[pgpony]
download
// 01_download

PGPony for Desktop.

OpenPGP for macOS, Linux and Windows. Encrypt, decrypt, sign and verify messages and files, manage your keyring, and use a hardware security key over USB — all on device. Linux ships for x86_64 and ARM64, as a .deb, a portable tarball, an AppImage or from the AUR. Like the phone apps: no accounts, no ads, no analytics, no tracking.

Download for macOS (.dmg)
Download for Linux (.deb)
Download for Windows (.msi)
version 2.1.3 released 2026-08-23 runtime bundled licence Apache-2.0
macOS · sha256
a0e40f9124053940fac6060b91f11741af629de94513f494422893238fcff828
Linux · sha256
ab926e87112980fcf115f529da04943cfb8396bf1da88c16f1a7769037ef7fff
Windows · sha256
847aa0be428f2a2db569b9f3c35807890ac00e026d580a953b708c38d48a8768
More Linux builds
PackageArchsha256
Debian / Ubuntu (.deb) ARM64 feab751c33914de7a59f94bb7b1633e1f979f019881cbbf4e033d676c068548b
Portable tarball (.tar.gz) x86_64 1835aacf9d93e2963147e5528eadf9740ab4ca341286457319b8baf21df0027b
Portable tarball (.tar.gz) ARM64 182b7bcd8a99a2717095e2e0060c2b5321936a13ba47f72633d5a4ded2a25f61
AppImage x86_64 41863c60d4a5b16358043b307852c3af520887ce6f9ea3cc20f063fe389bcc1c
AppImage ARM64 f1c09fc557cf043c2091c37487f325dc9baf2684c4b459dcfa47eb404d011d54
Arch Linux (AUR) x86_64 · ARM64 pgpony-bin

The tarball and AppImage are self-contained and need no install step — extract and run bin/PGPony, or make the AppImage executable and run it. Neither registers file associations, because nothing installs a desktop entry for them; the .deb and the AUR package do.

What's new in 2.1.3.
A compatibility hardening release. Passphrase-protected messages and exports already use the iterated-salted format that every version of GnuPG can read, rather than Argon2, which older GnuPG builds cannot. This release adds a regression test so that stays true, matching the same compatibility fix in the PGPony Android app. No change to how you use the app. Thanks to darkvegas for the report.
// 02_not_a_rewrite

The same engine your phone runs.

The desktop app compiles the exact OpenPGP engine the PGPony phone apps ship — packet handling, v4 and v6 (RFC 9580) keys, the post-quantum ML-KEM composite layer in both wire formats, the OpenPGP smart-card stack, MIME — on the same Bouncy Castle version.

  • Encrypt, decrypt, sign, verify. Text, files, and PGP/MIME mail bundles, with signature verification banners and never-overwrite outputs.
  • Post-quantum keys. ML-KEM-768 + X25519 composites in both the IETF (v6) and GnuPG/LibrePGP formats — generate, encrypt and decrypt.
  • Hardware security keys over USB. On-card key generation, decrypt, sign, PIN management and factory reset, over PC/SC.
  • Backups that cross devices. Encrypted .pgpony archives restore to and from the phone apps, with a recovery code.
  • Key discovery. WKD, the verifying keyserver and per-server publishing, with optional Tor routing and an onion mirror.
  • Password store. A read-only pass browser with hardware-key entries, an auto-clearing clipboard and live TOTP.
  • A command line. The pgpony CLI shares the app's keyring, streams stdin to stdout, and never takes a passphrase as a plain flag.
  • Six languages. English, Deutsch, Español, Français, 日本語 and Português (BR), switchable without a restart.
// 03_verify

Check what you downloaded.

Every artifact ships with a detached PGP signature, and each release carries a signed SHA256SUMS covering all three. A PGP app should sign its own releases with its own kind of key — this one does, using the NorseHorse release key published on this site and over WKD. 

gpg --verify PGPony-macOS.dmg.asc PGPony-macOS.dmg
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c SHA256SUMS
Where the signatures live. The .asc files and SHA256SUMS are attached to the release alongside the installers, so you can verify before you ever run the thing.
// 04_requirements

What it needs, and what your OS will say.

  • macOS. macOS 11+ on Apple silicon
  • Linux. Debian or Ubuntu, x86-64
  • Windows. Windows 10 or later, x64
  • No Java to install. The runtime is bundled inside each installer.
  • Hardware keys on Linux need the pcscd daemon, which the .deb declares as a dependency and your package manager will pull in.
macOS opens it cleanly. The app is signed with a Developer ID certificate and notarized by Apple, with the ticket stapled to the disk image — so it opens without a warning, and without needing a network connection to check.
Windows will warn on first run. The installer is not yet code-signed, so SmartScreen shows an "unrecognized app" prompt — choose More info, then Run anyway. If you would rather not take that on trust, verify the PGP signature and checksum above first. A code-signing certificate is being evaluated.
Linux installs with the dependency. sudo apt install ./PGPony-linux.deb pulls in PC/SC support for hardware keys.
// 05_source

Read it yourself.

The desktop source is published at github.com/norsehorse-dev/PGPonyDesktop under Apache-2.0, alongside the Android app and the shared crypto cores. The OpenPGP engine is vendored verbatim from the Android repository rather than reimplemented, so there is one implementation to audit, not two.