AgePony: File Encryption

AgePony 5.1.0 fixes setup on iPhones with Face ID turned off and adds a Face ID only lock. New - Face ID only lock: the device passcode can no longer open the vault. If you've set an AgePony password, it still works when Face ID can't. - In Face ID only mode, a hardware key can also require Face ID on every use. - On iOS 26, new quantum-safe hardware keys keep both halves in the Secure Enclave, and the ML-KEM and X-Wing steps run on Apple's CryptoKit. Earlier iOS versions keep AgePony's own code, and existing keys keep working. - Hardware security keys ask for the PIN first, so a decrypt takes one tap. - Key pickers show each key's type and the start of the key, so two keys with similar names are easy to tell apart. Changed - A plainer design throughout, with error messages in plain words and a code where one helps. - AgePony is now tested against the 147 shared age test vectors. Fixed - Setup no longer stops with "Keychain refused the request" on iPhones that have a passcode but Face ID turned off. If iOS won't protect the vault with Face ID or the passcode, setup offers an AgePony password instead. - A vault set up with only the passcode moves to Face ID once Face ID is turned on. - Post-quantum keys now refuse a malformed key share that the test vectors turned up. - A file that finished decrypting after you closed the screen is no longer left behind. The 5.0.1 notes called the September review a full security audit. It was an internal security review, not an independent audit. The full report is published in the AgePony source repository. Everything still runs on your device. No tracking, no ads.