Skip to main content
chezmoi supports encrypting files with age, git-crypt, gpg, and transcrypt. Encrypted files are stored in ASCII-armored format in the source directory with the encrypted_ attribute and are automatically decrypted when needed.

​
Adding Encrypted Files

Add files to be encrypted with the --encrypt flag: 
chezmoi add --encrypt ~/.ssh/id_rsa
This will encrypt the file and store it in your source directory (typically ~/.local/share/chezmoi).

​
Editing Encrypted Files

chezmoi edit will transparently decrypt the file before editing and re-encrypt it afterwards: 
chezmoi edit ~/.ssh/id_rsa

​
Template Functions

chezmoi provides template functions for encrypting and decrypting data within templates:

​
encrypt

Encrypts plaintext data using your configured encryption method: 
{{ encrypt "my-secret-value" }}

​
decrypt

Decrypts ciphertext data: 
{{ decrypt "-----BEGIN AGE ENCRYPTED FILE-----..." }}

​
Supported Encryption Methods

chezmoi supports several encryption methods:

age

Modern encryption tool with simple key management

gpg

Traditional GPG/PGP encryption with asymmetric keys

​
Choosing an Encryption Method

Configure your preferred encryption method in ~/.config/chezmoi/chezmoi.toml: 
encryption = "age"  # or "gpg"
Make sure encryption is added to the top level section at the beginning of the config, before any other sections.

​
How It Works

When you add an encrypted file:
  1. chezmoi encrypts the file content using your configured encryption method
  2. The encrypted content is stored with the encrypted_ prefix in the filename
  3. When applying your dotfiles, chezmoi automatically decrypts the file
  4. The decrypted content is written to the target location

​
Best Practices

  • Keep your keys secure: Store encryption keys outside of your chezmoi source directory
  • Use different keys per machine: For sensitive environments, use machine-specific encryption keys
  • Test decryption: Verify you can decrypt files before removing the originals
  • Backup your keys: Without your encryption keys, your encrypted files cannot be recovered

​
Common Use Cases

​
SSH Keys

chezmoi add --encrypt ~/.ssh/id_rsa
chezmoi add --encrypt ~/.ssh/id_ed25519

​
API Tokens

Store API tokens in an encrypted file: 
chezmoi add --encrypt ~/.config/api-tokens

​
Certificates

chezmoi add --encrypt ~/.cert/private-key.pem

​
Next Steps

Configure age

Set up modern encryption with age

Configure GPG

Set up traditional GPG encryption

Build docs developers (and LLMs) love

Get started for freeTalk to us