End-to-end encryption.

The property the whole app is built around. A message is sealed on your phone and opened on your contact's phone. Everything in between — networks, the relay, anyone watching the wire — carries ciphertext it cannot read.

// definition

End-to-end encryption (E2EE) is encryption where only the communicating endpoints hold the keys. In CarrierPony, that means the sender's and recipient's devices — not the relay, not the developer, not Apple.

What it is

Before a message leaves your phone, it is encrypted to your contact's public key. Only their private key — which never leaves their device — can decrypt it. The relay stores and forwards the sealed result without any ability to open it.

Why it matters

Transport encryption (like HTTPS) protects data between you and a server, but the server still reads everything. End-to-end encryption removes the server from the trusted set entirely: a breach of the relay leaks ciphertext, not conversations.

// in CarrierPony Every message and every file in CarrierPony is end-to-end encrypted with OpenPGP, and additionally signed so tampering is detected. There is no unencrypted mode.

Related terms

Common questions.

Does end-to-end encryption hide who I'm talking to?

It hides content, not necessarily patterns. CarrierPony minimizes what surrounds the ciphertext — no accounts, no names, opaque routing identifiers — but E2EE itself is about making the contents unreadable. See the metadata entry.

Can the developer read my messages if compelled?

No. The developer holds no decryption keys. The relay can only hand over sealed envelopes, which is the point of the design.

Get CarrierPony

Free private messaging and file transfer for iPhone. No accounts, no tracking, no phone numbers.