PGPony

byPsychopath · Security & Privacy

Verified safeOpen source

Download APK

—

No reviews reviews

downloads

8.0

android

AI summary

Open-source OpenPGP client for Android with post-quantum cryptography support. Encrypt, decrypt, sign, and verify messages and files; manage keys; and use hardware security keys over NFC. Version 4.5.0 adds composite ML-DSA and ML-KEM-768+X25519 keys, offline mode, and biometric-gated destructive actions. No accounts, ads, or tracking.

Generated by AI. May contain inaccuracies.

About this app

OpenPGP for Android. Encrypt, decrypt, sign, and verify messages and files, manage your keyring, and use a hardware security key over NFC, all on device.

PGPony has no accounts, no ads, no analytics, and no tracking. The FOSS build contains no Google services and runs fully on de-Googled devices.

Features

- Encrypt, decrypt, sign, and verify text and files. - Modern key generation, including RFC 9580 (OpenPGP v6) Ed25519 and X25519, with Argon2id passphrase protection. - Hardware security keys over NFC (YubiKey 5 NFC, Token2): on-card key generation, decrypt, sign, PIN management, and factory reset. - Read-only password-store (pass) support, including hardware-key entries. - Key discovery via WKD and the keys.openpgp.org verifying keyserver. - Optional contacts integration, QR import and scanning. - Biometric lock and secure-screen protection.

Requirements

- Android 8.0 (API 26) or newer - Optional: an NFC-capable hardware security key

Disclaimer

PGPony is an independent, open-source project developed by norsehorse-dev. It is not affiliated with YubiKey, Token2, or any third-party service. All trademarks belong to their respective owners.

License

Apache 2.0

open source encryption pgp offline security nfc

What's new

v4.5.0Sep 16, 2026

Post-Quantum
Generate post-quantum-only keys (composite ML-DSA) and v4 ML-KEM-768+X25519 encryption keys. - Add post-quantum subkeys to an existing key. - Composite keys can carry multiple User IDs and work as encryption recipients via their ML-KEM subkey. - A warning appears when encrypting to a mix of post-quantum and classical recipients.
Key Management
More granular key creation: choose what goes on the key. - Delete or revoke a subkey (the delete dialog now offers "revoke instead"). - Generate keys without an email address. - Use your own key server repositories and Web Key Directory. - Public keys shared into PGPony can be used to encrypt immediately.
Security
New offline mode toggle in Settings. - Destructive actions sit behind one switch that requires device authentication, on by default.
Smartcard
Decryption with a nistp521 secret key on a SmartPGP JavaCard now works; other NIST curves are covered too.
Fixes
Fixed decrypting files to imported composite ML-KEM keys. - Fixed decrypting messages with multiple recipients including your own composite ML-KEM key. - Fixed non-primary emails being set as primary after upload. - Truncated PGP messages now show a clear "incomplete message". - Post-quantum-only keys can now produce a QR code. - Fixed a stale "Never" expiry shown next to a live subkey date. - Addressed several Google Play stability reports.
Improvements
Encrypt and decrypt pickers now show the email under the name. - Added a subkey selector when a key offers more than one target. - Clearer key-generation publish prompt and onboarding options. - Importing or sharing a key tolerates extra surrounding text.