Hardware key file encryption

Your key is the lock.

Wardlet encrypts files with the security keys you already own. No password, no account, no upload.

$ wardlet init
$ wardlet enc taxes.pdf
$ wardlet dec taxes.pdf.age

Set up once with your keys. Lock a file. Tap a key to open it.

View on GitHub How it works

Source on GitHub Threat model

Free and open source. A command-line tool for Linux today, with a desktop app later that opens the same files. Build from source for now; a packaged download is next.

How it works

Three steps. Files stay where they are.

Set up with your keys

wardlet init adds one or more security keys and shows a recovery code once. Add more later so a lost key is not the end.

enc — lock a file

wardlet enc taxes.pdf replaces it with taxes.pdf.age in the same folder.

dec — tap to open

wardlet dec taxes.pdf.age — plug in a key and tap it. Without a key, the file can't be read.

Files stay where they are — locked in place. Use wardlet index later if you need to find where you put one.

Good for: SSH keys, .env files, tax documents, password-manager exports, scans, private notes.

Why it's different

For people who already carry a security key.

Your keys, not a password

Nothing to invent, type or forget. Works with YubiKey, Trezor and similar FIDO2 keys. Add more than one.

Files stay where they are

A locked file replaces the original in place. No mounted drive, no container, no sync conflicts.

Several keys, one lock

Any key you add opens the files. Adding a key doesn't rewrite them.

A recovery code, shown once

The way back in if every key is lost. Wardlet keeps no copy, so store it in a password manager.

Nothing leaves your machine

No account, no cloud, no upload.

Open format, open source

Files use the age format. The source is public, so you can audit the lock yourself.

When things go wrong

What stays true for files you've locked.

Laptop stolen

Files you've locked stay locked.

Drive copied

Files you've locked stay locked.

Key lost

A second key or your recovery code gets you back in.

Why not just use…?

Other tools solve related problems. Here is how Wardlet differs.

gpg

Capable, but setting up hardware keys takes many manual steps. Wardlet uses FIDO2 keys directly and needs no key management.

Full disk encryption

Full disk encryption protects a powered-off machine. Locked files stay locked on a running machine until you tap your key to open one.

Encrypted containers

Tools like Cryptomator are great for synced vaults, but they use a mounted container and, as far as we know, don't support unlocking with a hardware key. Wardlet locks each file on its own and unlocks with your keys.

age + a FIDO plugin

Underneath, Wardlet uses the age format and FIDO2 hmac-secret — the same building blocks as plugins like age-plugin-fido2-hmac. The difference is the product: several keys and a recovery code in one keyring, files locked in place, and adding a key without rewriting existing locked files. If you already live in the age CLI and manage recipients yourself, a plugin may be enough.

Supported keys

Plug a key in with USB. If it asks for a PIN, that is the same PIN a website asks for.

Key	Status
YubiKey 5 series (incl. 5 NFC)	Tested
Trezor Safe 3	Tested
Nitrokey 3	Should work (FIDO2 hmac-secret)
SoloKeys	Should work (FIDO2 hmac-secret)
YubiKey 4 / NEO	Not supported (no FIDO2)
Trezor One	Not supported

FAQ

Limits and tradeoffs, stated plainly.

What are the limits?: You need compatible FIDO2 keys. Older keys listed as Not supported cannot be used.

Removing a key does not rewrite files already locked. See the next question.

Wardlet does not protect against malware running as you while a file is decrypted or open in an editor.

Linux CLI today. Packaged downloads and other platforms come later.
Where did I put that locked file?: wardlet index prints paths this machine recorded when you locked a file. It needs a key tap. Paths are host-specific; another computer keeps its own list.
If I remove a key, is it revoked from old files?: No. Removing a key updates the keyring so that key cannot open files locked after the change. Files locked before the change are still tied to an older copy of your key settings. Anyone with that key and an older keyring copy can still open them. To cut a key off: remove it, re-encrypt the files you care about, then delete the old locked copies and any old keyring export.
What if I lose every key?: Use the recovery code shown once at setup (and again after you change keys). Store it in a password manager. Wardlet keeps no copy. Lose every key and the code, and the locked files cannot be opened.
Is this an encrypted container?: No. There's no mounted drive or container file. Each file is locked on its own, in the standard age format, and stays where it is.