PGPony for desktop

OpenPGP for macOS (Apple silicon and Intel), Linux and Windows. Encrypt, decrypt, sign and verify messages and files, manage your keyring, and use a hardware security key over USB, all on device. Linux ships for x86_64 and ARM64, as a .deb, a tarball, an AppImage or from the AUR, and every platform has a portable build that runs from a USB drive. Like the phone apps: no accounts, no ads, no analytics, no tracking.

Download for Apple silicon Mac (.dmg)

Download for Intel Mac (.dmg)

Download for Linux (.deb)

Download for Windows (.msi)

version 3.1.0 released 2026-11-03 runtime bundled licence Apache-2.0

Apple silicon Mac · sha256
4183f5709884dec98c3bd1079a4a0891d7f2822fc405982cdd75675e14619208

Intel Mac · sha256
5e67e999eba565943d5b377d95c89fdbce0d718ebda8d4ee1fd0d34d377dcf09

Linux · sha256
04eb6af0a5cee4406a197bf1f57b68b65c7ab80e2ecf81be239092e23e927818

Windows · sha256
25cd2abf2cde737cff77cd6554d81d541888e17011ecf8db0e84b157625efcee

More Linux builds

Package	Arch	sha256
Debian / Ubuntu (.deb)	ARM64	0cacbcfa9ab7ac207480330899856198e1590a5f7e4af3ea477274f45134d10c
Tarball (.tar.gz)	x86_64	20236d6fa23d8c2f54f29f8d6920eb3272d3e79919ae39c270a2ead354e657fd
Tarball (.tar.gz)	ARM64	8469669010a7c3e82465f2341918e7c1f1dacdbafaad978868e376e6545ffcd5
AppImage	x86_64	46da620ee4f3aa4bc51b4118875ce95ff7e70cb2edb9fcf4ecd81544049f019b
AppImage	ARM64	d69220467ca05edc1fa5c26cccca04d23ec65bbc3b482a87e99e7f30d11c59cc
Arch Linux (AUR)	x86_64 · ARM64	pgpony-bin

The tarball and AppImage are self-contained and need no install step: extract and run bin/PGPony, or make the AppImage executable and run it. Neither registers file associations, because nothing installs a desktop entry for them; the .deb and the AUR package do.

Portable (run from a USB drive)

Build	Arch	sha256
macOS (.zip)	Apple silicon	97969bb5bdc2cfac00f899d6584eef9c200f316852a598082091f91483214c3c
macOS (.zip)	Intel	f3938eaa5387d3e138822cd78a22073352e4c8db84fc264479e44918f74d5c4b
Windows (.zip)	x64	50c94ebc3d1abd6acce50b2d06f0bc9ba019915b36424c61b9b5dcda0ddbd69f
Linux (.tar.gz)	x86_64	478de2dab75b8fd8ec86f6b4e8616b471dec69ac46b259a62e0aa045a77a425e
Linux (.tar.gz)	ARM64	a0f61c6c1c69230e3a55e9ccc901a3fb30be4c774b72ab2ac5cc5d15297b7c02

Unzip or extract one onto a USB drive and run PGPony from there, with nothing installed. It keeps its keyring and settings in the PGPony-data folder beside the app, not on the computer you plug the drive into. Whoever has the drive has the keyring, so a portable copy only stores secret keys that have a passphrase. The keyring database itself is not encrypted: if that matters to you, keep the folder on an encrypted drive (BitLocker To Go, or a VeraCrypt container). The computer it runs on can still see your clipboard and its own list of recent files.

What's new in 3.1.0.
App lock: PGPony can be locked with a PGPony PIN, the same lock PGPony Android 4.7.0 has, and it locks again when the computer locks or sleeps. An optional duress PIN deletes every key and setting with nothing on screen to say so and reopens PGPony as a fresh install. Portable mode: with a PGPony-data folder beside the app, PGPony keeps its keyring and settings in that folder, so it runs from a USB drive with nothing installed; the portable downloads are on the release page. Signing a file larger than 512 MB with an ML-DSA key no longer fails (#14), and on Linux the file chooser no longer opens blank when PGPony is started from a shortcut (#12).

Same engine as the phone apps

The desktop app compiles the exact OpenPGP engine the PGPony phone apps ship (packet handling, v4 and v6 (RFC 9580) keys, the post-quantum ML-KEM composite layer in both wire formats, the OpenPGP smart-card stack, MIME) on the same Bouncy Castle version.

Encrypt, decrypt, sign, verify. Text, files, and PGP/MIME mail bundles, with signature verification banners and never-overwrite outputs.
Post-quantum keys. ML-KEM-768 + X25519 composites in both the IETF (v6) and GnuPG/LibrePGP formats: generate, encrypt and decrypt.
Hardware security keys over USB. On-card key generation, decrypt, sign, PIN management and factory reset, over PC/SC.
Backups that cross devices. Encrypted .pgpony archives restore to and from the phone apps, with a recovery code.
Key discovery. WKD, the verifying keyserver and per-server publishing, with optional Tor routing and an onion mirror.
Password store. A read-only pass browser with hardware-key entries, an auto-clearing clipboard and live TOTP.
A command line. The pgpony CLI shares the app's keyring, streams stdin to stdout, and never takes a passphrase as a plain flag.
Pair with another computer. Move key pairs, public keys or a full backup between two PGPony installs on your local network, confirmed with a six-digit code.
Import from GnuPG. Brings in your GnuPG keys and trust, with secret keys coming through gpg itself so they stay protected by their passphrases. Nothing in the GnuPG folder is written.
App lock and duress PIN. Lock PGPony with a PGPony PIN when the computer locks, sleeps or sits idle. An optional duress PIN deletes every key and setting, with nothing on screen to say so.
Portable mode. Run it from a USB drive with the keyring and settings on the drive, on macOS, Windows and Linux.
Eleven languages. English, Deutsch, Español, Français, 日本語, 한국어, Português (BR), Русский, Türkçe, Українська and 简体中文, switchable without a restart.

Verify your download

Every artifact ships with a detached PGP signature, and each release carries a signed SHA256SUMS covering every installer. A PGP app should sign its own releases with its own kind of key. This one does, using the NorseHorse release key published on this site and over WKD.

gpg --verify PGPony-macOS.dmg.asc PGPony-macOS.dmg
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c SHA256SUMS

Where the signatures live. The .asc files and SHA256SUMS are attached to the release alongside the installers, so you can verify before you ever run the thing.

Requirements and first-launch warnings

Apple silicon Mac. macOS 11+ on Apple silicon
Intel Mac. macOS 11+ on an Intel Mac
Linux. Debian or Ubuntu, x86-64
Windows. Windows 10 or later, x64
No Java to install. The runtime is bundled inside each installer.
Hardware keys on Linux need the pcscd daemon, which the .deb declares as a dependency and your package manager will pull in.

macOS opens it cleanly. The app is signed with a Developer ID certificate and notarized by Apple, with the ticket stapled to the disk image, so it opens without a warning, and without needing a network connection to check.

Windows will warn on first run. The installer is not yet code-signed, so SmartScreen shows an "unrecognized app" prompt: choose More info, then Run anyway. If you would rather not take that on trust, verify the PGP signature and checksum above first. A code-signing certificate is being evaluated.

Linux installs with the dependency. sudo apt install ./PGPony-linux.deb pulls in PC/SC support for hardware keys.

Source code

The desktop source is published at github.com/norsehorse-dev/PGPonyDesktop under Apache-2.0, alongside the Android app and the shared crypto cores. The OpenPGP engine is vendored verbatim from the Android repository rather than reimplemented, so there is one implementation to audit, not two.