Your files, in a box you own.

Why VaultPony exists

Real disk encryption on a desktop has been a solved problem for two decades. You make a container, you put things in it, and without the password it is a file full of noise. On a phone the story has been worse: either you trust the whole device to one system-level switch, or you hand your files to a cloud service that promises to be careful with them.

Plenty of people already keep a VeraCrypt container on a laptop or a USB stick. There has not been a good, free, open way to open that same container on the phone in their pocket. VaultPony is that: the same file, the same format, the same password, on Android.

How it is built

The cryptography lives in a shared Rust core: header parsing and validation, PBKDF2 key derivation, the XTS engine including the cascades, the filesystem layer, and the session and auto-lock logic. The Android app is Kotlin and Jetpack Compose sitting on top of it through UniFFI. The same core is what the desktop and iOS builds will use, so there is one implementation of the hard part rather than three.

The format is implemented clean-room from published documentation. No VeraCrypt or TrueCrypt source is used or linked. Compatibility is verified against a corpus of real VeraCrypt fixtures generated from a pinned VeraCrypt checkout, so "compatible" means tested rather than intended.

The app reaches your files only through the Storage Access Framework and declares no internet permission at all. Both repositories are open source under Apache-2.0: VaultPonyAndroid and VaultPonyCore.

Where it is going

Android is out now as a direct APK. F-Droid is next, then the desktop app, then iOS, and Google Play last. There is no roadmap with dates on it, because a one-person project that promises dates is a one-person project that misses them.

The Pony family

VaultPony has siblings, all the same one person, all the same principles:

• PGPony does the full OpenPGP world: GnuPG-compatible keys, hardware smartcards, on-card key generation.
• PassPony is a password manager that keeps the vault on your own devices.
• AgePony brings the age protocol to the phone for encrypting and signing files.
• RelayPony sends files straight from one phone to another with no server in the middle.
• QuorumPony splits a secret into cards, where any few rebuild it and one alone reveals nothing.

All nine sit together on the family page.

The rules

• No accounts. Nothing to sign up for.
• No tracking. No analytics, no telemetry, no ad IDs.
• No network. The app cannot reach the internet, because it never asked for permission to.
• Free. No in-app purchases, no subscriptions.

Contact

Bug reports, questions, and the occasional thank-you all go to the same inbox: NorseHorse@norsehor.se.

VeraCrypt is a registered trademark of IDRIX. VaultPony is an independent project, not affiliated with or endorsed by IDRIX. The container format is implemented clean-room from published format documentation; no VeraCrypt or TrueCrypt source is used or linked.