Real PGP encryption,
in your pocket.

Yes. Encryption happens locally on your device using your recipient's public key. Only the holder of the corresponding private key can decrypt the result. PGPony has no server in the path and no ability to read your messages.

Yes — that's the whole point. Import your existing OpenPGP key (Ed25519, Cv25519, RSA, or DSA) and it round-trips perfectly with gpg 2.4+. You can encrypt on your phone and decrypt on your laptop, or vice versa.

If you had iCloud Keychain sync turned on, your keys are restorable on a new device signed into your Apple ID. Otherwise, your keys are gone and so is anything encrypted to them — that's the point of strong encryption. Always back up your private key somewhere safe (a password manager export, an encrypted USB drive, paper in a safe).

Signal is the best secure messenger on the planet — but it only works inside Signal. PGPony encrypts arbitrary text and files, which you can send through any channel: email, SMS, Slack, a paste site, a public forum. Use Signal for everyday chat. Use PGPony for everything else.

The standard is old — RFC 4880 is from 2007 — but it's also open, portable, and updated. RFC 9580 (2024) modernized the whole stack with Ed25519, X25519, SEIPDv2 authenticated encryption (AEAD-OCB), and Argon2. PGPony supports both: full v4 (generate, encrypt, sign, decrypt, verify) and full OpenPGP v6 — including v6 key generation, encrypting to v6 recipients with SEIPDv2, and v6 signing and verification.

Yes — fully. You can create OpenPGP v6 keys (an Ed25519 primary with an Ed25519 signing subkey and an X25519 encryption subkey), encrypt to v6 recipients with SEIPDv2 authenticated encryption, and sign and verify with v6 keys. A picker on the Generate screen lets you choose v6 or classic v4. PGPony's v6 output has been verified against Sequoia (sq), a reference RFC 9580 implementation, and against the official RFC 9580 Appendix A test vectors.

Yes. Pair an OpenPGP NFC smartcard and PGPony will use it for private-key operations — sign, decrypt, encrypt-and-sign, and edit key expiration — with the private key never leaving the card. Each operation is authorized by your card PIN and a tap. You can also change the card PIN from the key's detail screen, and signed messages decrypted on a card show a verified-signer badge. Hardware-key support was validated end-to-end on YubiKey 5 NFC and Token2, cross-checked with GnuPG. The card must hold ECC keys (Ed25519 signing, Curve25519 encryption); RSA-only cards aren't supported, and your phone needs NFC.

Yes. PGPony can generate a fresh Ed25519 + Curve25519 keypair on the card itself over NFC — the private key is created on the token and never exists on the phone. This is the strongest form of hardware-key protection: there is no on-device copy that could leak. You can still import an existing key to a card if you prefer, and full card management (admin PIN change, unblock, factory reset) is built in.

The cryptographic core is — fully, under Apache-2.0, on both platforms: PGPonyCore (Swift) and PGPonyCore-Kotlin (Kotlin). That is the part that matters for trust: key generation, the OpenPGP packet parser and builder, and the encryption and signing paths. You can read it, build it, and audit it. The app shells around the core (UI and platform glue) stay closed, but the math that seals your messages is public. See the open-source page.

For v4 keys, yes — byte-exact, verified against gpg 2.4.x. v6 keys and v6-encrypted messages interoperate with RFC 9580 implementations such as Sequoia, but current GnuPG does not yet implement RFC 9580 v6, so a v6 key or message won't work with GnuPG today. The rule of thumb: choose v6 for the strongest, most modern crypto and Sequoia-class interoperability; choose v4 if you need to exchange with GnuPG users right now.

v6 (RFC 9580) modernizes several things over v4 (RFC 4880): fingerprints use SHA-256 instead of SHA-1; messages use SEIPDv2 authenticated encryption (AEAD-OCB), which cryptographically detects tampering, instead of v4's bolt-on MDC; Ed25519 and X25519 are represented natively without the legacy OID wrapping v4 needed; and secret keys can be protected with memory-hard Argon2. v4 remains the most broadly compatible format — notably the one GnuPG users can exchange with today.

Not yet. PGPony is iOS + Android only today. Since PGPony is fully standards-compliant, your existing desktop OpenPGP setup (GnuPG, Thunderbird, Kleopatra, GPG Suite) works perfectly alongside it.

No. PGPony is free to download and use. No subscriptions, no IAPs, no ads, no upsells. Just an app a solo developer made because mobile PGP deserved better.

It prevents anyone who picks up your unlocked phone from opening PGPony without authenticating. It does NOT add cryptographic protection to your keys — they're already encrypted at rest by the OS. There's also an optional second prompt before every decryption, for high-stakes scenarios.

No, by default. Optional features hit external servers: WKD lookups query the recipient's mail domain, HKP search queries keys.openpgp.org over TLS 1.3, and iCloud sync uses Apple's end-to-end encrypted keychain. Every one of these is opt-in. The app contains no analytics SDKs, no crash reporters, and no advertising IDs.