AgePony
download
Changelog

Every release, in order.

The big beats are below. The App Store and Google Play listings carry the per-build notes too. Both platforms track the same feature set, so a version number means the same thing on either phone.

3.1 Size stops mattering current
  • Files of any size. Encrypting, decrypting, signing and verifying all stream now. Nothing is held in memory, so a 1 GB file uses no more memory than a small one. The old ceiling was not a policy, it was the amount of headroom the operating system will hand a phone app before killing it.
  • Signing streams too. SSHSIG only ever covers the message digest, so a large file is hashed as it passes rather than loaded whole to be signed. The same applies to verifying.
  • One archive, or one file each. Encrypting several files now asks which you want instead of assuming. Archives are assembled as the encryptor reads them and never touch disk.
  • Inspect any age file. See what a file is encrypted to, whether it is post-quantum, and whether you hold a key for it, without decrypting a byte.
  • Adjustable scrypt work factor. Passphrase mode is memory-hard by design. The cost is now a setting, so a device with less headroom can still use it.
  • Rename saved recipients, and give a pasted key a name as you save it.
  • Returns to the tab you left when the app re-locks.
3.0 Post-quantum
  • Quantum-safe recipients. A new identity type combining ML-KEM-768, the lattice KEM standardised as FIPS 203, with classical X25519. A file sealed to one stays secret as long as either half holds, which is what protects it from an adversary recording ciphertext today and waiting for a quantum computer. Interoperable with the age CLI 1.3 and newer.
  • Re-encrypt existing files. Encrypting new files post-quantum does nothing for the ones already out there. The re-encrypt tool lifts a file you can already open onto a new key, leaving the original untouched. It cannot help with copies you already sent elsewhere, and it says so.
  • Sign and encrypt in one step. The signature now travels sealed inside the encrypted file rather than beside it. One file goes out instead of two, and the ciphertext no longer reveals who signed it. Signatures are verified automatically as a file decrypts, with the signer matched against your vault. Files signed by AgePony 2.0, as a .age alongside a .age.sig, still verify.
  • Post-quantum badges. Identities, recipients and files carry a visible marker, so what kind of protection a file has is never a guess.
2.0 Signing arrives
  • Detached signatures. AgePony can now sign, not just encrypt. Signatures are standard SSHSIG (the same format as ssh-keygen -Y sign) under the namespace agepony, so anyone with OpenSSH can verify them with ssh-keygen -Y verify, with no AgePony required.
  • Three ways to sign. Use an in-app SSH key (ed25519 or RSA), a Secure Enclave key generated in hardware on the device, or an external FIDO security key tapped over NFC.
  • Security keys, done properly. External keys produce both sk-ssh-ed25519 and sk-ecdsa-sha2-nistp256 signatures, and work whether they're touch-only or protected by a FIDO2 PIN. PIN-protected keys prompt for the PIN only when the key asks for it, then finish in a single tap.
  • Verify inside the app. Check signatures other people send you without leaving AgePony.
  • Multi-file bundles. Pick several files in the encrypt flow and AgePony rolls them into one standard USTAR tar, then encrypts that into a single bundle.tar.age. Decrypt and run tar -xf bundle.tar to get the originals back.
  • Open source. The entire iOS app is now Apache-2.0. The pure-Swift crypto core lives in the same repo under Sources/AgePonyCore, each piece pinned to reference test vectors.
1.1 Onboarding and polish
  • A short first-launch walkthrough that explains identities, recipients, and the encrypt flow before you need them.
  • An in-app Help & Support section.
  • A review prompt that only appears after you've actually used the app, with its own quiet gating so it never nags.
  • Assorted fixes and smoothing across the encrypt and decrypt screens.
Android Parity port platform
  • A native Kotlin build of AgePony for Android phones.
  • The crypto core is cross-checked against the same reference vectors as iOS, so a file encrypted on one platform decrypts cleanly on the other and a signature made on one verifies on the other.
  • Same rules as iOS: no accounts, no tracking, no backend.
1.0 The first release
  • age on the phone. Encrypt and decrypt files with the age protocol, bit-for-bit compatible with the age command line.
  • Recipients, three ways. Paste an age1… string or an SSH public key, scan a QR code, or just type someone's GitHub username and AgePony pulls their keys.
  • Passphrase mode. No recipient needed. Encrypt to a passphrase with scrypt when you're just protecting a file for yourself.
  • Encrypted notes. A private notes tab where each note's body is sealed with its own passphrase.
  • Text mode. Encrypt and decrypt short text directly, without a file.
  • Locked by default. The whole vault sits behind Face ID / Touch ID, with keys held in the Secure Enclave and the platform keychain.
  • A Share Sheet extension so you can encrypt straight from other apps.

Curious what's next instead of what's done? The roadmap lays out what's being built and what's deliberately off the table.