Release candidates
Test builds of StegPony for Android, published before each release so testers can try them and check them against their source. A release candidate is not a release: it can have bugs, and the format can still change before 1.0.
StegPony 1.0.0-rc3
October 29, 2026 · Android 8.0 or later · 9.8 MB
- Hardware keys: a Nitrokey 3 over USB, and a plain message when a key won't open OpenPGP over NFC.
- Hide text or a file in a JPEG or PNG under a passphrase or a key, with an optional decoy, or hide in text.
- Reveal with a passphrase, a saved key, or an OpenPGP hardware key with a Curve25519 key over NFC or USB.
- Import Curve25519 OpenPGP keys from PGPony or GnuPG, and age keys.
- Telegram photo from an iPhone (experimental). WhatsApp, Signal and Telegram sent from Android don't work yet.
- The format can still change before 1.0. Keep the originals of anything you hide with this build.
SHA-256 of StegPony-1.0.0-rc3.apk
d79eb6db592548d73359b0daaa867e14c4f6d1a1c1a25186743c4a94a5309dec
APK signing certificate, SHA-256
5f1a484df08945fff27451d5a55a070714ad4e8ef61f4c1ab8846fcfaab6be82
Source
Tag v1.0.0-rc3, commit d2b02dfe186d
StegPony 1.0.0-rc2
October 29, 2026 · Android 8.0 or later · 9.8 MB
- First test build. Hide text or a file in a JPEG or PNG under a passphrase or a key, with an optional decoy, or hide in text.
- Reveal with a passphrase, a saved key, or an OpenPGP hardware key with a Curve25519 key over NFC or USB. A Nitrokey 3 doesn't work with this build; use RC3.
- Import Curve25519 OpenPGP keys from PGPony or GnuPG, and age keys.
- Telegram photo from an iPhone (experimental). WhatsApp, Signal and Telegram sent from Android don't work yet.
- The format can still change before 1.0. Keep the originals of anything you hide with this build.
SHA-256 of StegPony-1.0.0-rc2.apk
10458f3075e1a3b9aabe9e74209b524cdcc42645197e5d9276ac4bc1ba1e6a57
APK signing certificate, SHA-256
5f1a484df08945fff27451d5a55a070714ad4e8ef61f4c1ab8846fcfaab6be82
Source
Tag v1.0.0-rc2, commit def9b2f008f7
Install
Download the APK on your Android phone and open it. Android asks once to allow installs from your browser or file manager. A release candidate installs over an earlier one, and the 1.0 release will install over it, because they are signed with the same key.
Check the download
Compare the file's SHA-256 with the one above:
shasum -a 256 StegPony-*.apk
On Linux, sha256sum StegPony-*.apk does the same.
Check the OpenPGP signature with the NorseHorse release key (fingerprint A0CB C8F6 5AAC E56F 1C5B 7677 53F9 798E 4919 DE62, the same key that signs PGPony):
gpg --import norsehorse.asc
gpg --verify StegPony-*.apk.asc StegPony-*.apk
And check that the APK is signed with the certificate above:
apksigner verify --print-certs StegPony-*.apk
Report a problem
Open an issue on GitHub or write to NorseHorse@norsehor.se. Say which release candidate you used, your phone and Android version, and what you did. Please don't send real secrets or photos you care about.
