Repository navigation
Conversation
Add a short README section covering the pattern of piping an age identity from a password manager (e.g. 1Password, Bitwarden, pass) via -i -, and materializing to a temp file for tools like SOPS that require an identity file path. Fixes FiloSottile#722 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019dHe95FDNgtHdZk7uEDbdc
pcarinhas
suggested changes
Nov 1, 2026
Comment on lines
+282
to
+284
| ### Storing identities in a password manager | ||
|
|
||
| Rather than keeping an identity file on disk, it can be kept in a password manager and piped in with `-i -`. Use a name scoped to the purpose of the key, since age identities are cheap to generate and can't be rotated. |
There was a problem hiding this comment.
Should you advocate for password encrypting the identity before storing on a 1password or other system? If those systems are compromised your identies are plain text and exposed.
Author
There was a problem hiding this comment.
Thanks, good point. I added a paragraph making the trust model explicit (the identity is only as safe as the password manager entry), plus an example of storing a passphrase-protected, armored identity instead (age-keygen | age -p -a), which works with -i - and prompts for the passphrase. I also noted that the SOPS temp file holds the key unencrypted on disk.
Address review feedback: note that an identity stored in a password manager is only as safe as the password manager, show how to store a passphrase-protected armored identity instead, and warn that the SOPS temporary file holds the identity unencrypted.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
age -d -i -.This is docs-only, no code changes — both patterns already work with the existing
-i -support.Fixes #722
🤖 Generated with Claude Code
https://claude.ai/code/session_019dHe95FDNgtHdZk7uEDbdc