Elysia Tools
Navigation
Workflow Playbook
Package a file as AGEX, inspect visible metadata, choose passphrase and signature settings, and verify the handoff before delivery.
Hubs
Use this workflow when a file must cross a person or team boundary as an AGEX bundle and the handoff must be reviewable. It is for operators, support teams, and recipients who need to check visible metadata, protection choices, signature status, and a recipient-style decrypt test.
Keep the source within the AGEX v1 limit of 50 MB. Decide whether the requirement is confidentiality only or confidentiality plus a signature. Keep the passphrase and signing private key out of the bundle, and share secrets through a separate channel.
Use agex-passphrase-strength-checker for decision support, not a security guarantee. If a signature is required, use agex-keypair-generator, protect the private key, and confirm the public key independently. Create the package with age-like-encrypted-file-bundle, then use agex-bundle-inspector to read filename, size, MIME type, KDF and cipher settings, and signature presence without decrypting plaintext.
Use agex-bundle-metadata-redactor to reduce visible metadata. Its result reports changed fields, whether ciphertext and nonce stayed unchanged, and whether an existing signature was stripped. Use agex-bundle-rewrapper when the current passphrase is known and fresh protection is needed; use agex-bundle-diff to review the change. Finally verify with agex-signature-verifier, test decryption with age-like-encrypted-file-bundle, and generate agex-secure-share-note. The note is an instruction artifact, not a transport or identity service. Accept the handoff only after expected metadata, decryption, signature decision, and external recipient acknowledgement are recorded.
Workflow playbook
Run the passphrase checker and use its warnings and profile recommendation as guidance, not a guarantee. If signing is required, generate or select an Ed25519 keypair, protect the private key, and confirm the public key independently.
Encrypt the source with the chosen passphrase and optional signer. Inspect the bundle before sharing or decrypting, without exposing plaintext, and record its version, file metadata, protection settings, and signature presence.
Use the redactor for visible filename, MIME type, or signer-label changes, and check whether a signature was stripped. Use the rewrapper for a known current passphrase that must change. Compare original and final bundles so the intended differences are observable.
Verify the signature with the trusted public key when expected, run a recipient-style decrypt test, compare restored file details with the source, and generate the plain-language share note. Share the passphrase separately and accept delivery only after the checks are recorded.
Choose the metadata redactor when the current encryption should remain while filename, MIME type, or signer ID exposure is reduced. Choose the rewrapper when the current passphrase is known and a new passphrase or fresh Argon2id parameters are needed. Redaction can remove an existing signature, so it is not a re-signing step.
Use the keypair generator and verifier when provenance is required. If confidentiality is the only requirement, omit the signature and record that no signer check was performed. A verified signature matches bytes to a public key but does not prove who controls that key.