Why metadata matters
Even when messages are encrypted, a service that knows your phone number and your contact list knows who you are and who you talk to. Umbera removes these pieces one by one: no phone number, no email, no address book, and no sender on the envelope.
Sealed sender and changing mailbox addresses
The sender of every message is sealed inside the ciphertext, so the server accepts the envelope without knowing who sent it. The mailbox it is delivered to is derived by the two of you and changes periodically, so the server cannot link conversations by address.
Message size is padded to blocks, so the length of what you write is not visible either.
Your contact list stays on your phone
Umbera does not upload your address book and does not ask for access to your contacts. The list of people you talk to exists only on your device.
Network privacy with built-in Tor
Turn on Tor in the network settings and all of the app’s traffic goes through the Tor network. In calls, “Hide IP in calls” routes the call through a relay, so the other person does not see your IP address.
Private by design, verifiable in public
The cryptographic core is open source and comes with tests anyone can run. The proof page explains what the server sees for each message — and what it never sees.
Frequently asked questions
What makes Umbera a private messenger?
Besides end-to-end encryption, Umbera hides metadata: there is no phone number or email on the account, the sender is sealed inside the ciphertext, mailbox addresses change over time and message sizes are padded.
Does Umbera upload my contacts?
No. Umbera does not ask for access to your address book. Your contacts are stored only on your device.
Does Umbera support Tor?
Yes. Tor is built in and can be turned on with a single switch in the network settings.
Can the other person see my IP address in a call?
Not if you turn on “Hide IP in calls”. The call then goes through a relay, which only sees encrypted packets.
Try Umbera
Available on Android and iPhone. The trial is free and starts on first launch — no card required. See exactly what the server can and cannot see on the proof page.