BurnPony on your desktop.

Download

Version 1.0.0, released 2026-07-29. Every build carries its own Java 17 runtime and a bundled SQLite, so there is nothing to install first.

What's in 1.0.0

First desktop release. The four screens the phone apps have, plus a full command line, on macOS, Linux and Windows.

Not a rewrite: it compiles the same crypto engine, relay client and database schema the phone apps ship, so a note created on a laptop and one created on a phone are the same note. The interface follows your system language in nine of them.

Verify what you downloaded

Every artifact has a detached PGP signature, and a signed SHA256SUMS covers all eight. The signing key is the same one published on this site — fingerprint A0CB C8F6 5AAC E56F 1C5B  7677 53F9 798E 4919 DE62.

# the manifest and its signature
curl -LO https://burnpony.app/downloads/SHA256SUMS
curl -LO https://burnpony.app/downloads/SHA256SUMS.asc

# confirm NorseHorse signed the manifest
curl -sL https://burnpony.app/assets/pgp/norsehorse.asc | gpg --import
gpg --verify SHA256SUMS.asc SHA256SUMS

# then check your file against it
sha256sum --ignore-missing -c SHA256SUMS      # Linux
shasum -a 256 --ignore-missing -c SHA256SUMS  # macOS

Verify the manifest signature first, then the file against the manifest. The other way round only proves your file matches a number whose origin you have not established. If gpg --verify does not print Good signature, stop — a checksum that matches an unverified manifest proves nothing at all.

The download buttons point at GitHub, but SHA256SUMS above is served from this site. That is the useful arrangement: the bytes come from wherever is fastest, and the thing you check them against comes from the domain whose PGP key you already have.

The command line

The desktop build is one binary with two faces: no arguments opens a window, a verb does the thing and exits.

echo "the secret" | burnpony create --views 1 --expires 1d
burnpony list
burnpony status <id>
burnpony burn <id>

burnpony is not on your PATH unless you put it there. None of the installers add it, because a desktop installer installs an application rather than a command. What you invoke depends on how you installed:

That last row is not a naming quirk. A Windows GUI-subsystem process has no stdout at all, so the main BurnPony.exe would run a verb, do the work, and discard every line of output. burnpony-cli.exe is a second, console-mode launcher that exists for exactly that reason, and the release build asserts it prints before shipping.

Full option list with burnpony help.

Before you install

• Nothing to install first. Each build bundles its own Java 17 runtime and SQLite. No JDK, no system packages.
• The note text never touches your disk. Only the note id, its management token and the settings needed to show status are stored locally. Lose the machine and you lose the ability to burn a note early — it still expires on its own.
• --passphrase <value> is refused on purpose. It would sit in ps output and in your shell history. Use --passphrase-env, --passphrase-fd or --passphrase-prompt.
• Don't run the window and a CLI verb at once. Both open the same SQLite file and the second writer gets a busy lock.
• Nine languages, following your system locale with an override in Settings. CLI output stays English so scripts keep working.
• Self-hosting works here too. Point Settings, or --server, at your own relay and this app never talks to ours. Each note remembers where it lives.

The source is on GitHub under Apache 2.0 — including the release workflow that built these artifacts and the checks it runs on them. More on the open source page.