PGPony vs OpenKeychain.

OpenKeychain has been the de facto OpenPGP app on Android since 2014. It\'s free, open source (GPLv3), and deeply integrated with K-9 Mail. PGPony is the modern cross-platform alternative — the same OpenPGP standard, a fresher UI, and the same identity on iOS.

// the short version

Android-only and K-9 Mail user? Stay with OpenKeychain — its K-9 integration is deep and PGPony can\'t match it. Want modern UX, OpenPGP v6 import, QR key exchange, or cross-platform to iPhone? PGPony. You can also run both side-by-side; OpenPGP keys are portable.

At a glance.

PGPonyOpenKeychain
PlatformiOS 17.6+, Android 8.0+Android only
PriceFreeFree
LicenseProprietary; uses Bouncy Castle (open) and audited cryptoGPLv3 (open source)
Key generationEd25519 + Curve25519 default, RSARSA, ECC including Ed25519/Curve25519
OpenPGP v4 (RFC 4880)FullFull
OpenPGP v6 (RFC 9580)Import, decrypt, verify (gen in v6.0)Not yet
K-9 Mail integrationVia Share intent onlyDeep — inline encrypted mail rendering
YubiKey NFCPlanned v6.0Yes
QR code key exchangeYesYes (different format)
WKD + HKP keyserver searchYesYes
Biometric app lockFingerprint, with optional per-decryption promptPassphrase only
Material 3 UIYesMaterial 2-era
iOS counterpartSame app, same keyNone
Active development cadenceActiveSlower in recent years

Honest tradeoffs.

Where OpenKeychain wins

  • K-9 Mail integration is real. OpenKeychain implements the OpenPGP API spec that K-9 understands natively. Inline encrypted-message rendering, recipient suggestions, signing during compose — all without leaving K-9. PGPony works with K-9 via Share, but not inside it.
  • Open source under GPLv3. If you require open-source code paths for your crypto layer end-to-end, OpenKeychain is auditable from key generation through ciphertext output. PGPony uses open audited libraries but the UI/glue is proprietary.
  • NFC YubiKey support. Tap a YubiKey to the back of your Android phone for hardware-token signing and decryption. OpenKeychain has the mature integration here; PGPony does not yet.
  • Mature smartcard ecosystem. Beyond YubiKey — OpenPGP smartcards, Nitrokey, etc. OpenKeychain has shipped support across many of these over the years.
  • Detailed key edit operations. Subkey expiration changes, revocation certificate generation, signing chains, user ID management — OpenKeychain exposes all of it.

Where PGPony wins

  • You get an iOS counterpart for free. If anyone in your contact list uses an iPhone — or you might in the future — PGPony covers both. Same UI, same key portable in both directions. OpenKeychain is Android-only and has no plans for iOS.
  • Modern UI. PGPony uses Material 3 with dynamic color, modern motion, and a refreshed information architecture. OpenKeychain still looks and feels like the Material 2 era it shipped in.
  • OpenPGP v6 (RFC 9580) import today. PGPony imports v6 keys, decrypts v6 messages, and verifies v6 signatures. OpenKeychain has not yet shipped v6 support.
  • Biometric lock with per-decryption prompt option. Fingerprint to open the app, optional second fingerprint per decryption for high-stakes use. OpenKeychain uses the passphrase prompt instead.
  • QR code key exchange built around mobile usage. Both apps support QR, but PGPony\'s flow is tuned for in-person key exchange — single QR code with the public key + UIDs, encoded with high error correction.
  • Active development. PGPony ships updates regularly. OpenKeychain\'s release cadence has slowed substantially since its peak years.
  • Auto-clearing clipboard. PGPony purges decrypted plaintext from the clipboard after a configurable timeout — important on Android where any installed app can read the clipboard.

Moving a key between them.

Whether you stay on OpenKeychain, switch to PGPony, or run both, your key is portable:

  1. In OpenKeychain, tap your key → ⋮ menu → Backup secret keys → ASCII armored. Choose a location (Files, Downloads).
  2. Open the resulting .sec.asc file. Android offers "Open with"; pick PGPony.
  3. PGPony recognizes the OpenPGP key block, prompts for the passphrase that protects the secret key, and imports it. Same fingerprint, same UIDs, same subkeys.
  4. Both apps now know about the same key. If you delete from one, the other still has it.

Going the other direction is identical: PGPony → Export → ASCII armored → open with OpenKeychain. The OpenPGP standard is the interop contract; the apps are just different windows onto the same key.

The technical bits.

Both apps use Bouncy Castle as the underlying OpenPGP crypto library on Android. Bouncy Castle (specifically the bcpg-jdk18on module) is an industry-standard open-source Java crypto library, in security-critical production use across the JVM ecosystem. Different UI, identical underlying crypto stack on Android.

On signing and encryption output, OpenKeychain and PGPony produce bit-identical PGP messages and keys to each other and to GnuPG. There\'s no "PGPony format" or "OpenKeychain format" — there\'s just OpenPGP.

The cross-platform story: PGPony on iOS uses Swift implementations of OpenPGP primitives that have been validated against the GnuPG reference for Ed25519 + Curve25519 interop. A key generated on Android in PGPony, exported and imported into iOS PGPony, has the same fingerprint and operates identically. OpenKeychain has no iOS counterpart at all.

The verdict.

  • Choose OpenKeychain if You\'re Android-only and you use K-9 Mail as your daily email client. The deep K-9 integration is real and PGPony cannot match it. You also want NFC YubiKey support today.
  • Choose PGPony if You use (or might use) iPhone. You want a modern UI. You want OpenPGP v6 import support. You want biometric lock with per-decryption prompts. Your mail client is anything other than K-9 (Gmail app, Outlook, Spark, Aqua, etc.) — at which point OpenKeychain\'s mail integration advantage doesn\'t apply.
  • Run both if You want K-9 integration via OpenKeychain AND modern QR / cross-platform / v6 support via PGPony. The same key works in both. Use OpenKeychain inside K-9 and PGPony for everything else. Switching costs are nil because the key is yours, not the app\'s.

Try PGPony

Free. No accounts. No tracking. Works with everything that speaks OpenPGP.