AgePony
download
// 01_download

AgePony for Desktop.

The same age encryption your phone does, on macOS, Windows and Linux. Post-quantum ML-KEM-768 recipients, classic X25519, OpenSSH keys and passphrases — and a file of any size, because everything streams. No accounts, no analytics, no tracking, and nothing leaves the machine.

Download for macOS (.dmg)
Download for Windows (.msi)
Download for Linux (.deb)
version 2.2.2 released 2026-09-03 macOS universal licence Apache-2.0
macOS · sha256
6df782e67d8feac285b0ec93fc562ebe13e8fd53c2e8e3ed05bf198cc3e30f37
Windows · sha256
affccfd5bd490bb18de0c7b19d59e80f30a03f30efd674813a288b1b5dce3339
Linux · sha256
7460f1ab502eb1cf6edc1382ffc6137d670051ef72428dee71f976c49e7de9ae
More Linux builds
PackageArchsha256
Debian / Ubuntu (.deb) ARM64 c41cb8cba08f37338fa3b51b8bf368e3ccdf4bd4a18bbc8025f922a608659e0f
Portable tarball (.tar.gz) x86_64 11c1cac55ca2a49efe4d1630aa75b40ef927581f596c76a1067e8d12c8828baf
Portable tarball (.tar.gz) ARM64 0a6d4707e9ba0fc4aa33608df5141f263f4dc034e86bf10bc94ca6ed822b19a4
AppImage x86_64 371181bf56524618d53d0b1fa557d94bad25abc972845dc7bd365be17a3a6c92
AppImage ARM64 a8c0c4788b205a49ab6bf3165dff194c6b0d220e8c9af50c0d9d1ae82f1d01eb

The tarball and the AppImage are self-contained: extract and run bin/agepony, or make the AppImage executable and run it. Neither registers a desktop entry or file associations, so double-clicking an .age file still wants the .deb. All three carry agepony-cli alongside the window.

What's in 2.2.2.
AgePony Desktop 2.2.2 fixes verifying signatures from the mobile apps and ssh-keygen. Desktop rejected a valid Ed25519 or RSA signature made by AgePony on Android or iOS, or by ssh-keygen, reporting "not a valid SSH signature," while it accepted its own. Those signers wrap the armored signature at a wider line than the desktop parser accepted, so it turned away signatures it should have read. It now accepts any line width. Signatures made on the desktop were never affected.
// 02_same_files

The same files your phone makes.

AgePony Desktop is not a companion app that speaks its own dialect. It writes ordinary age files — the ones the age CLI, the iOS app and the Android app all read — and the post-quantum recipient it uses is the standardised mlkem768x25519 one, not a private extension.

  • Post-quantum recipients that actually interoperate. ML-KEM-768 combined with X25519 under X-Wing, wrapped with HPKE exactly as the age specification describes. Desktop and phone are pinned to the same reference vectors on every build, so a file sealed on one opens on the other — byte for byte, not approximately.
  • Every recipient kind the protocol has. Classic age1… X25519 keys, post-quantum age1pq… keys, OpenSSH ed25519 and RSA keys, and plain passphrases. Mixing a post-quantum recipient with a classical one is refused rather than silently downgraded.
  • Any file size, in 64 KiB of memory. Encryption and decryption stream. A 1 GB archive costs the same working set as a text file, and a failed decrypt removes its own partial output instead of leaving an unauthenticated fragment on disk.
  • Bring your identity over by QR. Show the code on the phone, point the desktop at it, and the identity and its recipient book land on the machine. Nothing is typed, nothing is emailed to yourself.
  • Encrypted identity files. Keys on disk are written 0600, through a sibling temp file and a rename, so a crash cannot leave half a key at the real path. Passphrase-protected identity files are ordinary age files that age -d and the phone apps can open.
  • A command line in the box. agepony-cli shares the app's identity store. agepony-cli selftest runs the whole stack — classic, post-quantum, passphrase, the reference vector, Bech32 and the config path — and exits non-zero if any of it is wrong.
  • Nothing phones home. No accounts, no telemetry, no update pings, no network access at all in normal use. The build asserts it: a test fails if a networking crate ever enters the dependency graph.
  • Open source, Apache-2.0. agepony-core holds the crypto and the file handling and knows nothing about the interface, which is what makes it worth auditing on its own.
// 03_verify

Check what you downloaded.

Every artifact ships with a detached signature, and each release carries a signed SHA256SUMS covering all eight. An encryption tool ought to be verifiable before you run it, so the checksums are on this page as well as in the release — compare them and they should agree. 

gpg --import norsehorse-release-key.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
shasum -a 256 -c SHA256SUMS

gpg --verify AgePony-macOS.dmg.asc AgePony-macOS.dmg
The release key. One key signs AgePony, PGPony, BurnPony and RelayPony — one fingerprint to learn, one revocation to handle if it ever comes to that.

A0CB C8F6 5AAC E56F 1C5B 7677 53F9 798E 4919 DE62

Fetch it from this site, or with gpg --keyserver hkps://keys.pgpony.app --recv-keys A0CBC8F65AACE56F1C5B767753F9798E4919DE62. Check the fingerprint against the one printed above before you trust anything it signed.
Where the signatures live. The .asc files and SHA256SUMS sit alongside the installers, on GitHub and on this site's Tor and I2P mirrors alike. On SHA256SUMS the signature is the part that matters: it is what ties a list of hashes to a key rather than to whoever happens to be serving the page.
A checksum from the same place as the file proves very little. If you fetched both from here, you have shown the download was not corrupted in transit — worth knowing, but not the same as showing it came from NorseHorse. The signature is what does that, and only if you got the key from somewhere you already trust. That is why the fingerprint is short enough to compare by eye.
// 04_requirements

What it needs, and what your OS will say.

  • macOS. macOS 11 or later, Apple silicon or Intel
  • Windows. Windows 10 or later, x64
  • Linux. Debian 12 or Ubuntu 22.04 and newer, x86-64
  • Nothing to install alongside it. No runtime, no framework, no Java. Each package carries the whole application.
  • Around 25 MB on disk, and no background service. AgePony runs when you open it and stops when you close it.
macOS opens it cleanly, on both architectures. The disk image carries a universal binary — Apple silicon and Intel in one file — signed with a Developer ID certificate and notarized by Apple, with the ticket stapled to the image. It opens without a warning and without needing a network connection to check.
Windows will warn on first run. The installer is not yet code-signed, so SmartScreen shows an "unrecognized app" prompt — choose More info, then Run anyway. If you would rather not extend that trust on a prompt alone, verify the signature and the checksum above first; that is a stronger check than the one SmartScreen is offering to skip.
Linux installs with one command. sudo apt install ./AgePony-linux-x86_64.deb on Debian or Ubuntu. The package declares its own dependencies, registers a desktop entry, and puts agepony and agepony-cli on your PATH. On other distributions, take the tarball or the AppImage.
// 05_source

Read it yourself.

The desktop source is at github.com/norsehorse-dev/AgePonyDesktop under Apache-2.0, alongside the iOS app and the Android app. The three implementations are independent — Rust, Swift and Kotlin — which is exactly why they are held to one shared set of reference vectors instead of to each other.

Desktop source onGitHub
All artifacts and signaturesRelease v2.2.2
Download overTor & I2P