PGPony and OpenPGP on your phone: why PGP, open source, and F-Droid

Want to send a password, a passport scan, or a contract so only the recipient can read it — even if the mail sits on someone else’s server? That is what PGP (today usually OpenPGP) is for: you encrypt with the other person’s public key; only they can open it with their private key.

It sounds technical, but the idea is as simple as a padlock and a key. On a phone, PGPony makes it practical. Below — plain language: why it helps, how to start, and where to tap.

PGP in plain words

Every person has two keys:

• Public key — safe to share. Others use it to encrypt messages to you and to verify your signature.
• Private key — yours alone. You decrypt and sign with it. Never post it online.

Analogy: the public key is a padlock you hand out. The private key is the only key that opens it. A friend locks a package with your padlock; only you can open it.

PGP can also sign messages: the recipient sees it really came from you and was not altered. Useful not only for secrets, but for trust.

Who it helps — and when

You do not need to be a security pro. Everyday cases:

• send a colleague or relative a password or banking details — not as plain text in a chat;
• email a document scan so the provider and mailbox backups cannot read the contents;
• confirm a file or message really came from the right person;
• keep encryption under your keys, without signing up for yet another cloud service.

If you only need family chat “like WhatsApp”, a normal E2EE messenger is easier. PGP shines when you want your own keys, mail/files, and compatibility with a computer (GnuPG and other OpenPGP tools).

PGPony — PGP on your phone without the headache

PGPony is an Android and iPhone app for everyday OpenPGP: create keys, encrypt text or files, decrypt what people send you, exchange keys via QR, look up a key by email.

Already use PGP on a computer? Import your existing keys. Brand new? The app walks you through creating a pair. On Android, PGPony can also act as the crypto engine for mail apps such as K-9 / Thunderbird / FairEmail. NFC hardware keys (e.g. YubiKey) are supported if you need them — beginners can start without.

Where to get it

On Android, F-Droid is the most transparent path: the repo builds from public source. Otherwise use Google Play or a direct APK. On iPhone — the App Store. A desktop build exists too.

• F-Droid (recommended on Android): PGPony package · client f-droid.org
• Google Play: PGPony
• APK: pgpony.app/apk
• App Store: PGPony
• Desktop: pgpony.app/desktop

First steps if PGP is new to you

• 1. Install PGPony (on Android, prefer F-Droid).
• 2. Create a new key pair. Add a name and email so people recognise you. Choose a strong passphrase for the private key.
• 3. Make a backup of your keys (and a revocation certificate if offered). Lose the phone without a backup — old ciphertext stays unreadable forever.
• 4. Give your contact the public key only: QR, file, or link. Never send the private key.
• 5. Get their public key. Encrypt a short test message both ways before sending anything important.
• 6. Once comfortable, encrypt attachments and mail; on Android, point your mail app at PGPony as the OpenPGP provider.

Do not fear terms like “key fingerprint”: it is a short ID you can compare in person. For a first exchange, a QR code with someone you trust is enough.

The Pony family: related tools

The same developer builds a small set of privacy apps. Catalog: pgpony.app/apps.php. Shared ideas: no mandatory accounts, no tracking, open crypto cores. Quick map:

PGPony — iOS · Android · Desktop

OpenPGP on your phone: keys, encrypt/sign, smartcards, pass store. Site · F-Droid · Google Play · App Store · APK · Desktop.

ScrubPony — iOS · Android · macOS · Linux

Before you upload a photo, strips metadata (GPS, phone model, timestamps, etc.) without changing the picture. CLI and mobile apps. scrubpony.app · App Store · F-Droid.

BurnPony — iOS · Android · Desktop

Self-destructing notes: sealed on-device; the recipient opens a browser link; after the view limit the note is gone. burnpony.app · App Store · Google Play · F-Droid · Desktop · Compose.

CarrierPony — iOS · Android · Desktop

Messaging and files with end-to-end OpenPGP — no phone number or email required to sign up. carrierpony.com · App Store · Google Play · APK · Desktop.

AgePony — iOS · Android · Desktop

Modern file encryption with the age protocol (often simpler than full PGP for file-only workflows). agepony.com · App Store · Google Play · F-Droid · Desktop.

RelayPony — Android · iOS

Phone-to-phone file transfer over Wi‑Fi with age encryption — no cloud account. relaypony.app · App Store · Google Play · F-Droid.

QuorumPony — iOS · Android

Splits a secret into cards: only a quorum can rebuild it. Handy as a backup path to an important key. quorumpony.com · App Store · F-Droid · Android releases.

PassPony — iOS · Android · Desktop

A password manager without a vendor cloud: vault on your devices, AutoFill without handing logins to a third party. passpony.app · App Store · FOSS APK · Desktop.

VaultPony — Android · iOS

An encrypted vault file compatible with VeraCrypt — a private filesystem in one container; on Android with no network permission. vaultpony.app · App Store · F-Droid · Releases · GitHub.

Things to keep in mind

• PGP protects the payload. Normal email still shows subject and addresses on the envelope — do not put secrets in the subject line.
• Without a private-key backup, losing the device means losing access to old encrypted files.
• Encrypt to the recipient’s public key. Encrypt to your own public key only when the file is for you.
• For the first key exchange, prefer someone you already trust (in person or over a familiar secure channel).

Open source and trust

For apps that encrypt your data, “looks nice in the store” is not enough — you should be able to see what does the encrypting. PGPony’s crypto core and (on Android) the full app are public under Apache-2.0 — details on the Open Source page.

• PGPonyAndroid — full Android client; also the tree F-Droid builds the FOSS flavour from;
• PGPonyCore — Swift core for iOS;
• Kotlin core on Android — keygen, OpenPGP packet parse/build, encryption.

That is why Android users are better off starting with F-Droid: you install a build made from public source, not only a store icon. If open source does not matter to you yet — Play or App Store is fine; you can always come back to the source later.

Links

• PGPony site
• Pony app family
• Open Source
• PGPony Desktop
• PGPony APK
• PGPony on F-Droid
• PGPony on Google Play
• PGPony on the App Store
• PGPonyAndroid on GitHub
• OpenPGP.org
• ScrubPony
• BurnPony
• CarrierPony
• AgePony
• RelayPony
• QuorumPony
• PassPony
• VaultPony

In short: PGP is a way to send a locked package to someone who has your padlock (public key) and their own key to open what you send them. PGPony puts that on your phone — start with install, a test message to a friend, and a key backup.