AGEX Bundle Rewrapper

AGEX Bundle Rewrapper | Online Free Tool | Elysia Tools

Tool usage guide

Learn when to use this tool, what it supports, and how real users apply it.

Key facts

Category: Security
Input types: file, text, select, textarea
Output type: json
Sample coverage: 4
API ready: Yes

Overview

The AGEX Bundle Rewrapper allows you to securely rotate passphrases or hand over ownership of your AGEX bundles. By decrypting your existing bundle with its current passphrase, the tool generates a fresh bundle encrypted with a new passphrase and updated Argon2id/XChaCha parameters, with optional support for Ed25519 cryptographic signing.

When to use

When you need to perform routine passphrase rotation for security compliance on your AGEX encrypted bundles.
When transferring ownership of an encrypted bundle to another team member or external partner.
When upgrading the key derivation strength parameters of an existing AGEX bundle.

How it works

1Upload the target AGEX bundle file and enter its current decryption passphrase.
2Specify the new passphrase and select the desired key derivation strength (interactive, moderate, or sensitive).
3Optionally provide a signer ID and an Ed25519 private key to cryptographically sign the newly generated bundle.
4Execute the rewrap process to generate and download the newly encrypted AGEX bundle JSON.

Use cases

Rotating credentials for sensitive configuration files stored in AGEX format.
Handing over encrypted database credentials to a new system administrator.
Re-signing and re-encrypting legacy AGEX bundles with stronger Argon2id parameters.

Examples

1. Routine Passphrase Rotation

Security Administrator

Background

A security administrator needs to rotate the passphrase of a production AGEX configuration bundle every 90 days to comply with company security policies.

Problem

The administrator needs to update the passphrase without exposing the raw contents of the bundle permanently.

How to use

Upload the existing config.agex.json file, input the current passphrase, enter the new secure passphrase, set the strength to 'sensitive', and run the rewrapper.

{
  "strength": "sensitive",
  "currentPassphrase": "old-passphrase-123",
  "newPassphrase": "new-passphrase-456"
}

Outcome

A new AGEX bundle is generated with updated Argon2id parameters and the new passphrase, ready for deployment.

2. Ownership Handoff with Cryptographic Signing

DevOps Engineer

Background

A DevOps engineer is handing over deployment credentials to a client and needs to re-encrypt the bundle with the client's passphrase while signing it with the company's private key.

Problem

The client requires a new passphrase and verification that the bundle originated from the trusted engineer.

FAQ

Does this tool store my passphrases or decrypted bundle data?

No, all decryption and re-encryption processes occur locally or in memory during execution, and no data is stored.

What encryption algorithms are used during the rewrap?

The tool uses Argon2id for key derivation and XChaCha20-Poly1305 for symmetric encryption.

Can I sign the new bundle during the rewrapping process?

Yes, you can optionally provide a Signer ID and a base64-encoded Ed25519 private key to sign the output bundle.

What do the different strength options mean?

The strength options (interactive, moderate, sensitive) adjust the Argon2id memory and CPU limits used to derive the encryption key.

What file formats does the tool accept?

The tool accepts AGEX bundle files, typically formatted as JSON.

{
  "strength": "moderate",
  "currentPassphrase": "devops-temp-pass",
  "newPassphrase": "client-final-pass",
  "signerId": "devops-team-01",
  "signerPrivateKey": "dGVzdC1wcml2YXRlLWtleS1iYXNlNjQtc3RyaW5nLWV4YW1wbGU="
}

What this tool helps you do

Run this tool

Prepared example runs

Inputs

Result

Examples that match this tool

Continue with connected tools and hubs

Prepared example runs

Inputs

Result

Learn when to use this tool, what it supports, and how real users apply it.

Key facts

Overview

When to use

How it works

Use cases

Examples

1. Routine Passphrase Rotation

2. Ownership Handoff with Cryptographic Signing

FAQ

Distributed Tracing Samples

AWS EventBridge Samples

JWT Samples

PDF Samples

Age-like Encrypted File Bundle

PDF Form Fill Batch

AGEX Secure Share Note

AGEX Bundle Diff

AGEX Secure File Bundle and Handoff Tools

JSON Interchange and Format Translation Tools

JSON Inspection, Diff, and Transformation Tools

JSON Schema, Mock Data, and API Fixture Generators