PGPony
Download

How to generate a PGP key on a YubiKey

Create an Ed25519 + Curve25519 keypair on the card itself over NFC or USB-C. The private key is born on the YubiKey (or Token2) and never touches your phone: the strongest version of the hardware-key promise.

~5 minutes iOS / Android Hardware key + NFC or USB-C required
At a glance
  1. Confirm an ECC OpenPGP card and NFC or USB-C
  2. Choose generate-on-card in PGPony
  3. Enter name and email
  4. Set the card PINs
  5. Tap or plug in the card to generate
  6. Export the public key
Prerequisites
  • PGPony installed on a phone with NFC, or a USB-C port for a key you plug in
  • An OpenPGP smartcard that supports ECC key generation (YubiKey 5 series, Token2)
  • A few minutes and a quiet surface to rest the card on while it generates
Step 1

Check your card and how it connects

Make sure your card is an OpenPGP smartcard with ECC support, and that NFC is on if you'll tap it. A USB-C key such as the YubiKey 5C goes in the USB-C port instead; it can't be tapped. PGPony's on-card generation was validated on the YubiKey 5 NFC and Token2. RSA-only cards can't hold the Ed25519 / Curve25519 keys PGPony generates.

Tip If your card has never been set up, the default factory PINs apply until you change them. You'll set your own PINs during this flow.
Step 2

Start on-card generation

In PGPony, choose to add a key on a hardware card, then pick the generate on card option (as opposed to importing an existing key onto the card). This tells the card to create the key internally rather than receiving one from the phone.

Step 3

Enter your identity

Provide the name and email to bind to the key. These go into the public key so others can identify you. They don't have to be your legal name. Use whatever you want associated with this identity.

Step 4

Set the card PINs

Set and confirm a user PIN (used for everyday sign / decrypt operations) and an admin PIN (used for management like changing PINs or resetting the card). Choose PINs you'll remember. A blocked PIN requires the admin PIN to unblock, and too many wrong admin PIN attempts can lock the card permanently.

Important Write the PINs down somewhere safe before you continue. There is no recovery path that bypasses them.
Step 5

Tap or plug in the card to generate

Hold the card to the phone's NFC area and keep it still, or plug it into the USB-C port. The card computes the Ed25519 certification/signing key and the Curve25519 encryption subkey internally. Generation can take a few seconds. Keep the card in place (or plugged in) until PGPony says it's done.

On Android, the NFC antenna is usually on the upper back of the phone; on iPhone, near the top edge. If the tap drops, follow the on-screen prompt and try again.

Step 6

Confirm and back up the public key

The new key appears in your keyring, marked as a hardware key. From the Exchange tab, export or publish the public key so others can encrypt to you and verify your signatures.

The private key cannot be exported; it lives only on the card. That's the whole point, and it's also the catch: there is no private-key backup. If the card is lost or reset, this key is gone. Plan accordingly.

Verify it worked

  • The new key shows in your keyring with a hardware-key indicator.
  • You can export the public key but not the private key (export offers public only).
  • Signing or decrypting with the key prompts for the card PIN, then a tap if the key isn't plugged in.
  • Importing the exported public key into GnuPG on a desktop shows the matching Ed25519 + Curve25519 fingerprint.

Common questions

Can I back up an on-card key?

No. The private key can't leave the card. If the card is lost or reset, the key is gone. Use on-card generation when you want non-extractability; otherwise generate on-device with an encrypted backup.

Which cards work?

OpenPGP smartcards with ECC support, over NFC or USB-C, validated on YubiKey 5 NFC and Token2.

Same on Android and iPhone?

Yes. Over NFC the tap location differs slightly; a USB-C key works the same on both. Follow the on-screen prompt.

I already have a key. Do I have to generate a new one?

No. You can import an existing key onto a card instead. On-card generation is for creating a fresh, born-on-card key.

Next steps

Learn

On-card key generation
Learn

Hardware security key
Distribute

Publish your public key
Use

Verify a downloaded file

Get PGPony

Free OpenPGP encryption for iOS and Android. No accounts, no tracking.

Download on the App Store
Get it on Google Play