fnox reencrypt

• Usage: fnox reencrypt [FLAGS] [KEYS]…

Re-encrypt secrets with current provider configuration

When you add or remove recipients from an encryption provider (e.g. age), existing secrets remain encrypted with the old recipient set. This command decrypts and re-encrypts all matching secrets with the current provider configuration.

Arguments

• [KEYS]… — Only re-encrypt these specific secret keys

Flags

• -f --force — Skip confirmation prompt
• -n --dry-run — Show what would be done without making changes
• -p --provider <PROVIDER> — Only re-encrypt secrets from this provider
• --filter <FILTER> — Only re-encrypt matching secrets (regex pattern)
• -h --help — Print help

Examples

After changing recipients, re-encrypt with an identity that can still decrypt the existing ciphertext. Repeat for each affected profile. This changes the encryption, not the underlying secret value.

fnox reencrypt --provider age --dry-run
fnox reencrypt --provider age
fnox reencrypt --provider age --profile staging

Related

• Update age recipients
• Global options, including profile selection and non-interactive mode.