Free guide · Francisco Arrieta · 7 min

Encrypt the files that still have to be secret in 2040

Find the handful of files with a long confidentiality life and encrypt them so a future computer cannot open them

Encrypting a file is not one decision, it is two. Almost everybody gets the first one right and never notices the second one exists.

Most files do not need to stay secret for long. An invoice, a delivery address, a password reset email. Nobody is going to care in five years, and if the encryption on them turned out to be weak in 2035 the answer would be a shrug.

Then there is the other pile. The NDA with a term measured in decades, and the documents it covers. Medical or legal records you are holding for someone else. Source code you licensed under conditions that outlive the contract. A due diligence folder from a deal that never closed.

For that pile the useful question is not whether the file is encrypted. It is how long the encryption has to hold, because anything an attacker copies today they can simply keep. Storage is cheap and patience is free. Something unreadable now, sitting on a disk, becomes readable the day the method protecting it stops being hard.

Here is the part that surprises people. The strength of the cipher scrambling your file is almost certainly fine. NIST’s own position is that Grover’s algorithm, the quantum attack on symmetric encryption, will likely give “little or no advantage in attacking AES,” and that AES 128 “will remain secure for decades to come.” Symmetric encryption is not the fragile half.

The fragile half is public key encryption, which is what most tools reach for by default when you encrypt a file to somebody. That is the piece a large quantum computer would break, and it is the piece NIST spent eight years standardizing replacements for.

The cipher is not the weak part. The way the key was wrapped is.

Before you start

You need a terminal and about ten minutes. Nothing here requires you to know what a qubit is, and this guide is not going to explain one.

Two words, once, so the steps make sense. Symmetric encryption uses one secret, a passphrase, for both locking and unlocking. Public key encryption uses a pair, so somebody can lock a file for you without knowing your secret. The convenience of the second one is exactly what makes it the vulnerable one.

Step 1

Decide which files are actually in the long pile

Do this before you encrypt anything, and keep the list short.

The test is a date. Ask what happens if this file is readable by a stranger in 2040. For most of your drive the honest answer is nothing. Put those aside, they are not this job.

What is left is usually smaller than people expect: a handful of client agreements with long confidentiality terms, one or two folders of records held on somebody else’s behalf, maybe an archive from a deal or a case. If your list runs past twenty files, you are sorting by how sensitive things feel rather than by how long they have to stay secret.

Step 2

Check how your existing archives were locked

If you have already encrypted something, find out which of the two decisions you made. You probably do not remember, because most tools never asked.

For a file encrypted with age, the header is plain text and you can just read it:

head -c 200 archive.age

You will see a line starting with ->. If it says -> scrypt, the key was wrapped from a passphrase, which is the durable option. If it says -> X25519, it was wrapped with elliptic curve public key encryption, which is the half that a quantum computer would break.

Both kinds scramble the file itself with ChaCha20-Poly1305, which is why this is not visible from the outside and why nobody catches it. Same cipher on the payload, different lock on the key.

Step 3

Install age

brew install age

Without Homebrew, download the release binary for your platform from the project’s releases page and put it somewhere on your PATH.

Any tool with a passphrase mode works here. age is used in this guide because its header states which method it used, in text, which makes step 5 possible.

Step 4

Encrypt with a passphrase, not a recipient

Bundle the folder first if you have more than one file, then encrypt it:

tar -czf archive.tar.gz long-term-files/
age -p -o archive.age archive.tar.gz

-p is the whole point of the step. It derives the wrapping key from a passphrase you type, through scrypt. The alternative, -r with a recipient’s public key, is the convenient one you would use to send a colleague a file today, and it is the one with the shorter shelf life.

Your passphrase is now carrying the entire archive. Use a long one, five or six unrelated words rather than a short string with substitutions in it. Length is what matters here.

Then remove the unencrypted bundle, since leaving archive.tar.gz next to archive.age makes the whole exercise decorative.

Step 5

Confirm you got what you think you got

Do not trust the flag. Read the file back.

head -c 200 archive.age

It has to say -> scrypt. If it says -> X25519, the -p did not apply and you have produced exactly the thing you were trying to avoid.

Then prove it opens:

age -d archive.age > test.tar.gz
tar -tzf test.tar.gz | head

Do this now, while you still remember the passphrase you just chose.

Step 6

Store the passphrase somewhere that also lasts

You have moved the problem, deliberately, and it is worth being honest about where you moved it to.

The archive is now exactly as durable as the passphrase, and a passphrase in a password manager you stop paying for in 2031 is not a fifteen year plan. Write it down, on paper, in two separate places, and note which file it opens. This is unglamorous and it is the step people skip.

A boundary worth knowing about

The realistic threat to this archive is not a quantum computer. It is your passphrase.

A dictionary attack needs no new physics and has always worked. A weak passphrase gets broken next year by ordinary hardware, on any timeline, quantum or not. That is the risk you have actually taken on by choosing the symmetric route, and it is a fair trade only if you take the passphrase seriously.

Two smaller edges. This protects the file, not its copies, so anything still sitting in an email thread or a shared drive is untouched by all of the above. And NIST’s assessment of AES is a current assessment by people who are good at this, not a guarantee, which is the honest way to hold any statement about cryptography in 2040.

If you have staff

Make the wrapping choice a policy, not a habit. Left alone, people use whichever mode their tool defaults to, which is usually the public key one because it is the convenient one for sending things. Nobody is being careless. They were never told there were two options.

Decide who holds the passphrase before you need it. One person who has left the company is the most common way a long term archive becomes permanently unreadable, and that failure is far more likely than the one this guide is about.

The short version

  1. List only the files that must still be secret in fifteen years. Keep it short.
  2. Check existing archives with head -c 200 file.age. Look for -> scrypt or -> X25519.
  3. brew install age
  4. tar -czf archive.tar.gz folder/ then age -p -o archive.age archive.tar.gz. Delete the tarball.
  5. Confirm the header says -> scrypt, then decrypt it once to prove it opens.
  6. Write the passphrase on paper, in two places, noting what it unlocks.

Sources

Written August 2026. Commands and file format checked against the age v1 specification on 23 August 2026.

Prints to PDF from your browser — colours and all.