Messages that travel sealed.
CarrierPony is private messaging, group chat and file transfer for iPhone, Android and your desktop. Every message is encrypted end to end and signed on your device, so only you and the people you paired with hold the keys. The relay in between carries envelopes it cannot open, and with sealed sender it can't tell who sent them.
Encrypted on your phone. Opened only on theirs.
Free on every screen you use.
No account to make, nothing to configure. Install it, generate your keys, pair with someone, and talk. Phone, tablet or computer, it's the same app and the same keys.
CarrierPony is free for iPhone. Download it on the App Store.
CarrierPony is free for Android. Get it on Google Play, or skip the store and download the APK (version 3.0.0), signed with the CarrierPony key. The APK is the open build, with the optional SMS transport included.
CarrierPony for macOS, Windows and Linux, on x86_64 and ARM. Pairs with your phone by QR code and keeps the same encryption. Get the desktop app.
iPhone, Android and desktop all talk to each other: same protocol, same safety numbers, same relay that cannot read a thing.
Three steps to a private thread.
No sign-up forms, no verification texts, no address book upload. Just keys, held by the two people who matter.
Create your identity
An OpenPGP keypair (Ed25519 for signing, Curve25519 for encryption) is generated on your device in a moment. No personal details are asked for or collected. Back it up to an encrypted file whenever you like.
Pair with someone
Send them an invite over any channel you trust, or scan each other's codes in person. Pairing exchanges public keys, never the private ones.
Verify, then talk
Compare the safety number to be certain it's really them. From then on, everything you send is encrypted for them and signed by you: messages, photos, files up to 50 MB.
Built to keep the middle out of it.
Every message and file is encrypted on your device and signed by your key. Nobody in between can read it or tamper with it.
End to end encrypted
OpenPGP under the hood, with modern Ed25519 and Curve25519 keys. Messages and files are sealed before they leave your phone and opened only on your contact's.
Signed, every time
Every envelope carries the sender's signature. What arrives is exactly what was sent. Tampering anywhere along the way is detected, not trusted.
Send real files
Photos, documents, anything up to 50 MB, encrypted the same way your messages are. A dedicated Files tab keeps every transfer in one place.
Pair, then verify
Swap an invite in person or over any channel you trust. Compare a safety number to be certain no one slipped into the middle.
Keys stay on your device
Your identity is generated on your phone and never leaves it, except in an encrypted backup only you can open. Lock the app behind Face ID.
Bring your own key
Already have an OpenPGP key from GnuPG or PGPony? Import it and keep your identity. Passphrase-protected keys stay protected.
No account, ever
No phone number, no email address, no username database. There is nothing to sign up for and nothing about you to leak.
Open at the core
The cryptography is PGPonyCore, published under Apache-2.0. The part that has to be right is not a secret.
Report and block
Unwanted contact gets one tap to block. Reporting is built in without breaking the encryption for everyone else.
Groups and channels
Encrypted group chats with the people you've paired with, and broadcast channels for posting to many at once. Same OpenPGP sealing, same signatures, same relay that can't read them.
Sealed sender
Who a message is from travels inside the encryption. The relay delivers it without learning the sender, only the mailbox it goes to.
Direct delivery
On the same Wi-Fi, or peer to peer across the internet, messages can go straight to your contact's device and skip the relay entirely. Nothing in the middle at all.
More than one you
Keep separate identities on one device, each with its own keys, contacts and inbox. Work and personal never have to meet.
Other roads in
On Android, sealed envelopes can also travel over Nostr relays, and the direct-download build can carry them by SMS when there's no data at all. Both are off until you turn them on.
On your desktop too
Real apps for Mac, Windows and Linux, notarized on the Mac and PGP-signed everywhere. Drag files in, get notified from the tray, pair with your phone by QR code. Get it.
The relay knows nothing.
Messages and files pass through a relay so they reach you even when your phone is off or out of reach. That relay only forwards sealed envelopes. No names, no message contents, no plaintext, ever. With sealed sender it doesn't even learn who sent what. It holds an encrypted blob just long enough to deliver it, then lets it go. Read the full breakdown on the security page.
The relay is open source, and you can run your own. It never sees your messages either way.
Common questions.
Is CarrierPony available yet?
Do I need an account, phone number, or email address?
What encryption does CarrierPony use?
What can the relay see?
How do I know I'm really talking to my contact?
Can I use my existing PGP key?
Can I send files?
Does it do group chats?
Is there a desktop app?
Can I install it without Google Play?
Can I have more than one identity?
Is it open source?
Ready when you are.
Private messaging, groups and file transfer on your phone and your computer, without handing your conversations to anyone in the middle.