# How can I encrypt and decrypt files on my VPS?
Source: https://vpsdime.com/knowledgebase/technical-questions/encrypt-files
Last reviewed: 2026-07-02
Summary: File-level encryption done properly, age as the modern tool (one command each way), GPG as the everywhere-installed classic (symmetric passphrase or public-key), what each protects against on a VPS, encrypting backups before they leave the box, and the passphrase-loss warning that has no fine print.

## What this is

Encrypting individual files and archives, a database dump before it leaves the server, a credentials file at rest, an archive only you should ever open. Two tools cover it: **age**, the modern one designed to be un-misusable, and **GPG**, the classic that's already installed everywhere. (Whole-disk encryption is a different topic with different trade-offs on a VPS; this page is about files.)

First, the honest threat model: file encryption protects data **at rest and in transit**, the copy in your off-site bucket, the archive on a stolen backup drive. It does *not* protect a file from someone who has root on the box *while you decrypt and use it*, [keeping the server unowned](https://vpsdime.com/knowledgebase/getting-started/securing-your-vps) remains job one.

## age: the modern answer

[age](https://github.com/FiloSottile/age) (`apt install age`) does one thing with no footguns:

**Passphrase mode**, one file, one secret:

```
age -p secrets.tar > secrets.tar.age        # prompts for a passphrase
age -d secrets.tar.age > secrets.tar        # prompts to decrypt
```

**Keypair mode**, encrypt *to* a recipient (yourself, elsewhere):

```
age-keygen -o key.txt                        # once; keep key.txt safe, off-box
age -r age1xyz... backup.tar > backup.tar.age    # encrypt to the public key
age -d -i key.txt backup.tar.age > backup.tar    # decrypt with the private key
```

The keypair pattern is the good one for **backups**: the *public* key lives on the VPS and encrypts nightly dumps; the *private* key lives only on your machine, so a fully compromised server still can't read its own backup archive.

## GPG: the everywhere classic

Already on every distro, and the format the wider world speaks:

```
gpg -c backup.tar                    # symmetric: passphrase, makes backup.tar.gpg
gpg backup.tar.gpg                   # decrypt (prompts)
```

Public-key mode mirrors age's (generate with `gpg --gen-key`, encrypt with `-e -r you@example.com`), with more machinery (keyrings, trust) than a single-server workflow strictly needs, which is exactly why age exists. Use GPG when interoperability matters (the other side already uses it); use age when you're choosing fresh.

## Where this fits your backups

If you followed [the backup guide](https://vpsdime.com/knowledgebase/getting-started/backing-up-your-vps), note that **restic already encrypts everything** it stores, that's built in, no extra layer needed. Manual patterns, a dump uploaded with rclone, an archive parked in object storage, are where `age -r` before upload earns its place:

```
mysqldump --single-transaction mydb | gzip | age -r age1xyz... > mydb-$(date +%F).sql.gz.age
```

## The warning with no fine print

**A lost passphrase or private key is the data, gone.** There is no reset flow, no support ticket ([ours included](https://vpsdime.com/knowledgebase/support-coverage/what-support-covers)) that recovers properly encrypted data. Store the passphrase in a password manager and keep a copy of the key file somewhere that isn't the VPS, before the first real file is encrypted, not after.

## Still need help?

You can [open a support ticket](https://vpsdime.com/open-ticket/). So we can help on the first reply, it's worth mentioning:

- the VPS hostname or IP,
- the tool (age or GPG), the exact command, and the error. (Never include the passphrase itself.)

## Related questions

- "How do I encrypt a file with a password on Linux?"
- "Should I use GPG or age?"
- "How do I encrypt backups before uploading them?"
- "Can encrypted files be recovered if I lose the passphrase?"