Everything you need to write about it.
Covering VaultPony? Help yourself to the facts, the boilerplate, and the brand assets below. Anything missing, just ask: NorseHorse@norsehor.se.
Fact sheet
- Name
- VaultPony
- What it is
- VeraCrypt-compatible encrypted vaults for Android
- Platforms
- Android (out now); F-Droid, desktop, iOS and Google Play to follow, in that order
- Download
- github.com/norsehorse-dev/VaultPonyAndroid/releases/latest
- Package id
dev.norsehorse.vaultpony- Requires
- Android 8.0 or later
- Price
- Free, no in-app purchases, no ads
- Container format
- VeraCrypt, clean-room from published documentation
- Ciphers
- 15 schemes: AES, Serpent, Twofish, Camellia, Kuznyechik, plus ten cascades
- Hashes
- 5: SHA-512, SHA-256, BLAKE2s-256, Whirlpool, Streebog
- Filesystems
- FAT, exFAT
- Permissions
- USE_BIOMETRIC only, and optional. No internet, no storage.
- License
- Open source, Apache-2.0, app and core
- Source
- VaultPonyAndroid (Kotlin app) · VaultPonyCore (shared Rust core)
- Languages
- English, German, Spanish, French, Russian, Brazilian Portuguese
- Developer
- NorseHorse, a solo indie developer
- Sibling apps
- PGPony, PassPony, AgePony, RelayPony, and four more
- Contact
- NorseHorse@norsehor.se
Boilerplate
Copy whichever length fits. No attribution needed.
VaultPony puts VeraCrypt-compatible encrypted vaults on Android: one encrypted file holds a whole private filesystem, with hidden volumes, cipher cascades, and no network permission at all.
VaultPony is a free, open-source encrypted container app for Android. A vault is a single encrypted file holding an entire private filesystem, and only the password, optionally plus keyfiles, opens it. Vaults are compatible with VeraCrypt, so the same container opens on the desktop and on the phone. It offers 15 encryption schemes including cascades, 5 header hashes, hidden volumes with outer-volume write protection, and header backup and restore. There is no account, no cloud, and no telemetry: the app declares no internet permission at all. Licensed Apache-2.0 over a shared Rust core.
VaultPony is a free, open-source encrypted container app for Android, built by NorseHorse, a solo independent developer. A vault is one encrypted file that holds an entire private filesystem; only the password, optionally combined with keyfiles and a PIM, opens it. Vaults use the VeraCrypt container format, implemented clean-room from published documentation and verified against a corpus of real VeraCrypt fixtures, so a container created on a phone opens in VeraCrypt on a desktop and vice versa. Users choose from 15 encryption schemes, including AES, Serpent, Twofish, Camellia and Kuznyechik plus ten cascades, and 5 header key-derivation hashes: SHA-512, SHA-256, BLAKE2s-256, Whirlpool and Streebog. Hidden volumes conceal a second vault inside the free space of the first, with a separate password; the outer password gives no sign the hidden volume exists, and unlocking with both passwords shields the hidden region so ordinary writes cannot destroy it. Other features include header backup and restore with the password verified before anything is written, changing a vault password in place, optional biometric unlock that is never offered for hidden volumes, auto-lock, blocked screenshots, and a no-trace mode that stops the app remembering which vaults exist. The cryptography lives in a shared Rust core bound to Kotlin through UniFFI. The app declares a single permission, USE_BIOMETRIC, and no internet permission, and the core links no networking libraries at all. Both the app and the core are open source under Apache-2.0. VaultPony is localized into English, German, Spanish, French, Russian and Brazilian Portuguese, and is part of a family of privacy tools that also includes PGPony, PassPony, AgePony and RelayPony.
Brand assets
The app mark: a brass padlock centered on a graphite plate. Please don't recolor or stretch it.
Getting it right
Two things are easy to state slightly wrong, and both matter on a security product.
On VeraCrypt. VaultPony reads and writes the VeraCrypt container format. It is not VeraCrypt, not a port of VeraCrypt, and not connected to the VeraCrypt project. VeraCrypt is a registered trademark of IDRIX. VaultPony is an independent project, not affiliated with or endorsed by IDRIX. The container format is implemented clean-room from published format documentation; no VeraCrypt or TrueCrypt source is used or linked.
On hidden volumes. The useful claim is that a vault with a hidden volume and a vault without one are indistinguishable to anyone who does not hold the hidden password, by timing and by error message. What that is worth in any given legal or physical situation is not something software decides. The security page states the scope precisely, including what is out of scope.
VaultPony is available now as a direct APK, with F-Droid next. For a build, more technical detail, or anything else, email NorseHorse@norsehor.se.