Roadmap

What's shipped, what's being built, and what's planned. Dates are intentionally absent: solo development moves at the speed it moves at.

Shipped

Live on the App Store, Google Play, and F-Droid today.

Core platform
iOS app
Native Swift / SwiftUI, App Store
Android app
Native Kotlin / Compose, Google Play & F-Droid
11 languages
English · Deutsch · Español · Français · 日本語 · 한국어 · Português (Brasil) · Русский · Türkçe · Українська · 简体中文. Korean, Turkish and Ukrainian reach iPhone in the next update.
OpenPGP support
v4 (RFC 4880)
Full read/write, Ed25519 + Cv25519 generation
v6 (RFC 9580, full)
Generate v6 keys, encrypt to v6 recipients with SEIPDv2 (AEAD-OCB), sign & verify with v6 keys. Verified against Sequoia and the RFC 9580 Appendix A test vectors.
Hardware keys
OpenPGP smartcards (YubiKey 5 series, Token2) over NFC or USB-C: pair, sign, decrypt, encrypt-and-sign, edit expiration, change PIN, and generate a keypair on the card
RSA legacy
Import & encrypt to RSA 2048 / 4096 / DSA keys
GnuPG interop
Byte-exact v4 round-trip with gpg 2.4.x
Post-quantum (RFC 9980)
ML-KEM-768 + X25519 and ML-KEM-1024 + X448 encryption, ML-DSA-65 + Ed25519 signatures (iOS 26 on iPhone), ML-DSA-87 + Ed448 on Android with iPhone next. Reads and writes GnuPG 2.5 post-quantum keys.
7.0.0: depth release
On-card key generation
Ed25519 + Curve25519 keypair born directly on the card over NFC or USB-C, never touches the phone
Card management
Change admin / user PINs, unblock a locked PIN, factory-reset a card over NFC or USB-C
Passphrase encryption
Symmetric, no keypair required (gpg -c style)
Detached file signing
Sign a file and verify a downloaded file against a detached signature
pass viewer
Read-only browse & decrypt of your existing pass store, hardware-key-backed
Open source
PGPonyCore
Swift OpenPGP core (iOS): public, Apache-2.0
PGPonyCore-Kotlin
Kotlin OpenPGP core (Android): public, Apache-2.0
What's public
Key generation, packet parser & builder, encryption & signing paths
Read it
pgpony.app/open-source
UX features
QR key exchange
Generate & scan binary high-density QR codes
Share Sheet / Intent
Encrypt or decrypt from any app on either platform
WKD lookup
Find keys by email, recipient's mail domain first
Bulk discovery
One-tap scan of contacts for published PGP keys
Expiration reminders
Local notifications at 30 / 7 / 1 days
Auto-clear clipboard
Configurable countdown for decrypted content

Currently building

Active direction since open-sourcing the core. Committed in direction, not in timing.

Reproducible builds

Now that the crypto core is public, the next trust step is making builds reproducible so the binary can be matched to the source. Already live on Android via F-Droid; bringing the same guarantee to iOS is the remaining groundwork.

v6 by default

Preparing to make OpenPGP v6 (RFC 9580) the default for new keys as ecosystem support broadens, while keeping v4 a one-tap choice for GnuPG interop.

Localizing the new screens

Bringing the 7.0.0 card-management and pass screens into all eleven languages, matching the rest of the app.

Up next

Planned for the next major release. Direction is committed; timing is not.

Hardware keys: next steps
Multi-device key sharing
One hardware key, multiple devices.
More transports
Beyond NFC and USB-C: exploring Lightning keys such as the YubiKey 5Ci on iPhone.
Android parity
Finishing detached-signature and download-verification parity with iOS.
v6: next steps
v6 by default
Make v6 the default format for new keys once ecosystem support is broad enough.
Argon2 tuning
Optimize the Argon2id work-factor/runtime trade-off for v6 secret-key protection.
Open source: next steps
Reproducible builds
Match the shipped binary to the now-public source on both platforms.
Third-party audit
Open source is step one; a formal review is the goal it sets up.
Contributions
Issues and pull requests welcome on both core repos.

Further out

Ideas that are interesting but not yet committed. Add or remove freely.

Desktop client

A native macOS or cross-platform desktop build, sharing the same packet parser as mobile.

Reproducible builds

Now that the core is public, the natural next step: let anyone match the shipped binary to the source. Contingent on upstream tooling reaching parity on both platforms.

Third-party audit

A formal cryptographic-protocol audit, contingent on funding or sponsorship. Open-sourcing the core is the first step toward making one possible.

More languages

Beyond the current eleven. Community contributions welcome.

Suggest a feature

Feature requests, prioritization arguments, and "please don't ever build this" votes all welcome.