One set of hands. The same rules.
Ten small privacy tools, all built and maintained by one indie developer. No accounts, no tracking, and open-source cores across the board.
HashPony Android you're here
Hash files, text and whole folders, check a download against a published value, verify a folder against its sums file, and write sums files desktop tools accept. Zero permissions, fully offline.
PGPony iOS · Android
The full OpenPGP world on your phone. GnuPG-compatible keys, hardware smartcards, on-card key generation, and a pass store viewer.
PassPony iOS · Android
A password manager with no cloud behind it. The vault stays on your own devices, and AutoFill works without handing your logins to anyone.
VaultPony Android
VeraCrypt-compatible encrypted vaults on Android. One encrypted file holds a whole private filesystem, with hidden volumes, cipher cascades, and no network permission at all.
AgePony iOS · Android
Modern file encryption and signing on the age protocol. Encrypt to a GitHub username, sign with a security key, and stay bit-compatible with the age CLI.
CarrierPony iOS
Private messaging and file transfer, sealed end to end with OpenPGP. Pair, verify a safety number, and talk; the relay only ever sees envelopes.
BurnPony iOS · Android planned
Self-destructing notes, sealed with AES-256-GCM on your phone. The recipient opens one link in any browser; after the last allowed view the note burns.
RelayPony Android · iOS planned
Encrypted peer-to-peer file transfer. Files go straight from one phone to another over your Wi-Fi, encrypted with age. No server, no account.
QuorumPony iOS
Real Shamir Secret Sharing. Split a key into cards; any few rebuild it, and a single card alone reveals nothing. Fully offline and open source.
ScrubPony macOS · Linux
A command line tool that strips EXIF, GPS, XMP and IPTC out of JPEGs and copies the image data through byte for byte. Atomic writes, orientation preserved, fails closed.
What they have in common
No accounts
Nothing to sign up for, nothing to log into. The tools work the moment you open them.
No tracking
No analytics, no telemetry, no ad IDs. None of them phone home about what you do.
Open cores
The important code is public and Apache-2.0 licensed, so it can be read and checked.
Questions about any of them go to one inbox: NorseHorse@norsehor.se.