Your pass and passage store, in your pocket
PassPony is a real client for the standard unix password store — both classic
pass (OpenPGP) and passage (age). Browse, edit, generate,
and autofill your passwords; sync over your own git remote; read your TOTP codes.
Your keys never leave your device.
Everything the store already is — on your phone
Nothing proprietary. PassPony reads and writes the exact on-disk format the command-line tools do, so your store stays yours.
Two formats, one app
Classic pass stores (OpenPGP / GnuPG) and passage stores (age) — switch between them; each keeps its own store.
Git sync
Clone, publish, and sync over your own git remote — GitHub, GitLab, Codeberg, or self-hosted. Conflicts are shown per file, never silently merged.
Autofill
QuickType suggestions in Safari and apps, filled straight from your store — gated behind Face ID and a passphrase policy you control.
Live TOTP
Two-factor codes from your otpauth:// lines, with a countdown ring — the pass-otp convention, read natively.
Byte-faithful edits
Edit one field and every other byte of the entry is left exactly as it was — comments, ordering, and spacing all preserved.
Your keys, your device
Decryption happens on-device with your own age identities or OpenPGP keys. No plaintext is ever written to disk; nothing is uploaded anywhere.
The store you already have
PassPony doesn't invent a format or an account. It speaks the one the unix tools already use.
Bring your keys
Import your age identity or OpenPGP key. Or generate a fresh one on device. Keys are stored encrypted and never leave.
Point at your store
Clone your existing git-synced store, or start a new one and publish it to a remote you control.
Use it anywhere
Browse folders, reveal passwords, read TOTP, autofill in the browser. Every change commits with a familiar pass-style message.
Read it with anything
Everything PassPony writes is decryptable by pass, passage, gpg, and age on your desktop. Verified byte-for-byte.
No accounts. No trackers. No middleman.
Only your remote
The only network connection PassPony ever makes is to the git remote you configure. Local-only and folder-sync modes make none at all.
No plaintext at rest
Decrypted content is held only while you're viewing it. The index caches entry names and timestamps — never contents.
What the git host sees
Entry names and folder structure are metadata visible to whoever hosts your repo — the same as with the CLI. PassPony says so plainly and never pretends otherwise.
For the people who read the source
The compatibility surface is a test suite, not a promise. Fixtures generated by the real binaries are the specification.
- pass
.gpgfiles · per-dir.gpg-id· nearest-ancestor resolution- passage
.agefiles ·.age-recipients· identities-fallback- TOTP
- RFC 6238 · SHA-1/256/512 · pass-otp
otpauth:// - fidelity
- byte-exact round-trip; unknown lines preserved
- age
- X25519 · ChaCha20-Poly1305 · scrypt (pure Swift)
- OpenPGP
- Ed25519 · Curve25519 · v4 & v6 (RFC 9580)
- engines
- open, auditable cores; verified against gpg & age
- on device
- keys encrypted at rest; nothing uploaded
- transport
- git over HTTPS (token) · SSH forthcoming
- pull
- fetch + rebase — never a merge of encrypted blobs
- conflicts
- per file: keep mine / theirs / both
- offline
- commits queue and badge until pushed
Questions
What's the difference between pass and passage?
Both are the same idea — one encrypted file per entry, organized in folders, versioned with git. pass encrypts with OpenPGP (GnuPG); passage is Filippo Valsorda's fork that encrypts with age instead. PassPony speaks both.
Does it work with my existing store?
Yes — that's the whole point. PassPony reads and writes the exact on-disk format, so a store you created on your laptop opens on your phone and vice versa, with no conversion.
Where do my keys and passwords go?
Nowhere. Keys are stored encrypted on your device; decryption happens locally. The only thing that ever leaves is the already-encrypted store, and only to the git remote you choose.
Do you support YubiKey / smartcards?
OpenPGP smartcard support (NFC and USB-C) is part of the plan and shares the hardware-tested card stack from the NorseHorse OpenPGP core. Availability is noted on the support page as it lands.
Is it open source?
The cryptographic cores are open and auditable — the part that matters for trust. The store engine that drives both formats is Apache-2.0. The app is where you verify the claim: everything it writes is readable by the standard CLIs.
Bring your store with you
iOS first, desktop close behind. No account to make.