An age plugin that derives encryption keys from BIP39 seed phrases. This lets you use a memorable 24-word mnemonic as your age identity.

The environment variable AGE_PLUGIN_BIP39_CACHE configures cache TTL for derived keys (default: 10m, 0 to disable). Uses the Linux kernel keyring to store them in memory.

age-plugin-bip39 -k > identity.txt

An interactive TUI lets you accept a generated phrase or enter your own. The public key is printed to stderr, the identity to stdout.

For non-interactive use, pipe a mnemonic on stdin:

echo "abandon abandon ... art" | age-plugin-bip39 -k > identity.txt

Use the public key shown during keygen:

age -r age1... -o secret.age secret.txt

age -d -i identity.txt secret.age > secret.txt

age will invoke the plugin automatically and prompt for your seed phrase.

The 24-word mnemonic encodes 256 bits of entropy. The plugin extracts this entropy via BIP39, derives an X25519 keypair using the same method as melt (SHA-512 of the entropy, clamped to a Curve25519 scalar), and uses the standard age X25519 recipient mechanism for encryption and decryption.