AgePony
download
// 01_download

AgePony for Desktop.

The same age encryption your phone does, on macOS, Windows and Linux. Post-quantum ML-KEM-768 recipients, classic X25519, OpenSSH keys and passphrases — and a file of any size, because everything streams. No accounts, no analytics, no tracking, and nothing leaves the machine.

Download for macOS (.dmg)
Download for Windows (.msi)
Download for Linux (.deb)
version 1.0.0 released 2026-08-01 macOS universal licence Apache-2.0
macOS · sha256
099b0bf49f3b01e61af99403ec3f01ad59b196d79d5da64514ab331597292a69
Windows · sha256
12c51a1368c3d1334b0c750ea5ab4a92fbc2c3c0947447ae38cd48ee471a9f8e
Linux · sha256
5d176b539912be5b21b54299f5e4cded1f35c12255bdc1faaa49eace747fa5e3
More Linux builds
PackageArchsha256
Debian / Ubuntu (.deb) ARM64 1220d01efaf846fe12aea040477d02165b9885f3f83203a5475dea26dd195604
Portable tarball (.tar.gz) x86_64 e470b317445b5cc343317a82fc865c0d55f259588b557c760b8bae8c11e1e7c5
Portable tarball (.tar.gz) ARM64 34294f1ba6ac8b6e88b4d7fe98818f9b8369b9618effe8a80a67ac2d188869d1
AppImage x86_64 b4d3cc5b9427294852a2d2b7b85bc1feb0a101596a1672e4caed7b21c2f32680
AppImage ARM64 6d5aa53547741533139e0c85db98a530e9d2e883864ad53df1c36803ee5cfd60

The tarball and the AppImage are self-contained: extract and run bin/agepony, or make the AppImage executable and run it. Neither registers a desktop entry or file associations, so double-clicking an .age file still wants the .deb. All three carry agepony-cli alongside the window.

What's in 1.0.0.
The first AgePony Desktop release.

The same age encryption the phone apps do, on macOS, Windows and Linux. Classic X25519 recipients, post-quantum mlkem768x25519 recipients, passphrases, and OpenSSH keys. Files stream in 64 KiB chunks, so a 1 GB file encrypts in the same memory a 1 KB one does.

Identities port from the phone by QR, and files cross in either direction: what the desktop seals to a post-quantum recipient opens on iOS and Android, and the other way round, checked against shared reference vectors on every build.

A console binary ships alongside the GUI. agepony-cli selftest runs the whole crypto stack including the post-quantum reference vector, so a packaged build can prove itself on a machine that has never seen the source.
// 02_same_files

The same files your phone makes.

AgePony Desktop is not a companion app that speaks its own dialect. It writes ordinary age files — the ones the age CLI, the iOS app and the Android app all read — and the post-quantum recipient it uses is the standardised mlkem768x25519 one, not a private extension.

  • Post-quantum recipients that actually interoperate. ML-KEM-768 combined with X25519 under X-Wing, wrapped with HPKE exactly as the age specification describes. Desktop and phone are pinned to the same reference vectors on every build, so a file sealed on one opens on the other — byte for byte, not approximately.
  • Every recipient kind the protocol has. Classic age1… X25519 keys, post-quantum age1pq… keys, OpenSSH ed25519 and RSA keys, and plain passphrases. Mixing a post-quantum recipient with a classical one is refused rather than silently downgraded.
  • Any file size, in 64 KiB of memory. Encryption and decryption stream. A 1 GB archive costs the same working set as a text file, and a failed decrypt removes its own partial output instead of leaving an unauthenticated fragment on disk.
  • Bring your identity over by QR. Show the code on the phone, point the desktop at it, and the identity and its recipient book land on the machine. Nothing is typed, nothing is emailed to yourself.
  • Encrypted identity files. Keys on disk are written 0600, through a sibling temp file and a rename, so a crash cannot leave half a key at the real path. Passphrase-protected identity files are ordinary age files that age -d and the phone apps can open.
  • A command line in the box. agepony-cli shares the app's identity store. agepony-cli selftest runs the whole stack — classic, post-quantum, passphrase, the reference vector, Bech32 and the config path — and exits non-zero if any of it is wrong.
  • Nothing phones home. No accounts, no telemetry, no update pings, no network access at all in normal use. The build asserts it: a test fails if a networking crate ever enters the dependency graph.
  • Open source, Apache-2.0. agepony-core holds the crypto and the file handling and knows nothing about the interface, which is what makes it worth auditing on its own.
// 03_verify

Check what you downloaded.

Every artifact ships with a detached signature, and each release carries a signed SHA256SUMS covering all eight. An encryption tool ought to be verifiable before you run it, so the checksums are on this page as well as in the release — compare them and they should agree. 

gpg --import norsehorse-release-key.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
shasum -a 256 -c SHA256SUMS

gpg --verify AgePony-macOS.dmg.asc AgePony-macOS.dmg
The release key. One key signs AgePony, PGPony, BurnPony and RelayPony — one fingerprint to learn, one revocation to handle if it ever comes to that.

A0CB C8F6 5AAC E56F 1C5B 7677 53F9 798E 4919 DE62

Fetch it from this site, or with gpg --keyserver hkps://keys.pgpony.app --recv-keys A0CBC8F65AACE56F1C5B767753F9798E4919DE62. Check the fingerprint against the one printed above before you trust anything it signed.
Where the signatures live. The .asc files and SHA256SUMS sit alongside the installers, on GitHub and on this site's Tor and I2P mirrors alike. On SHA256SUMS the signature is the part that matters: it is what ties a list of hashes to a key rather than to whoever happens to be serving the page.
A checksum from the same place as the file proves very little. If you fetched both from here, you have shown the download was not corrupted in transit — worth knowing, but not the same as showing it came from NorseHorse. The signature is what does that, and only if you got the key from somewhere you already trust. That is why the fingerprint is short enough to compare by eye.
// 04_requirements

What it needs, and what your OS will say.

  • macOS. macOS 11 or later, Apple silicon or Intel
  • Windows. Windows 10 or later, x64
  • Linux. Debian 12 or Ubuntu 22.04 and newer, x86-64
  • Nothing to install alongside it. No runtime, no framework, no Java. Each package carries the whole application.
  • Around 25 MB on disk, and no background service. AgePony runs when you open it and stops when you close it.
macOS opens it cleanly, on both architectures. The disk image carries a universal binary — Apple silicon and Intel in one file — signed with a Developer ID certificate and notarized by Apple, with the ticket stapled to the image. It opens without a warning and without needing a network connection to check.
Windows will warn on first run. The installer is not yet code-signed, so SmartScreen shows an "unrecognized app" prompt — choose More info, then Run anyway. If you would rather not extend that trust on a prompt alone, verify the signature and the checksum above first; that is a stronger check than the one SmartScreen is offering to skip.
Linux installs with one command. sudo apt install ./AgePony-linux-x86_64.deb on Debian or Ubuntu. The package declares its own dependencies, registers a desktop entry, and puts agepony and agepony-cli on your PATH. On other distributions, take the tarball or the AppImage.
// 05_source

Read it yourself.

The desktop source is at github.com/norsehorse-dev/AgePonyDesktop under Apache-2.0, alongside the iOS app and the Android app. The three implementations are independent — Rust, Swift and Kotlin — which is exactly why they are held to one shared set of reference vectors instead of to each other.

Desktop source onGitHub
All artifacts and signaturesRelease v1.0.0
Download overTor & I2P