"End-to-end encrypted" has become a checkbox. WhatsApp has it. Signal has it. Telegram has it (sometimes).

But encryption hides what you say. It does not automatically hide who you are, who you talk to, or how much you say. That part is called metadata, and for many people it is the more dangerous part.

"We kill people based on metadata." — Michael Hayden, former director of the NSA and CIA

So when I started building Umbera, a messenger for Android and iOS, I set myself one rule: design the server as if it will one day be hacked, subpoenaed, or run by someone I don't trust. What can it learn?

Here is what I ended up with, including the parts that are still not solved.

1. No phone number. No email. Nothing.

Most messengers start by asking for your phone number. That number is tied to your real name, your SIM card and your contacts.

In Umbera you pick a username and a password. That's it. Your account recovery is a 12-word phrase (like a crypto wallet) that lives only on your side. The server has nothing to send a password reset to, because it does not know who you are.

2. The server does not see the sender

Normally a message arrives at the server with a "from" field. Even if the content is encrypted, the server writes down: Alice → Bob, 14:02.

Umbera uses sealed sender: the sender's identity is put inside the encrypted envelope. The server sees a blob that it has to deliver, not who sent it.

3. The server does not see the recipient either

This is the part I'm most proud of. Messages are not sent "to Bob". They are dropped into a mailbox address that only the two people in the chat can compute, and that address changes every week.

shared = X25519(my_private, peer_public) epoch = floor(unix_time / 604800) // one week mailbox = HKDF-SHA256(ikm = shared, salt = RENDEZVOUS_LABEL, info = "rdv|e{epoch}|{from}|{to}")

Each direction gets its own address. To read a mailbox, the phone proves it owns the key behind it with a signature, without showing any account ID.

From the server's point of view, it's a rotating random string receiving random-looking blobs. It cannot link two mailboxes to the same person, or tell which two people share one.

4. Message length is hidden in buckets

If "ok" is 2 bytes and a long confession is 900, size alone tells a story. Umbera pads every message up to a size bucket (1, 2, 4, 8, 16 KiB, then steps of 4 KiB), so "ok" and a whole paragraph look exactly the same on the wire.

5. Post-quantum, because recordings last forever

Someone can record your encrypted traffic today and decrypt it in 10–15 years when quantum computers are good enough. This is called harvest now, decrypt later.

Umbera's session setup is hybrid: classic X25519 plus ML-KEM-1024 (the NIST post-quantum standard). An attacker has to break both.

6. Your IP address

Encryption doesn't hide your IP. Umbera has built-in Tor on Android and iOS: one switch and all app traffic goes through Tor. Calls can go through a relay so the other person doesn't see your IP.

What it does NOT do (yet)

I think a privacy post without this section is marketing. So:

Status
1:1 message encryption post-quantum Yes (hybrid handshake)
Ratchet after the handshake post-quantum No, classic Double Ratchet for now
Group chats post-quantum No, groups use MLS with X25519
Calls post-quantum No, DTLS-SRTP (WebRTC)
Server sees delivery time Yes, it has to deliver the message
App and server source open No, only the crypto core is open
Several devices on one account No, one device per account

"Don't trust us. Verify."

Every messenger says "we can't read your messages". I didn't want you to take my word for it.

The cryptographic core is open source under Apache-2.0, written in Rust: umbera-core. It ships with proof tests you can run in one command. They play the role of a malicious server and check that it cannot read, link or forge messages, and that a removed group member cannot read new messages.

git clone https://github.com/UmberaAPP/UMBERA cd UMBERA/core cargo test 
test the_ciphertext_does_not_contain_the_message ... ok test anyone_with_other_keys_cannot_read_it ... ok test breaking_only_x25519_is_not_enough ... ok test breaking_only_kyber_is_not_enough ... ok

If you are a cryptographer and you find a hole, I really want to hear about it. Open an issue or write to info@umbera.app.

Try it

Umbera is live on both stores. No phone number, no email: just a username and a password.

Install it, look at what the app shows you about your own privacy, and tell me in the comments what you would try to break first. I'll answer every comment.