Libre Key Companion vs BurnPony

Libre Key Companion turns your iPhone into a manager for hardware security keys. Tap your key to NFC or plug it into USB-C and work with everything it stores — from a single, free, ad-free app. WHAT YOU CAN DO • One-time passcodes (OATH) — list TOTP/HOTP credentials with live codes, add new ones by scanning a QR code or pasting an otpauth:// link, and delete the ones you no longer need. Works with the standard YKOATH applet used by YubiKey-class and compatible keys. • Token2 on-device OTP — list, add, and remove TOTP entries stored directly on Token2 FIDO keys, including touch-required profiles. • FIDO2 / passkeys — read your authenticator's details, set or change its PIN, toggle always-require-user-verification, and view or delete passkeys with full per-passkey details. (FIDO2 management is available over NFC.) • PIV and OpenPGP — view certificate slots, key details, and PIN retry counters. • FIDO metadata — resolve your key's model name, icon, and certification level (e.g. FIDO Certified L2) from the FIDO Alliance metadata service, with an in-app update to refresh the catalog. TRANSPORTS • NFC — works with every supported applet. Hold your key to the top of the phone. • USB-C — read OATH, Token2 OTP, PIV, and OpenPGP by plugging the key in; the app detects it automatically. (FIDO2 management is NFC only on iOS.) PRIVACY FIRST No account. No analytics. No ads. No tracking. Codes and key data are shown on screen only and never leave your device. The single optional network request downloads the public FIDO Alliance metadata file and sends none of your data. Libre Key Companion is provided by Token2.

Send a secret without making the other person install anything. Write a note, set the self-destruct rules, share one link. The note is encrypted on your iPhone with AES-256-GCM before anything is uploaded, and it decrypts only in the recipient's browser. The decryption key travels in the part of the link after the #, which browsers never send to any server, so the server stores ciphertext it cannot read, plus a note ID, a view count, and an expiry. No accounts, no names, no analytics. THREE KINDS OF NOTE • Simple: one note, one link, optional passphrase • Double bottom: one link with separate compartments, each opened by its own passphrase. Hand over one passphrase and only that compartment shows; nobody can prove the others exist • Split key: the note opens only when enough key links are combined, for example any 2 of 3 WHAT YOU CONTROL • Views: burn after 1 reading, or allow up to 100 • Expiry: 5 minutes to 30 days, changeable later, counted from now • Scheduled opening: the note stays hidden, looking like it does not exist, until the time you pick • Optional passphrase, stretched with PBKDF2 and mixed into the key. Send it through a different channel than the link • Open immediately: skip the confirmation screen when a note should open on the first visit • Auto-hide: the revealed note re-hides after a timer • Read receipts, disclosed to the recipient before they reveal the note. BurnPony does not do silent read tracking • Defaults for new notes, set once in Settings • A private label for your own list; it never leaves your device • QR code for in-person handoff: the whole link, key included, transfers with no network at all SAVED COPIES (OPTIONAL, OFF BY DEFAULT) Keep a copy of a note you send so you can reread it after it burns. You choose per note. Each copy is encrypted to a key held in the Secure Enclave, which only uses it after Face ID, Touch ID or your passcode. Double bottom notes are never saved. HONEST LIMITS Whoever has the full link (and passphrase, if set) can read the note. A recipient can always copy or photograph a note while it is visible. Self-destruction limits future access; it does not control the moment of reading. OPEN The app, the server, the viewer, and the wire-format specification are open source (Apache-2.0), with cross-implementation test vectors. Self-hosters can point the app at their own server from Settings. Protocol: https://burnpony.app/protocol BurnPony is part of the pony family of privacy tools: encryption you can inspect instead of taking a developer's word for it.