No phone number. Message your friends. No one can even see that you did.
Here's the same handful of conversations arriving at two different servers. A normal messenger's server can read the pattern of your life, who, when, how often. UMBRA's relay only ever sees sealed, identical-size blocks under random codes it can't join up.
Same conversations, one relay each. On the left, the server reads your life. On the right, the UMBRA relay holds sealed blocks it can't connect, so even we can't tell who you were talking to.
Type all day or never open the app, the wire looks identical either way. So a watcher can't even tell when you're talking, never mind to whom.
Send a photo or a document, and the server carrying it can't tell how big it is, what kind of file it is, or who it's for. It's split into identical locked pieces under random names, and only the person you sent it to can put them back together.
The private mailbox each friend uses to reach you quietly changes over time, and every friend gets a different one. Even a server that watched a single address for months can't build a lasting map of your life. The trail goes cold on its own.
Phone lost, or taken from you? Everything on it stays locked behind your passphrase. Someone who forces it open finds only noise, not your chats, not your contacts.
Your identity is just a key on your phone. Add a friend with a QR code or a one-time link, no number, no email, nothing that ties the app to the real you.
Every message is locked so only your friend's phone can open it, not us, not your network, not any server in between.
Messages fade by themselves, on your screen and in transit. Keeping one is a choice you make, never the default.
This is the app, not a metaphor. Read a message and it dissolves. Add a contact with a code, never a number.
Guardian quietly checks the links and files people send you for scams and phishing, and warns you in plain words. It runs entirely on your phone, so it can warn you, but it physically can't report you or phone home.
UMBRA isn't only chats. Your files, passwords and notes live in the same sealed vault, protected by one key, the same encryption engine that guards your messages.
Lose your phone, or have it taken? It all stays shut behind your passphrase. Someone who forces it open finds only noise.
“Secure everything,” meant literally, not just what you say, but what you keep.
One key protects it all. A leak in one place can't unlock the rest.
A leak is often exposed by who met whom, not what was said. UMBRA hides the contact and the timing, no number links a source to a reporter.
Built for places where the network is watched. Constant cover traffic hides when you coordinate; reaching each other with the internet cut is on the roadmap.
Privilege and patient trust depend on the record staying shut. No central store, no metadata trail, disappearing by default, less to ever be subpoenaed or breached.
You don't need a threat model to want your relationships kept to yourself. Same protection, no configuration, private is simply the default.
Everything that keeps you private is free, forever. UMBRA+ adds room and comforts on top, and it's the one messenger where paying can't reveal who you are.
UMBRA's code is open-source, so anyone, a security researcher, or you, can read exactly what it does and check the promises on this page. Every release is signed, so you can confirm the app you're running really is the one we published. We won't call UMBRA “audited” until an independent firm has published one, that's planned. Full reproducible builds (rebuild from source, get identical bytes) are in progress.
And we tell you what we can't hide. On iPhone, to wake your phone for a new message, Apple's push system can see when your device receives something, never from whom, never what. That's a limit of the platform, and we say so rather than pretend it away. It's why we call UMBRA metadata-minimizing, never “invisible.” Full threat model, published at launch.
The rest of the page is the human version. Here's the engineering, condensed, for the people who want it, the cryptography, the verifiable builds, and where we're headed. Skipping it changes nothing about how the app feels.
“Harvest now, decrypt later” is already a strategy, capture sealed traffic today, open it when a quantum computer arrives. UMBRA runs post-quantum crypto on every message by default, out of the box.
Post-quantum on every message, the key exchange and the ongoing ratchet.
EncroChat, Sky ECC and ANOM didn't fall to broken math. They fell because a server, an update channel, or a key could be reached. UMBRA's answer: hold nothing worth seizing at those points, and let you check the app you run really is the published source.
A shutdown is now a routine tool of control. Because UMBRA seals and pads a message before it touches any transport, that sealed block doesn't care how it travels. These are roadmap directions, not shipping features.
Nearby phones can relay for each other over Bluetooth and Wi-Fi mesh, messages hop device to device with no cell tower, no router, no ISP. A planned LoRa companion pushes that range across a town.
Still sealed. Still no phone number. The block is the same one that would have crossed the internet.
Because a message is sealed and padded before transport, it can ride a satellite link still fully encrypted, the link only ever carries a fixed-size, opaque block.
No SIM, no carrier account, no phone number, a path to reach out from anywhere the sky is visible.
Off-grid mesh and satellite transport are roadmap directions, not shipping features. UMBRA today runs over the internet (optionally via Tor).
Overclaiming is the mistake that sank the last generation of “secure phones.” So here's the plain truth, updated as we ship.
UMBRA is in active development. For the first builds only, nothing else, no tracking.