How to encrypt a text file: age, GPG, and VeraCrypt

Updated: October 27, 2026

A text file is convenient, but if it contains passwords, client data, or sensitive notes, HTTPS and a cloud drive are not enough. This guide compares three practical encryption methods: age, GPG, and VeraCrypt.

Start with the threat model

Encryption comes in different scopes. Full-disk encryption (FileVault, BitLocker, LUKS) protects the whole device if a laptop is lost or stolen. File-level encryption protects the contents when they are stored in the cloud, sent to someone, or kept on a shared drive. VeraCrypt can act as an encrypted container for a folder or as disk encryption.

Answer three questions first: who are you protecting against, where will the ciphertext live, and what happens if the key is lost. Encryption does not protect against malware on an unlocked device, screenshots, weak passwords, or bad access permissions. It also does not hide the file name, size, or modification time — that is metadata, not content.

A sensible baseline: full-disk encryption, a strong password, two-factor authentication for the cloud account, and a backup. File-level encryption adds a second layer but does not replace these measures.

age: minimalism for one file

age is a modern file encryption tool with a small CLI and few settings. It uses X25519 for keys and works well for a single file protected by a passphrase or a public key.

Install with brew install age on macOS, apt install age on Debian/Ubuntu, or use the release binaries. On Windows, WSL or a package manager is usually the least painful route.

age -p -o everything.txt.age everything.txt
age -d -o everything.txt everything.txt.age

The first command asks for a passphrase and creates everything.txt.age. The second decrypts it. For a key pair:

age-keygen -o age-key.txt
# prints the public key, for example age1...
age -r age1... -o everything.txt.age everything.txt
age -d -i age-key.txt -o everything.txt everything.txt.age

Never keep the private key age-key.txt next to the ciphertext. Store it in a password manager or on offline media; the public key can be shared freely.

age wins on simplicity: short commands, modern defaults, few ways to misconfigure it. The trade-off is a smaller ecosystem and manual key management.

GPG: compatibility and keys

GNU Privacy Guard (GPG) implements OpenPGP. It is common in email, signatures, and enterprise workflows, and supports both symmetric and public-key encryption. If you need to exchange files with people who already use PGP keys, GPG remains the practical choice.

Symmetric encryption with a passphrase:

gpg --symmetric --cipher-algo AES256 everything.txt
gpg --decrypt everything.txt.gpg > everything.txt

Add --armor for an ASCII representation that can travel through email. To encrypt to a recipient's public key:

gpg --full-generate-key
gpg --encrypt --recipient you@example.com everything.txt
gpg --decrypt everything.txt.gpg > everything.txt

Keys and backups are the hard part. Save the private key and revocation certificate, remember the passphrase, and test recovery on a clean machine. Export a public key with gpg --export --armor; import one with gpg --import.

GPG offers broad compatibility, signatures, and a familiar public-key model. It also brings a complex interface, key-management risk, and more configuration. For a new personal file, age is usually simpler; for the PGP ecosystem, GPG is the right tool.

VeraCrypt: a container for a folder or disk

VeraCrypt creates an encrypted container or encrypts a disk. A container can hold a whole folder: notes, attachments, and archives. It supports AES, Serpent, and Twofish, keyfiles, PIM, and hidden volumes.

Basic GUI workflow:

1. Create Volume → Create an encrypted file container.
2. Choose a standard or hidden volume.
3. Pick a location and size.
4. Choose an encryption algorithm (AES with hardware acceleration is a practical default).
5. Set a password and, optionally, a keyfile.
6. Format the container, mount it, copy everything.txt inside, and dismount.

The command line covers the same operations (check veracrypt --help for your version):

veracrypt -t -c /path/container.hc
veracrypt -t /path/container.hc /mnt/vc
veracrypt -t -d /mnt/vc

For sync, put only the closed container in the cloud. Do not sync a mounted volume: the cloud client sees individual files and a conflict can damage the container. The order is: mount locally → edit the file → dismount → let the container sync.

Back up the volume header through the GUI (Tools → Backup Volume Header) and keep it separately. Without the header, recovery is much harder. If you use a hidden volume, enable hidden-volume protection when mounting the outer volume; otherwise writes to the outer volume can damage it.

VeraCrypt is strong for a whole folder, hidden volumes, and cross-platform use. The trade-offs are a heavier container, a fixed size, no official mobile clients, and the risk of syncing a mounted volume.

Comparison

Practical scenarios

• One file and a passphrase. age: one command to encrypt, one to decrypt.
• Exchange with a PGP user. GPG: encrypt to the recipient's public key and sign if needed.
• A folder of notes and attachments. VeraCrypt: a fixed-size container holding the whole structure.
• Cloud sync. Encrypt before upload. Decrypt to a temporary folder outside sync, not next to the ciphertext.
• Mobile access. age and GPG have limited CLI/app support; VeraCrypt has no official mobile clients. If mobile access is required, consider a file-level vault such as Cryptomator or OS-level encryption.
• Backups. Keep an encrypted copy, a key backup, and test recovery on a separate device.

Common mistakes

• Decrypting into a synced folder — the plaintext goes back to the cloud.
• Syncing a mounted VeraCrypt container.
• Keeping the private key or passphrase next to the ciphertext.
• Reusing one weak password for the cloud, disk, and archive.
• Not backing up the VeraCrypt volume header.
• Assuming encryption hides the file name, size, or modification time.
• Forgetting full-disk encryption and two-factor authentication.

Checklist

• The threat model is clear: theft, cloud provider, shared access, or device loss.
• Full-disk encryption and cloud 2FA are enabled.
• The method is chosen: age, GPG, or VeraCrypt.
• The passphrase and keys are stored in a password manager or offline.
• Plaintext never lands in a synced folder.
• Recovery from the encrypted copy has been tested.
• VeraCrypt is dismounted and the volume header is backed up.

If the file syncs across devices, set up secure sync first: how to sync one text file across devices. If you are still choosing a note-taking tool, start with OBTF vs Notion vs Obsidian.