# AGEX Bundle Rewrapper Re-encrypt an AGEX bundle with a new passphrase and fresh Argon2id/XChaCha parameters > Canonical page: https://elysiatools.com/en/tools/agex-bundle-rewrapper - **Category:** Security - **Keywords:** agex, bundle rewrap, passphrase rotation, re-encrypt ## Overview This tool is useful for passphrase rotation or ownership handoff. It decrypts the existing AGEX bundle with the current passphrase, then creates a fresh bundle protected by the new passphrase. If you want the new bundle signed, provide a signer ID and private key. ## Inputs - **Bundle File** (file) - **Current Passphrase** (text): Enter the current bundle passphrase - **New Passphrase** (text): Enter the new bundle passphrase - **Strength** (select) - **Signer ID** (text): Optional signer label for the new bundle - **Signer Private Key** (textarea): Optional base64 Ed25519 secret key used to sign the rewrapped bundle ## When to use - When you need to perform routine passphrase rotation for security compliance on your AGEX encrypted bundles. - When transferring ownership of an encrypted bundle to another team member or external partner. - When upgrading the key derivation strength parameters of an existing AGEX bundle. ## How it works - Upload the target AGEX bundle file and enter its current decryption passphrase. - Specify the new passphrase and select the desired key derivation strength (interactive, moderate, or sensitive). - Optionally provide a signer ID and an Ed25519 private key to cryptographically sign the newly generated bundle. - Execute the rewrap process to generate and download the newly encrypted AGEX bundle JSON. ## Use cases - Rotating credentials for sensitive configuration files stored in AGEX format. - Handing over encrypted database credentials to a new system administrator. - Re-signing and re-encrypting legacy AGEX bundles with stronger Argon2id parameters. ## Frequently asked questions ### Does this tool store my passphrases or decrypted bundle data? No, all decryption and re-encryption processes occur locally or in memory during execution, and no data is stored. ### What encryption algorithms are used during the rewrap? The tool uses Argon2id for key derivation and XChaCha20-Poly1305 for symmetric encryption. ### Can I sign the new bundle during the rewrapping process? Yes, you can optionally provide a Signer ID and a base64-encoded Ed25519 private key to sign the output bundle. ### What do the different strength options mean? The strength options (interactive, moderate, sensitive) adjust the Argon2id memory and CPU limits used to derive the encryption key. ### What file formats does the tool accept? The tool accepts AGEX bundle files, typically formatted as JSON. ## Related tools - [Age-like Encrypted File Bundle](https://elysiatools.com/en/tools/age-like-encrypted-file-bundle): Encrypt or decrypt portable password-based file bundles with Argon2id, XChaCha20-Poly1305, and optional signatures - [PDF Form Fill Batch](https://elysiatools.com/en/tools/pdf-form-fill-batch): Fill one PDF form template with an array of records and output one filled PDF per record (ZIP) or a merged PDF - [AGEX Secure Share Note](https://elysiatools.com/en/tools/agex-secure-share-note): Generate a plain-language share note for an AGEX bundle so recipients know how to decrypt and verify it safely - [AGEX Bundle Diff](https://elysiatools.com/en/tools/agex-bundle-diff): Compare two AGEX bundles and highlight metadata or protection-setting differences - [AGEX Bundle Inspector](https://elysiatools.com/en/tools/agex-bundle-inspector): Inspect AGEX bundle metadata without decrypting the file contents - [AGEX Signature Verifier](https://elysiatools.com/en/tools/agex-signature-verifier): Verify the Ed25519 signature attached to an AGEX bundle - [Time Series Anomaly Detector](https://elysiatools.com/en/tools/time-series-anomaly-detector): Upload CSV or JSON time series data, detect anomalies with Z-Score and IQR methods, and return a chart-backed report - [AGEX Bundle Metadata Redactor](https://elysiatools.com/en/tools/agex-bundle-metadata-redactor): Rewrite exposed AGEX metadata like original filename or signer ID without touching ciphertext bytes ## Samples - [Distributed Tracing Samples](https://elysiatools.com/en/samples/distributed-tracing-samples): Comprehensive distributed tracing examples using Jaeger, OpenTelemetry, and other modern observability tools for microservices architecture - [AWS EventBridge Samples](https://elysiatools.com/en/samples/eventbridge-samples): AWS EventBridge examples including event buses, rules, targets, schema registry, custom events, and cross-account event routing for serverless event-driven architecture - [JWT Samples](https://elysiatools.com/en/samples/jwt-samples): Comprehensive JWT examples from basic token structure to advanced security implementations - [PDF Samples](https://elysiatools.com/en/samples/pdf-samples): Generated PDF samples from tools dated 2026-02-01 to 2026-02-10 ## Related content - [AGEX Secure File Bundle and Handoff Tools](https://elysiatools.com/en/hubs/agex-secure-file-sharing): Create encrypted AGEX bundles, inspect metadata, rotate passphrases, verify signatures, redact exposed fields, and prepare safer secure-file handoffs in one focused hub. - [JSON Interchange and Format Translation Tools](https://elysiatools.com/en/hubs/json-convert): Compare JSON conversion tools for CSV, YAML, TOML, GraphQL, XML, Markdown, Excel, BSON, EDN, and related structured formats in one hub. - [JSON Inspection, Diff, and Transformation Tools](https://elysiatools.com/en/hubs/json-utility): Compare JSON formatting, diffing, path inspection, schema validation, merging, transformation, and export tools in one hub for API and data workflows. - [JSON Schema, Mock Data, and API Fixture Generators](https://elysiatools.com/en/hubs/json-generate): Curated tools for JSON schema generation, mock payload building, and API fixture preparation in one hub.