You might want to read this paragraph from @FiloSottile: > The only reason to use more than 128 bits of key is to protect against multi-user attacks. […] There

You might want to read this paragraph from @FiloSottile: > The only reason to use more than 128 bits of key is to protect against multi-user attacks. […] There are two ways to protect against that: larger keys or nonces. age uses a 128-bit per-file nonce fed into HKDF, making the total search space 128 + 128 = 256 bits, safe in every multi-user scenario, too. This is big. Without those multi-user attacks Age is much safer than I initially thought. The tiny security increase we'd get by going to 256-bit keys is not worth making a breaking change. Not by itself at least.