An Android app that makes PGP/GPG encryption approachable. Encrypt and decrypt messages, manage your keys, and use a hardware YubiKey — without touching a command line.
⚠️ Alpha software. Easy GPG is under active development and has not been audited. Do not rely on it to protect data whose disclosure would put you at risk. See Security below.
- 🔐 Encrypt and share messages with PGP public keys
- 🔓 Decrypt messages with your private keys
- 🗝️ Generate, import, and manage key rings on device
- 🛡️ Hardware-backed key storage via the Android Keystore
- 🔑 YubiKey support over USB and NFC (OpenPGP applet)
- 🌐 Localizable string resources (English)
- Kotlin, Android SDK 35+ (
compileSdk36) - Bouncy Castle (
bcpg/bcprov) for OpenPGP - Yubico YubiKit for hardware keys
- AndroidX (Navigation, Lifecycle, Preference, Security-Crypto, Biometric)
Requires Android Studio (latest stable) and JDK 21.
git clone https://github.com/<your-username>/EasyGPG.git
cd EasyGPG
./gradlew assembleDebugOr open the project in Android Studio and run it on a device/emulator. The SDK
location is read from local.properties, which Android Studio generates for you
(it is intentionally not committed).
Contributions are very welcome — this project is looking for help to keep development alive. Please read CONTRIBUTING.md to get started.
Easy GPG handles cryptographic material, so please treat it with care:
- It is alpha, unaudited software.
- Secret key rings are encrypted with a passphrase you choose when the key is generated, on top of the Android Keystore layer. Key rings created by earlier versions used a placeholder passphrase; the app asks you to replace it the first time you decrypt a message.
- Your passphrase cannot be recovered. If you forget it, messages encrypted to that key can no longer be decrypted.
- When you enter a passphrase you choose how long it is remembered: until the screen turns off, for one hour (default), or for one day. It is held in memory only, overwritten when it expires, and always gone once the app process ends.
- Private keys are additionally sealed with an Android Keystore key that requires biometric or device-credential authentication within the last five minutes, so they cannot be read without you being present. Removing or resetting the device lock screen destroys that key, and with it access to the stored private keys.
- Found a vulnerability? Please do not open a public issue. Instead, report it privately to the maintainer (see CONTRIBUTING.md).
Easy GPG is free software licensed under the GNU General Public License v3.0. You may redistribute and/or modify it under those terms. It comes with no warranty.