OpenPGP encryption for iPhone, Android and desktop

Yes. Encryption happens locally on your device using your recipient's public key. Only the holder of the matching private key can decrypt the result. PGPony has no server in the path and no way to read your messages.

Yes. PGPony for Desktop runs on macOS 11 or later (Apple silicon and Intel), Windows 10 or later (x64), and Linux on x86-64 and ARM64 (.deb, AppImage, a portable tarball, and the AUR). It encrypts, decrypts, signs and verifies messages and files, handles post-quantum keys and hardware security keys over USB, finds keys through WKD and key servers, makes encrypted backups, and has a command-line interface. Like the phone apps it's free, and it's open source under Apache-2.0 at PGPonyDesktop. Downloads are on the desktop page.

Yes, that's the whole point. Import your existing OpenPGP key (Ed25519, Cv25519, RSA or DSA, or a post-quantum key made by GnuPG 2.5) and it works with gpg in both directions. Encrypt on your phone and decrypt on your laptop, or the other way around.

Your keys live on your devices, not on a server, so a lost device takes its keys with it unless you have a backup. Encrypted backup is built into PGPony on iPhone, Android and desktop: make one after you create or import a key, and keep it somewhere off the device (a password manager, an encrypted USB drive, another computer). On iPhone, iCloud Keychain sync can carry your public keys to a new device, but from 8.3.0 on your secret keys never leave the device, so the backup is what restores them. If your private key lives on a hardware security key, it was never on the phone in the first place. With no backup and no card, the key and anything encrypted to it are gone. That's the trade-off of encryption nobody else can open.

Signal is the best secure messenger there is, but it only works inside Signal. PGPony encrypts any text or file, which you can then send through any channel: email, SMS, Slack, a paste site, a public forum. Use Signal for everyday chat. Use PGPony for everything else.

The standard is old (RFC 4880 is from 2007), but it's also open, portable, and still evolving. RFC 9580 (2024) modernized the whole stack with Ed25519, X25519, SEIPDv2 authenticated encryption (AEAD-OCB), and Argon2, and post-quantum keys are now being added on top. PGPony supports all of it: full v4 (generate, encrypt, sign, decrypt, verify), full OpenPGP v6, and post-quantum composite keys.

Yes, fully. You can create OpenPGP v6 keys (an Ed25519 primary with an Ed25519 signing subkey and an X25519 encryption subkey), encrypt to v6 recipients with SEIPDv2 authenticated encryption, and sign and verify with v6 keys. A picker on the Generate screen lets you choose v6 or classic v4. PGPony's v6 output has been verified against Sequoia (sq), a reference RFC 9580 implementation, and against the official RFC 9580 Appendix A test vectors.

Yes. PGPony can generate and use composite post-quantum keys, which pair ML-KEM (the NIST post-quantum key-exchange standard) with a classical X25519 or X448 key, so a message stays protected as long as either half holds. ML-KEM-768 and ML-KEM-1024 work on iPhone and Android, and the desktop app handles ML-KEM-768. Android also has post-quantum signatures (ML-DSA), with iPhone and desktop following. Support in other OpenPGP apps is still thin, so keep a classical key for anyone who isn't on PGPony or GnuPG 2.5.

For v4 keys, yes, byte-exact and verified against gpg 2.4.x. PGPony also exchanges post-quantum keys and messages with GnuPG 2.5. v6 keys and v6-encrypted messages interoperate with RFC 9580 implementations such as Sequoia, but GnuPG does not implement RFC 9580 v6, so a v6 key or message won't work with GnuPG today. The rule of thumb: choose v6 for the most modern crypto and Sequoia-class interoperability; choose v4 if you need to exchange with GnuPG users right now.

v6 (RFC 9580) modernizes several things over v4 (RFC 4880): fingerprints use SHA-256 instead of SHA-1; messages use SEIPDv2 authenticated encryption (AEAD-OCB), which cryptographically detects tampering, instead of v4's bolt-on MDC; Ed25519 and X25519 are represented natively without the legacy OID wrapping v4 needed; and secret keys can be protected with memory-hard Argon2. v4 remains the most broadly compatible format, and it's the one GnuPG users can exchange with today.

Yes. PGPony uses an OpenPGP smart card for private-key operations (sign, decrypt, encrypt-and-sign, and editing key expiration), with the private key never leaving the card. Each operation is authorized by your card PIN. On iPhone the card connects over NFC or USB-C (Lightning keys such as the YubiKey 5Ci aren't supported), on Android over NFC or USB, and on desktop over USB. Cards holding ECC (Ed25519 and Curve25519) or RSA keys both work. You can change the card PIN from the key's detail screen, and signed messages decrypted on a card show a verified-signer badge. Hardware-key support was validated end to end on YubiKey 5 NFC and Token2, cross-checked with GnuPG.

Yes. PGPony can generate a fresh Ed25519 + Curve25519 keypair on the card itself, so the private key is created on the token and never exists on your device. This is the strongest form of hardware-key protection: there is no on-device copy that could leak. You can still import an existing key to a card if you prefer, and full card management (admin PIN change, unblock a locked PIN, factory reset) is built in.

Mostly, yes. The Android app and the desktop app are open source in full under Apache-2.0: PGPonyAndroid (the same source the F-Droid build is made from, and every release rebuilds byte for byte) and PGPonyDesktop. The cryptographic core is also public as a standalone library for both phone platforms: PGPonyCore (Swift) and PGPonyCore-Kotlin (Kotlin), covering key generation, the OpenPGP packet parser and builder, and the encryption and signing paths. On iOS, the app shell around the core (UI and platform glue) stays closed, but the code that seals your messages is public. See the open-source page.

No. PGPony is free on iPhone, Android and desktop. No subscriptions, no in-app purchases, no ads, no upsells. It's made by one independent developer who thought PGP deserved better apps.

It stops anyone who picks up your unlocked phone from opening PGPony without authenticating. It does NOT add cryptographic protection to your keys; they're already encrypted at rest by the OS. There's also an optional second prompt before every decryption, for high-stakes situations.

Your messages, files and private keys never leave your device. What does touch the network is key handling: WKD lookups query the recipient's own mail domain, key search and upload go to the key servers you have enabled (keys.openpgp.org, and our own keys.pgpony.app, which logs requests without IP addresses or query strings), and automatic key refresh sends the fingerprints of the keys you hold to those servers so revocations reach you. Refresh is on by default on iPhone and in the Google Play build, and you can turn it off. On iPhone and Android, Offline mode blocks every network request. iCloud Keychain sync on iPhone is optional and uses Apple's end-to-end encrypted keychain. The apps contain no analytics SDKs, no crash reporters, and no advertising IDs.