// 01_direct_apk
Direct APK.
The same PGPony that ships to F-Droid — the reproducible, fully open-source build, signed with the same release key — as a plain APK you download straight from this site. No Google account, no store client, works on de-Googled devices and in regions where the stores are blocked.
PGPony 4.7.0 for Android
Download APK · 11.0 MB
Direct installs don't auto-update. Leave an email and each new release arrives with its notes, hash, and link.
What's new in 4.7.0.
# PGPony 4.7.0 Moving existing keys onto a security key, certifying other people's keys, an app PIN with a duress PIN, and a long list of changes from tester reports. 4.7.0 carries versionCode 470 and installs in place over 4.6.4. ## Move a key onto a security key (#71) Key Details > Move to a security key does what gpg's keytocard does. Each slot (Signature, Decryption, Authentication) gets one key that fits it, the newest subkey for that use by default, or is left as it is. PGPony offers to save a backup first, checks the user PIN before writing anything, then uses each slot once (a signature, a test decryption, an authentication) and reads the card's fingerprints back. Only after every check passes does anything on the phone change. By default the moved keys are removed from the phone and kept as pointers to the card, as gpg does. It works over NFC and USB with v4 RSA 2048, 3072 and 4096, Ed25519 and Cv25519 keys. v6 keys and NIST or brainpool curves cannot be moved yet; the sheet lists each key that cannot move and why. You can also move only the subkeys and keep the primary on the phone. Signing and decrypting then use the card, and the edits that need the primary (User IDs, expiry, certifying other keys, Refresh self-signatures) keep working with the key's passphrase. ## Security keys - Thunderbird and other mail apps can decrypt and sign with a USB security key, not only over NFC (#36). - A key generated on a card now shows as your own key: avatar, an ON CARD pill, "Key pair on a security key", and a line in Key Details saying the primary key sits in the Signature slot (#43). - A card scanned before its public key was imported now pairs when you import the key, also when the Signature slot holds a subkey. Until then Key Details says what is missing (#71). - A key that does not open OpenPGP over NFC (the Nitrokey 3 among them) says so and points to USB, instead of failing with a bare error (#43). - The card scan screen stopped answering after Change PIN and back. Fixed (#79). ## Certify other people's keys (#79) Key Details of a public key has Certify…: pick the User IDs, your certifying key (on the phone or on a security key), the level (no claim, persona, casual or positive), an optional expiry, and Local only. Certify stays off until you confirm you compared the full fingerprint. Exportable certifications travel with the key when you share it. Local-only ones never leave the phone: no share, export, QR code, upload, backup or pairing carries them. Each User ID lists who certified it, with the certifier's short fingerprint, and you can revoke your own. Long lists show three, then Show all (#85). A trust signature (gpg's tsign) shows its amount and depth (#79). A certification from a key you do not hold has Look up, which finds the certifier's key on your key servers and checks the certification after import (#88). ## Trust levels (#75) New shields for each level, and a new Don't use level. PGPony asks before encrypting to or signing with a Don't use key, never picks one for a mail app, and turns the verify banner red for a signature from one. Key pairs you generate in PGPony now start at Ultimate; imported keys keep Unknown. ## Expiry and self-signatures (#86) - Changing the primary key's expiry set the same date on every subkey, expired ones included, which brought them back. Now it changes the User IDs only, with an option to also set it on subkeys that are still valid, and each subkey has its own Edit expiration. - Before anything is signed, a confirmation shows the current and new date and what gets re-signed, then asks for your screen lock when Protect destructive actions is on. - Expiry changes dropped part of the old self-signature: User IDs lost their feature flags, AEAD and key server preferences, and subkey bindings kept only their key flags. The new self-signature now carries everything forward. - Refresh self-signatures re-signs every User ID and subkey binding with SHA-256, keeping each expiry. It also brings back subkeys that were dropped for a SHA-1 binding. ## Signing subkeys (#82, #83) - Signing could pick an expired subkey. PGPony now signs only with a subkey that is valid now (bound, cross certified, not revoked, not expired), newest first, then the primary. - Add Subkey has written signing subkeys without a back-signature since 4.2.0, so gpg warned about them and PGPony's own check did not accept them. New subkeys get one. For an existing one, change its expiry and it is bound again with a back-signature; until then PGPony signs with the primary when the primary can sign. - Use for signing: on a key pair with two or more valid signing subkeys, Key Details lets you pick one or leave it on Automatic, which names the key it picks. Coming from OpenKeychain: PGPony signs with the newest valid signing subkey, where OpenKeychain used the older one. If others expect your signatures from a particular subkey, pick it under Use for signing. ## Import and re-import - Re-importing your own key edited in gpg applies the changes: newer self-signatures (#78), subkeys added in gpg (#82), and, as an opt-in, the secret keys from the file after a passphrase change in gpg (#78). The result says what was applied, or why nothing was. - The import preview lists each subkey it leaves out and why, and Key Details shows where each subkey's secret is: on this phone, offline, on a card, or not present (#82). - Offline primary keys (secret subkeys only, as gpg exports with --export-secret-subkeys) import, sign and decrypt. The edits that need the primary are hidden behind one banner that says why. - User IDs bound only with SHA-1 vanished on import or restore and the key showed as Unknown. They are kept now, with a Weak hash mark (#67). A key restored without its names needs one more restore or re-import. - A key's shown name follows its primary User ID, so a revoked first User ID no longer stops publishing. - GitHub lookup: enter a username, @name or profile link and PGPony fetches that user's OpenPGP keys, through Tor or your proxy when those are on (#81). - Import's QR, Server and GitHub now open the Exchange page, and Exchange's Key Server tab has GitHub (#92). ## Key Details and Keyring - Copy a subkey's key ID (#91), the primary key's Usage (#89), and the last key server check with server and date (#90). A network failure during that check is reported as an error, not as "not found". - Keyring > Select keys exports several public keys as one .asc file (#93). - The list behind a key count badge scrolls (#87). - Key selectors show the name and email with the short fingerprint. - Toggle and checkbox rows respond to a tap anywhere on the row (#79). ## App lock and duress PIN Settings > Security > Lock method: device unlock as before, or a PGPony PIN of 6 to 16 digits, with Unlock with fingerprint as an option. A Duress PIN erases PGPony's keys and data when entered, and Erase after wrong PINs (5, 10 or 20, off by default) does the same. Without it, repeated wrong PINs add a delay. PINs are stored as Argon2id hashes. Clear All Data now also removes the keys in Recently Deleted, mail app and SSH approvals, and every setting. ## Mail apps - When an address has no usable key, PGPony asks which keys to use instead of failing with "No PGPony key found" (#25). Keys the request already includes show ticked, with the address that includes them. FairEmail asks several times for one send; your picks are reused for 30 minutes for the same addresses. - A long passphrase duration ("Until I clear it" and others) was lost after a few minutes on Xiaomi phones, because the system stopped PGPony's mail app process. While a passphrase is held for mail apps, a notification now keeps it alive, with Clear to forget it. - Signed mail now names the hash its signature used (micalg) (#84). - The passphrase and card PIN prompts open with the field focused and the keyboard up (#59). ## Files and Quick Actions - With several files, the package screen offers Each file on its own: encrypt, encrypt and sign, or sign only with a .sig per file, then Save to a folder or Share all (#72). - Several encrypted files shared to PGPony decrypt one by one, each with its own signature result, instead of being encrypted again as a package (#72). - Saving a large file shows progress and can be cancelled, and a save that fails or is cancelled removes its partial file (#73). - Encrypting and signing a large file with an ML-DSA key ran out of memory. It streams now; a 2 GB file was checked both ways with GpgFrontend (#73). - ML-DSA keys made by sq signed with their certify-only primary, so every verifier rejected the signature. They sign with their signing subkey now (#67). - Decrypt results name the key and subkey that signed and the one that decrypted, as gpg's key IDs (#79). - A Quick Actions decrypt of an ML-DSA-signed file keeps its file name (#67). - Shared text holding a PGP block can be encrypted whole with Encrypt all of it (#58). ## Network - With Tor or a custom proxy on, host names are looked up through the proxy too. - The keys.pgpony.app onion mirror is off by default. A choice you already made is kept. - Further message and key import hardening from an internal review. ## Contributed fixes - The contact email lookup handles a contacts provider that leaves out a column (#97). - The French and Portuguese "keys need regenerating" message shows its count, so 0 no longer reads as one key (#99). - Test infrastructure (#94). ## Signed source Release tags and the commits on main are now signed with the norsehorse-dev SSH signing key. The README's Verify a release section has the key and the git commands to check a tag. ## Verify this build Whole-file SHA-256 (is this download the published file): a78977fe4b6c957cc7599389766a5df664f92a2e09133a171a1e3c9ad32ef059 Content hash (for rebuilders; excludes signature, see docs/REPRODUCIBLE_BUILDS_PLAYBOOK.md): 9c1010def9fc2f4daae6fb99f1528c2fee8c0179c6221182d5eae409f0e503b3 The APK is signed with the NorseHorse release key (A0CBC8F65AACE56F1C5B767753F9798E4919DE62). The detached signature, the armored release key and PGPony-4.7.0-signing-keys.txt are on the GitHub release: https://github.com/norsehorse-dev/PGPonyAndroid/releases/tag/v4.7.0
# PGPony 4.7.0 Moving existing keys onto a security key, certifying other people's keys, an app PIN with a duress PIN, and a long list of changes from tester reports. 4.7.0 carries versionCode 470 and installs in place over 4.6.4. ## Move a key onto a security key (#71) Key Details > Move to a security key does what gpg's keytocard does. Each slot (Signature, Decryption, Authentication) gets one key that fits it, the newest subkey for that use by default, or is left as it is. PGPony offers to save a backup first, checks the user PIN before writing anything, then uses each slot once (a signature, a test decryption, an authentication) and reads the card's fingerprints back. Only after every check passes does anything on the phone change. By default the moved keys are removed from the phone and kept as pointers to the card, as gpg does. It works over NFC and USB with v4 RSA 2048, 3072 and 4096, Ed25519 and Cv25519 keys. v6 keys and NIST or brainpool curves cannot be moved yet; the sheet lists each key that cannot move and why. You can also move only the subkeys and keep the primary on the phone. Signing and decrypting then use the card, and the edits that need the primary (User IDs, expiry, certifying other keys, Refresh self-signatures) keep working with the key's passphrase. ## Security keys - Thunderbird and other mail apps can decrypt and sign with a USB security key, not only over NFC (#36). - A key generated on a card now shows as your own key: avatar, an ON CARD pill, "Key pair on a security key", and a line in Key Details saying the primary key sits in the Signature slot (#43). - A card scanned before its public key was imported now pairs when you import the key, also when the Signature slot holds a subkey. Until then Key Details says what is missing (#71). - A key that does not open OpenPGP over NFC (the Nitrokey 3 among them) says so and points to USB, instead of failing with a bare error (#43). - The card scan screen stopped answering after Change PIN and back. Fixed (#79). ## Certify other people's keys (#79) Key Details of a public key has Certify…: pick the User IDs, your certifying key (on the phone or on a security key), the level (no claim, persona, casual or positive), an optional expiry, and Local only. Certify stays off until you confirm you compared the full fingerprint. Exportable certifications travel with the key when you share it. Local-only ones never leave the phone: no share, export, QR code, upload, backup or pairing carries them. Each User ID lists who certified it, with the certifier's short fingerprint, and you can revoke your own. Long lists show three, then Show all (#85). A trust signature (gpg's tsign) shows its amount and depth (#79). A certification from a key you do not hold has Look up, which finds the certifier's key on your key servers and checks the certification after import (#88). ## Trust levels (#75) New shields for each level, and a new Don't use level. PGPony asks before encrypting to or signing with a Don't use key, never picks one for a mail app, and turns the verify banner red for a signature from one. Key pairs you generate in PGPony now start at Ultimate; imported keys keep Unknown. ## Expiry and self-signatures (#86) - Changing the primary key's expiry set the same date on every subkey, expired ones included, which brought them back. Now it changes the User IDs only, with an option to also set it on subkeys that are still valid, and each subkey has its own Edit expiration. - Before anything is signed, a confirmation shows the current and new date and what gets re-signed, then asks for your screen lock when Protect destructive actions is on. - Expiry changes dropped part of the old self-signature: User IDs lost their feature flags, AEAD and key server preferences, and subkey bindings kept only their key flags. The new self-signature now carries everything forward. - Refresh self-signatures re-signs every User ID and subkey binding with SHA-256, keeping each expiry. It also brings back subkeys that were dropped for a SHA-1 binding. ## Signing subkeys (#82, #83) - Signing could pick an expired subkey. PGPony now signs only with a subkey that is valid now (bound, cross certified, not revoked, not expired), newest first, then the primary. - Add Subkey has written signing subkeys without a back-signature since 4.2.0, so gpg warned about them and PGPony's own check did not accept them. New subkeys get one. For an existing one, change its expiry and it is bound again with a back-signature; until then PGPony signs with the primary when the primary can sign. - Use for signing: on a key pair with two or more valid signing subkeys, Key Details lets you pick one or leave it on Automatic, which names the key it picks. Coming from OpenKeychain: PGPony signs with the newest valid signing subkey, where OpenKeychain used the older one. If others expect your signatures from a particular subkey, pick it under Use for signing. ## Import and re-import - Re-importing your own key edited in gpg applies the changes: newer self-signatures (#78), subkeys added in gpg (#82), and, as an opt-in, the secret keys from the file after a passphrase change in gpg (#78). The result says what was applied, or why nothing was. - The import preview lists each subkey it leaves out and why, and Key Details shows where each subkey's secret is: on this phone, offline, on a card, or not present (#82). - Offline primary keys (secret subkeys only, as gpg exports with --export-secret-subkeys) import, sign and decrypt. The edits that need the primary are hidden behind one banner that says why. - User IDs bound only with SHA-1 vanished on import or restore and the key showed as Unknown. They are kept now, with a Weak hash mark (#67). A key restored without its names needs one more restore or re-import. - A key's shown name follows its primary User ID, so a revoked first User ID no longer stops publishing. - GitHub lookup: enter a username, @name or profile link and PGPony fetches that user's OpenPGP keys, through Tor or your proxy when those are on (#81). - Import's QR, Server and GitHub now open the Exchange page, and Exchange's Key Server tab has GitHub (#92). ## Key Details and Keyring - Copy a subkey's key ID (#91), the primary key's Usage (#89), and the last key server check with server and date (#90). A network failure during that check is reported as an error, not as "not found". - Keyring > Select keys exports several public keys as one .asc file (#93). - The list behind a key count badge scrolls (#87). - Key selectors show the name and email with the short fingerprint. - Toggle and checkbox rows respond to a tap anywhere on the row (#79). ## App lock and duress PIN Settings > Security > Lock method: device unlock as before, or a PGPony PIN of 6 to 16 digits, with Unlock with fingerprint as an option. A Duress PIN erases PGPony's keys and data when entered, and Erase after wrong PINs (5, 10 or 20, off by default) does the same. Without it, repeated wrong PINs add a delay. PINs are stored as Argon2id hashes. Clear All Data now also removes the keys in Recently Deleted, mail app and SSH approvals, and every setting. ## Mail apps - When an address has no usable key, PGPony asks which keys to use instead of failing with "No PGPony key found" (#25). Keys the request already includes show ticked, with the address that includes them. FairEmail asks several times for one send; your picks are reused for 30 minutes for the same addresses. - A long passphrase duration ("Until I clear it" and others) was lost after a few minutes on Xiaomi phones, because the system stopped PGPony's mail app process. While a passphrase is held for mail apps, a notification now keeps it alive, with Clear to forget it. - Signed mail now names the hash its signature used (micalg) (#84). - The passphrase and card PIN prompts open with the field focused and the keyboard up (#59). ## Files and Quick Actions - With several files, the package screen offers Each file on its own: encrypt, encrypt and sign, or sign only with a .sig per file, then Save to a folder or Share all (#72). - Several encrypted files shared to PGPony decrypt one by one, each with its own signature result, instead of being encrypted again as a package (#72). - Saving a large file shows progress and can be cancelled, and a save that fails or is cancelled removes its partial file (#73). - Encrypting and signing a large file with an ML-DSA key ran out of memory. It streams now; a 2 GB file was checked both ways with GpgFrontend (#73). - ML-DSA keys made by sq signed with their certify-only primary, so every verifier rejected the signature. They sign with their signing subkey now (#67). - Decrypt results name the key and subkey that signed and the one that decrypted, as gpg's key IDs (#79). - A Quick Actions decrypt of an ML-DSA-signed file keeps its file name (#67). - Shared text holding a PGP block can be encrypted whole with Encrypt all of it (#58). ## Network - With Tor or a custom proxy on, host names are looked up through the proxy too. - The keys.pgpony.app onion mirror is off by default. A choice you already made is kept. - Further message and key import hardening from an internal review. ## Contributed fixes - The contact email lookup handles a contacts provider that leaves out a column (#97). - The French and Portuguese "keys need regenerating" message shows its count, so 0 no longer reads as one key (#99). - Test infrastructure (#94). ## Signed source Release tags and the commits on main are now signed with the norsehorse-dev SSH signing key. The README's Verify a release section has the key and the git commands to check a tag. ## Verify this build Whole-file SHA-256 (is this download the published file): a78977fe4b6c957cc7599389766a5df664f92a2e09133a171a1e3c9ad32ef059 Content hash (for rebuilders; excludes signature, see docs/REPRODUCIBLE_BUILDS_PLAYBOOK.md): 9c1010def9fc2f4daae6fb99f1528c2fee8c0179c6221182d5eae409f0e503b3 The APK is signed with the NorseHorse release key (A0CBC8F65AACE56F1C5B767753F9798E4919DE62). The detached signature, the armored release key and PGPony-4.7.0-signing-keys.txt are on the GitHub release: https://github.com/norsehorse-dev/PGPonyAndroid/releases/tag/v4.7.0
Android will warn you when installing an app from outside a store — that prompt is expected. It appears for every directly-downloaded APK, including this one, and is exactly why the verification steps below exist.
// 02_verify
Verify before you install.
Every release is PGP-signed with the NorseHorse release key and published with its SHA-256. An APK from anywhere else claiming to be PGPony should fail these checks — that is the point of them.
Signing key fingerprint (the same key on the public key page):
A0CB C8F6 5AAC E56F 1C5B 7677 53F9 798E 4919 DE62
SHA-256 of PGPony-4.7.0.apk:
a78977fe4b6c957cc7599389766a5df664f92a2e09133a171a1e3c9ad32ef059
On a computer with GnuPG:
curl -O https://pgpony.app/downloads/PGPony-4.7.0.apk curl -O https://pgpony.app/downloads/PGPony-4.7.0.apk.asc curl -O https://pgpony.app/assets/pgp/norsehorse.asc gpg --import norsehorse.asc gpg --verify PGPony-4.7.0.apk.asc PGPony-4.7.0.apk shasum -a 256 PGPony-4.7.0.apk
Good output says Good signature from the fingerprint above, and the hash matches the one on this page. On the phone itself, PGPony can verify the detached signature too — see the walkthrough.
APK signing certificate SHA-256 (matches the F-Droid build — check with apksigner verify --print-certs):
446bf9e621222a40c66cd2476e1a97105ccb2a9b16a01a91c1c7eb90765b50dc
Previous releases (19)
PGPony-4.6.4.apk · 4.6.4 · 2026-10-06
sha256 3ae551b26577492d4b60fa8ded8d021d01c16957d19f2854f0790e500cd09547
sha256 3ae551b26577492d4b60fa8ded8d021d01c16957d19f2854f0790e500cd09547
PGPony-4.6.3.apk · 4.6.3 · 2026-10-05
sha256 3af5ca347c5e53331ab84793bba98140673f00a7f1f772cb365c8001fbeaf208
sha256 3af5ca347c5e53331ab84793bba98140673f00a7f1f772cb365c8001fbeaf208
PGPony-4.6.2.apk · 4.6.2 · 2026-09-28
sha256 856ab53741eac9154474a5e4ea8c728b82d4f4652d468f4ce5a083fc7b3cc743
sha256 856ab53741eac9154474a5e4ea8c728b82d4f4652d468f4ce5a083fc7b3cc743
PGPony-4.6.1.apk · 4.6.1 · 2026-09-26
sha256 681d13767d4ece6a79a5f2da095c2a3a1f5495ea0d8feb91737c6d89693ecbda
sha256 681d13767d4ece6a79a5f2da095c2a3a1f5495ea0d8feb91737c6d89693ecbda
PGPony-4.6.0.apk · 4.6.0 · 2026-09-24
sha256 0995431de506531682a17e0e3e0c06cb5dc9c90b1656b4f946c3112d71675dbf
sha256 0995431de506531682a17e0e3e0c06cb5dc9c90b1656b4f946c3112d71675dbf
PGPony-4.5.3.apk · 4.5.3 · 2026-09-21
sha256 85381b486459b97db61898759e1e9e9b9e6f3e6faf7d2d8bb040480762db16a1
sha256 85381b486459b97db61898759e1e9e9b9e6f3e6faf7d2d8bb040480762db16a1
PGPony-4.5.2.apk · 4.5.2 · 2026-09-18
sha256 0dd192d4a8768da2cd84df8b61a408f9e3a090252bdcf60b781f40b39235b019
sha256 0dd192d4a8768da2cd84df8b61a408f9e3a090252bdcf60b781f40b39235b019
PGPony-4.5.1.apk · 4.5.1 · 2026-09-17
sha256 166df6e0cc5840b98cbdcea2b55343241a357ea86a47ca7a3159b4b42ecfb3e4
sha256 166df6e0cc5840b98cbdcea2b55343241a357ea86a47ca7a3159b4b42ecfb3e4
PGPony-4.5.0.apk · 4.5.0 · 2026-09-16
sha256 9842e68809d115bf15c7f1c9af67a0cdc941399c15ebc646175535fedbb3766e
sha256 9842e68809d115bf15c7f1c9af67a0cdc941399c15ebc646175535fedbb3766e
PGPony-4.4.1.apk · 4.4.1 · 2026-09-01
sha256 55075c11f90833dae75b66162c0adcd636eec223a8fc98d2c22408209335e257
sha256 55075c11f90833dae75b66162c0adcd636eec223a8fc98d2c22408209335e257
PGPony-4.4.0.apk · 4.4.0 · 2026-08-28
sha256 3c10b9ea225a748d87dacbf5a233e20bdf456b4cfc2313ba700e6e06e10ae411
sha256 3c10b9ea225a748d87dacbf5a233e20bdf456b4cfc2313ba700e6e06e10ae411
PGPony-4.3.1.apk · 4.3.1 · 2026-08-21
sha256 f09e1577d5c20b0514980063d445d8d184ce26980dd59a3e60bf0647453175e5
sha256 f09e1577d5c20b0514980063d445d8d184ce26980dd59a3e60bf0647453175e5
PGPony-4.3.0.apk · 4.3.0 · 2026-08-20
sha256 6b534dc4f96fd014d8475e3a05543f30aca07c14358537494a2fc07dd73dd61f
sha256 6b534dc4f96fd014d8475e3a05543f30aca07c14358537494a2fc07dd73dd61f
PGPony-4.2.0.apk · 4.2.0 · 2026-08-14
sha256 59a0aa492982072d81c2ccd706d5d7096758c999a7ad065354e191b126563e2a
sha256 59a0aa492982072d81c2ccd706d5d7096758c999a7ad065354e191b126563e2a
PGPony-4.1.1.apk · 4.1.1 · 2026-08-04
sha256 15e9d5052dfcbc8fd5ee6a59783f2f3e4b2c730822ac9553bdb596917a214bd3
sha256 15e9d5052dfcbc8fd5ee6a59783f2f3e4b2c730822ac9553bdb596917a214bd3
PGPony-4.1.0.apk · 4.1.0 · 2026-08-01
sha256 2be8891833adba5d3698c3eab64607aa91cbcb43ed2aad3d1277717adaa66831
sha256 2be8891833adba5d3698c3eab64607aa91cbcb43ed2aad3d1277717adaa66831
PGPony-4.0.4.apk · 4.0.4 · 2026-07-26
sha256 528f9b6a8b68f44651f811a3d8cfae8ffedbbec03f3c568e6ac84116db890b62
sha256 528f9b6a8b68f44651f811a3d8cfae8ffedbbec03f3c568e6ac84116db890b62
PGPony-4.0.0.apk · 4.0.0 · 2026-07-20
sha256 2a6d2d64b9fc191145ff8fcf0d489dfc11bac82768eb1823b237ca8724f885df
sha256 2a6d2d64b9fc191145ff8fcf0d489dfc11bac82768eb1823b237ca8724f885df
PGPony-3.1.0.apk · 3.1.0 · 2026-07-11
sha256 482edf9df3802740795de4b3b62a7cbab3bb8c74b2b0a996e1bef7c26a2042e6
sha256 482edf9df3802740795de4b3b62a7cbab3bb8c74b2b0a996e1bef7c26a2042e6
// 03_good_to_know
Before you switch install sources.
- Same key as F-Droid. This APK is signed with the same release key as the F-Droid build, so you can move between F-Droid and the direct APK freely — each will update over the other without uninstalling.
- Different key than Google Play. Play re-signs apps with its own key, so Android will refuse to install this APK over a Play install (and vice versa). Switching requires an uninstall first.
- No auto-updates. A directly-installed APK does not update itself. Watch the changelog for new releases, or install through F-Droid if you want automatic updates with the same signing key.
- Reproducible build. The Android app is fully open source (PGPonyAndroid on GitHub) and builds reproducibly — you can compile it yourself and compare against this artifact.
Export your keys before uninstalling. If you are moving from a Google Play install to this APK, back up your keyring first — uninstalling deletes everything stored on the device, and PGPony keeps your keys nowhere else. The private-key backup guide covers it step by step.
Also served over Tor. This page and the APK itself are available on the PGPony onion service — the whole download can happen without ever touching the clearnet:
http://pgponyisur7gxcrfw5ofpjr2sepqul3zgbs66rrd3ughk5qvi4a3t5id.onion/apk
See mirrors for the verified onion and I2P addresses.
http://pgponyisur7gxcrfw5ofpjr2sepqul3zgbs66rrd3ughk5qvi4a3t5id.onion/apk
See mirrors for the verified onion and I2P addresses.