A public repository clones anonymously — that path is verified. A private one needs a credential, and FoldRender offers two: GitHub's OAuth device flow, or a personal access token stored in the Android hardware keystore. Both are described here from the shipped implementation; neither has been run end to end on a clean device, and this page says so where it matters rather than at the bottom in small print.
FoldRender is on the Play Store as FoldRender: Git Repo Reader, package id dev.foldrender.app, free and distributed worldwide. Install it the ordinary way — no allow installs from this source prompt to approve, and updates arrive on their own. The app declares minSdk 30, so it needs Android 11 or newer; Play will tell you if a device is below that rather than letting you install a build that cannot run.
Branch glyph in the top bar. Sign-in sits at the top of the panel under the heading GitHub, above the clone field, because it is the thing you do before the clone rather than after it.
Tap Sign in with GitHub. The app requests a device code and shows a short code with an Open GitHub button that takes you to github.com/login/device; you type the code there, authorize, and the token arrives on its own — the panel polls rather than making you come back. When it lands, the panel reads “Signed in as your-login” with a Sign out button. Device flow is the only flow offered because it is the only GitHub OAuth flow that completes without a client secret, which an app that ships to devices cannot hold. The build on Google Play has an OAuth client id compiled in, so you get the button rather than a request to paste a client id.
Tap Credentials & identity next to the clone button. The form takes Host (pre-filled github.com), Username and Personal access token, and Save token confirms with “Saved for <host>”. This is the path for GitLab, Bitbucket, a self-hosted Forgejo or anything else that is not GitHub — device flow is GitHub-specific, the token form is not.
The same form has Name and Email fields under Commit identity. They are written into a .gitconfig inside the app's private storage, because Android's user.home is / and is not writable — without a real home directory JGit's config loading differs between ROMs. Setting the identity is only relevant if you later use the commit path, which is not a verified path.
Paste the HTTPS URL into Clone an HTTPS repository URL and tap Clone. Credentials are looked up by host, so the same stored token serves every repository on that host. HTTPS only — an SSH remote will not work, because shipping a key agent is a cost the app deliberately does not pay.
From here it is identical to a public clone: the repository opens as the workspace, the tree lists (slowly on a large repository, behind a spinner with no progress indicator), and every file renders in the right-hand pane. Nothing about a private repository changes how it is read.
A saved token is encrypted with an AES-GCM key held in the Android hardware keystore, and it is never read back into a field. The screen that took it clears itself, and no screen in the app displays a stored token — so a screenshot or a shoulder-surfer recovers nothing.
GitHub documents client_secret as required on the access-token endpoint for the browser flow, and treats code_verifier as an addition to it rather than a replacement. An app that ships no secret gets incorrect_client_credentials — after the user has already authorized in the browser. A button guaranteed to fail at the last step is worse than no button, so browser sign-in is offered nowhere in the UI.
The identifier a GitHub OAuth app is issued is public by design; it is compiled into the build rather than being asked for. A build shipped without one falls back to a one-time field for pasting a client id, and if neither is present the panel says plainly that GitHub sign-in is not configured in that build.
The honest list — shipped-but-unverified behaviour included, so you can tell before installing whether this build does the thing you came for.
Four apps people actually reach for, and the one axis that separates them: whether the repository ends up on the phone, and whether anything renders it once it is there.
| Tool | Download price | Where you get it | Clones to the device | Renders PDF / notebook / Markdown | Editor or shell |
|---|---|---|---|---|---|
| FoldRender 0.8.2 | US$0 | Google Play, worldwide | Yes — HTTPS, anonymous for public repos | Yes — native Compose renderers | No, deliberately: a reader, not an IDE |
| GitHub Mobile | US$0 | Google Play and the App Store | No — it reads repositories hosted on GitHub | Only what GitHub itself renders, online | Edits files inside a pull request |
| Termux + git | US$0 | F-Droid or GitHub | Yes — the real git CLI | No — terminal text only | Yes, a full shell and any CLI editor |
| MGit 1.7.0 (2023) | US$0 | F-Droid only | Yes — clone, pull, push, HTTPS or SSH keys | No | No — its own listing says it ships no text editor |
Prices are for the download. GitHub Mobile’s capabilities follow your GitHub plan; Termux and MGit are both free software. MGit’s version and date are from its F-Droid listing.
Every figure here is read out of the shipping build or off a primary source listed at the foot of this page — nothing is rounded up for effect.
0.8.2, build 16, last reviewed on 27 August 2026.minSdk 30 — the API level Android 11 shipped with in 2020 — compiled and targeted against API 36.The primary documents behind the figures above, so you can confirm any of them without taking our word for it.
git-clone reference — the operation the app's clone button performs, in the words of the project that defines itminSdk names as its floorPage last reviewed 2026-08-27, against FoldRender 0.8.2.