The project encourages users to review the code before trusting it with sensitive data. The statement is the project’s own disclosure; it is not evidence of an independent audit or a particular level of security.
Rank #3
- Certified to FIPS 197 - U.S. Government Approved High Level Information Security Standard.
- Protection against brute force password attacks - Data is automatically erased after 6 unsuccessful access attempts. The data of the USB flash drive type c encryption with dual connectors is destroyed and the cryptographic drive is reset.
- Durable dual-layer waterproof design* — Protects the crypto reader from bumps, drops, run-in and immersion in water. The electronics are protected by a hardened internal case. Rubberized silicone outer case provides a final layer of protection.
- Auto-Lock —The cryptographic key automatically encrypts all data and locks when removed from a PC/Mac or when screen protection or "computer lock" is enabled.
- Secure Entry —Data on these flash drives cannot be accessed without the correct alphanumeric password of 8 to 16 characters. A password indication option is available for this flash drive. The hint cannot match the password.
age supplies the underlying file-encryption role, but the safety of using agevault also depends on the wrapper’s behavior and on how you handle the identity and passphrase. Before relying on it for sensitive files, consider whether you are comfortable reviewing the code and managing the identity file and passphrase safely.
Quick Recap
Best Value
- FIPS 140-3 Level 3 (Pending) Certified Military-Grade Security
- OS/Device Independent
- XTS-AES Hardware Encryption
- Enforced Alphanumeric PIN
- Multi-PIN (Admin and User) Option
Rank #4
- FIPS 197 with XTS-AES 256-bit Encryption: Provides business-grade security with hardware-based encryption to protect your sensitive data
- Brute Force and BadUSB Attack Protection: Safeguards against unauthorized access attempts and malicious USB attacks with digitally-signed firmware
- Multi-Password Option with Complex/Passphrase modes: Offers flexible password configuration options to meet various security requirements and user preferences
- New Passphrase Mode: Enhanced security feature allowing users to create longer, more memorable password phrases for easier access without compromising protection
- Dual Read-Only (Write-Protect) Settings: Enables write protection functionality to prevent accidental data modification or deletion when needed
When agevault may suit your workflow
- Consider agevault if you want directory-oriented lock and unlock commands and are comfortable with its documented identity-file workflow.
- Consider using age directly if you prefer to create a directory archive yourself and encrypt that file with age, following the approach shown in the age README.
- Check current project details first if your choice depends on a particular operating system, release, or maintenance and audit status. These details can change; the project sources cited here do not establish a complete current platform matrix or a specific release version.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
