PGP ID on Android
foodjis turns your phone and a small NFC security key into a digital identity nobody can take from you: sign, encrypt, recognise one another, with no account and no platform in between.
Free software · No account · No advertising
From the engineers who designed it to the crackers who exploit its flaws, all the way to the states that would rather watch their citizens than protect them: what you entrust to your phone does not necessarily stay between the two of you.
A message, a screenshot, a video: nothing says who really made them. Fakes travel faster than denials, and trust wears thin.
Your accounts belong to whoever hosts them. Let them change their terms, or close the door, and your digital identity goes with it.
PGP ID is a decentralised digital identity, built on the open OpenPGP standard. Its secret part lives in a security key, a YubiKey or a NitroKey, that you carry with you: it signs and decrypts, but does not let its secret out. What vouches for your identity is not a company’s terms of service: it is the people who know you and have certified it.
Your identifier is computed from a place and an instant of birth, not from a number someone hands you. The secrets are printed on paper, in fragments: your backup depends on no service.
Hold the key against the back of the phone: the identity is written over the key's own radio, not over the network. The phone keeps no secret.
What your key carries, in plain words: name, portrait, addresses, fingerprint, validity, certifications received. Every change is signed by the key, so by you, then published.
The gesture a web of trust is woven from: confirming that a certificate does belong to the person it names. No central office: everyone signs, everyone checks.
Look a certificate up on the keyservers, exchange one by QR code, sort them by status: certified, uncertified, expired, revoked.
Thunderbird for Android reads, signs, encrypts and decrypts your messages through foodjis, with the key held against the phone when it is needed.
Select a text in any application, or share it: foodjis decrypts it, checks its signature, or encrypts it for your contacts.
For the more technical: your remote sessions and your git commits authenticate and sign with the same security key.
A YubiKey 5 NFC or a Nitrokey 3A NFC. The foopgp association provides them to its members. See the key offer →
An Android phone, version 7 or newer, with an NFC reader, and the application from Google Play.
Create your identity, or present a key that is already set up. Then, when you meet, certify one another.
From Termux, an SSH connection authenticates with the security key, with no private key on the phone at all.
The SSH agent in detail →foodjis does not ask to be taken at its word. Here is what it does, and how.
The SSH agent in detail → The introductory article → Our tools on Codeberg →
foopgp, a non-profit association that promotes the uses of PGP technologies among individuals, businesses and policy makers. foodjis is developed for its members, and for everyone who wants to take back control of their digital identity.
Discover foopgp →
Android 7 or newer, an NFC reader, a contactless OpenPGP security key.
Rather avoid Google Play’s surveillance or other malfunctions? Download the application:
foodjis_1.3.4.apk
Check the application’s fingerprint and signature:
SHA-256 · PGP signature