Private messaging and file transfer, encrypted end to end

CarrierPony is messaging, group chat and file transfer for iPhone, Android and your desktop. Every message is encrypted and signed on your device with OpenPGP, so only you and the people you paired with hold the keys. The relay in between carries envelopes it cannot open, and with sealed sender it can't tell who sent them.

Download on the App Store Get it on Google Play Get it on F-Droid Direct download Android APK Mac · Windows · Linux Desktop

Free. No account, no phone number, no email address.

CarrierPony on iPhone: the conversation list with a group and four contacts, two of them with unread messages

CarrierPony on Android: a conversation with a shared photo and replies, with disappearing messages set to one day

A group chat on iPhone with members planning a weekend trip — **Groups**Encrypted group chats with the people you've paired with.

The Files tab on iPhone listing images, a PDF and a text file sent and received — **Files**Every file you've sent or received, in one list.

The pairing screen on iPhone with options to show or scan a code in person, or create or enter an invite remotely — **Pairing**Scan a code in person, or send an invite over any channel.

Get CarrierPony

Install it, generate your keys, pair with someone and talk. Phones and computers all run the same protocol, so iPhone, Android and desktop users can message each other.

Platform	Details	Get it
iPhone	Free on the App Store.	App Store
Android	Free on Google Play. The F-Droid build and the APK (version 3.3.3) are the open build with the optional SMS transport, signed with the CarrierPony key.	Google Play F-Droid Download the APK
Mac, Windows, Linux	Desktop apps for x86_64 and ARM. Pair with your phone by QR code.	Desktop downloads

How it works

No sign-up form, no verification text, no address book upload.

Create your identity

An OpenPGP keypair (Ed25519 for signing, Curve25519 for encryption) is generated on your device. No personal details are asked for or collected. Back it up to an encrypted file whenever you like.
Pair with someone

Send them an invite over any channel you trust, or scan each other's codes in person. Pairing exchanges public keys, never the private ones.
Verify, then talk

Compare the safety number to be sure it's really them. From then on everything you send is encrypted for them and signed by you: messages, photos and files up to 50 MB.

Features

Encryption

End-to-end encryption: OpenPGP with Ed25519 and Curve25519 keys. Messages and files are sealed before they leave your device and opened only on your contact's.
Signed messages: Every envelope carries the sender's signature, so tampering anywhere along the way is detected.
Sealed sender: Who a message is from travels inside the encryption. The relay delivers it knowing only the mailbox it goes to.
Files: Photos, documents and anything else up to 50 MB, encrypted the same way as messages. The Files tab keeps every transfer in one place.

Contacts and groups

Pairing and safety numbers: Swap an invite in person or over any channel you trust, then compare a safety number to confirm nobody is in the middle.
Groups and channels: Encrypted group chats with people you've paired with, and broadcast channels for posting to many people at once.
Disappearing messages: Set a timer per conversation and messages are deleted once it runs out.
Report and block: Block unwanted contact with one tap. Reporting works without weakening the encryption for anyone else.

Your keys

No account: No phone number, no email address, no username database. There's nothing to sign up for.
Keys stay on your device: Your identity is generated on your device and leaves it only in an encrypted backup that you can open. You can lock the app with biometrics.
Bring your own key: Import an OpenPGP key from GnuPG or PGPony and keep your identity. Passphrase-protected keys stay protected.
Several identities: Keep separate accounts on one device, each with its own keys, contacts and inbox.

Delivery

Direct delivery: On the same Wi-Fi, or peer to peer across the internet, messages can go straight to your contact's device and skip the relay.
Nostr and SMS: On Android, sealed envelopes can also travel over Nostr relays, and the APK build can send them by SMS when there's no data. Both are off until you turn them on.
Desktop apps: Mac, Windows and Linux, notarized on the Mac and PGP-signed everywhere. Drag files in and pair with your phone by QR code. Desktop downloads
Open-source crypto: The cryptography is published under Apache-2.0, so the part that has to be right can be checked. Source code

What the relay sees

Messages and files pass through a relay so they reach you when your phone is off or out of reach. The relay only forwards sealed envelopes. It never sees names, message contents or plaintext, and with sealed sender it doesn't learn who sent what. It holds an encrypted blob long enough to deliver it, then deletes it.

The full breakdown is on the security page.

Run your own relay

The relay is open source under Apache-2.0. Run it with Docker or the installer on your own server and point the app at it.

Self-hosting guide Relay releases on GitHub

Questions

Is CarrierPony available yet?

Yes. CarrierPony is free on the App Store for iPhone and on Google Play for Android. The Android app is also a direct APK download from this site, no Google account needed, and there are desktop apps for Mac, Windows and Linux.

Do I need an account, phone number, or email address?

No. Your identity is an OpenPGP keypair generated on your device in a moment. There is no sign-up, no login, and no personal details anywhere in the app.

What encryption does CarrierPony use?

OpenPGP with modern keys: Ed25519 for signing and Curve25519 for encryption. Every message and file is encrypted for the recipient and signed by the sender before it leaves your phone. The crypto engine is PGPonyCore, the same open-source core that powers PGPony.

What can the relay see?

Sealed envelopes, and nothing inside them. The relay stores an encrypted blob just long enough to deliver it to the recipient's device, then lets it go. It never sees names, message contents, or plaintext of any kind. With sealed sender, the sender's identity moves inside the encryption too, so the relay can't even tell who a message came from. And when you and your contact are on the same network, or direct delivery can reach them, the message skips the relay altogether.

How do I know I'm really talking to my contact?

After pairing, both of you see the same safety number derived from your keys. Compare it in person or over a channel you trust. If it matches, no one slipped into the middle.

Can I use my existing PGP key?

Yes. If you already have an OpenPGP key from GnuPG or PGPony, import it and keep your identity. Passphrase-protected keys stay protected.

Can I send files?

Yes. Photos, documents, anything up to 50 MB, encrypted and signed exactly like your messages. A dedicated Files tab keeps every transfer in one place.

Does it do group chats?

Yes. Groups are end-to-end encrypted conversations among people you have paired with, and broadcast channels let one person publish to many subscribers who can read but not reply into the channel. Both use the same OpenPGP sealing as one-to-one chats.

Is there a desktop app?

Yes. CarrierPony runs on macOS, Windows and Linux (x86_64 and ARM), with the same crypto core and messaging code as the Android app. Pair it with your phone by scanning a QR code. Downloads and install notes are on the desktop page.

Can I install it without Google Play?

Yes. CarrierPony is on F-Droid, and the APK on this site is downloaded straight from the GitHub release, signed with the CarrierPony PGP key. Both are the open build, which also includes the optional SMS transport. On the Tor and I2P mirrors the APK is served from this server, so it never leaves the network you came in on.

Can I have more than one identity?

Yes. Keep several accounts on one device, each with its own keys, contacts and inbox, and switch between them.

Is it open source?

The cryptography is. CarrierPony is built on PGPonyCore, published under Apache-2.0 on GitHub, so the part that has to be right is public and checkable.

Download CarrierPony

Free on iPhone, Android, Mac, Windows and Linux.