Create an Ed25519 + Curve25519 keypair on the card itself over NFC. The private key is born on the YubiKey (or Token2) and never touches your phone — the strongest version of the hardware-key promise.
Make sure NFC is on and that your card is an OpenPGP smartcard with ECC support. PGPony's on-card generation was validated on the YubiKey 5 NFC and Token2. RSA-only cards can't hold the Ed25519 / Curve25519 keys PGPony generates.
In PGPony, choose to add a key on a hardware card, then pick the generate on card option (as opposed to importing an existing key onto the card). This tells the card to create the key internally rather than receiving one from the phone.
Provide the name and email to bind to the key. These go into the public key so others can identify you. They don't have to be your legal name — use whatever you want associated with this identity.
Set and confirm a user PIN (used for everyday sign / decrypt operations) and an admin PIN (used for management like changing PINs or resetting the card). Choose PINs you'll remember — a blocked PIN requires the admin PIN to unblock, and too many wrong admin PIN attempts can lock the card permanently.
Hold the card to the phone's NFC area and keep it still. The card computes the Ed25519 certification/signing key and the Curve25519 encryption subkey internally. Generation can take a few seconds — keep the card in place until PGPony says it's done.
On Android, the NFC antenna is usually on the upper back of the phone; on iPhone, near the top edge. If the tap drops, follow the on-screen prompt and try again.
The new key appears in your keyring, marked as a hardware key. From the Exchange tab, export or publish the public key so others can encrypt to you and verify your signatures.
The private key cannot be exported — it lives only on the card. That's the whole point, and it's also the catch: there is no private-key backup. If the card is lost or reset, this key is gone. Plan accordingly.
No — the private key can't leave the card. If the card is lost or reset, the key is gone. Use on-card generation when you want non-extractability; otherwise generate on-device with an encrypted backup.
OpenPGP NFC smartcards with ECC support — validated on YubiKey 5 NFC and Token2.
Yes, with a slightly different NFC tap location. Follow the on-screen prompt.
No. You can import an existing key onto a card instead. On-card generation is for creating a fresh, born-on-card key.
Free OpenPGP encryption for iOS and Android. No accounts, no tracking.
