In short
- No phone number, no email. Your account is a set of keys that lives on your phone.
- Every message, file, group and call is end-to-end encrypted. Only the people in the conversation hold the keys.
- Post-quantum protection is in every layer, not only in messages: files, groups, calls and linking a computer.
- The server delivers sealed envelopes. It does not know who wrote to whom.
- The encryption core is open source. You can run the tests yourself.
Where the protection is
What “two keys at once” means
Classical encryption (X25519) has protected the internet for years, but a large quantum computer could break it. Post-quantum encryption (ML-KEM and ML-DSA, standardised by NIST in 2024) is built to resist quantum computers, but it is young.
Umbera does not choose between them. Every key is made from both, so it stays safe as long as at least one of them holds. Signal, Apple and Google take the same approach.
Everything encrypted with a shared key — AES-256 and ChaCha20 — is already resistant to quantum computers, because 256-bit keys are long enough.
What the server knows
The server stores and forwards sealed envelopes. Here is what it can and cannot learn. The full check, with tests and a Wireshark recording, is on the Proof page.
It doesn’t know who you write to.
The sender is sealed inside the ciphertext. Envelopes go to mailbox addresses that only the two people can compute and that aren’t tied to your account. When you both have the new version, the address is also derived from a post-quantum secret, and from the next release it changes every week.
It doesn’t see who is in a group.
A group message goes to each member as a separate sealed envelope of an ordinary size, in random order and with small random delays, so neither timing nor size gives the group away easily.
It doesn’t know what you send.
Contents, file names, photos, voice and calls are encrypted on your device. Message and file sizes are padded, so a size doesn’t reveal what’s inside.
It can’t swap someone’s keys unnoticed.
Public keys are kept in an append-only log, and your app checks the proof. You can also compare a safety number with the other person in person.
It doesn’t know who you are — but without Tor it sees your IP address.
No phone number, no email, no contact book upload. Without Tor, the server sees the IP address you connect from and when. Tor is off unless you turn it on: the app offers it the first time you open it, and you can switch it on later in settings. With Tor, the server can’t see your IP address.
Your computer
Umbera for Windows, macOS and Linux links to your phone with a QR code. Your account keys stay on the phone — they are never copied to the computer. The computer gets its own keys, certified by your phone.
So a computer in the wrong hands can’t take your account away: it can be unlinked from the phone, and when it comes back online it erases its chats and keys by itself. Changing the password, the recovery phrase and deleting the account are done only on the phone.
Everything the computer sends goes through the same encryption as the phone, with the same post-quantum layers.
While you link it, the server passes the encrypted link data between the two devices without being able to read it, and deletes it as soon as the computer is registered. It keeps the computer’s public keys with your phone’s signature, and it knows how many computers your account has — senders need that to encrypt for each of them. The computer’s name is encrypted.
Honest limits
There is no independent audit yet.
Our code is open and covered by tests that compare results byte for byte, but no outside firm has audited it yet. We have applied for one and will publish the report in full.
Old versions fall back to the older schemes.
If the other person still runs an old version, a call with them goes without the post-quantum layer and a group that includes them keeps its previous suite. Everything still works and stays end-to-end encrypted. Once everyone updates, the post-quantum layers switch on by themselves.
Group members on old versions sign classically.
MLS member signatures are Ed25519, as the standard defines today. Umbera adds an ML-DSA-65 signature on top, but a member who is still on an old version doesn’t add it, and their changes are accepted with the Ed25519 signature alone.
With an old version, the safety number covers only the classical keys.
When you both have the new version, the safety number also covers the post-quantum keys, and the screen says “Version 2”. If the other person still runs an old version, it is version 1: it checks the secp256k1 and X25519 keys, and the post-quantum keys are checked by the transparency log.
Mailbox addresses don’t change everywhere yet.
From the next release, the mailbox address of a chat changes every week, at the same moment for everyone — but only when both of you have that release. With someone on an old version, the address stays the same. The addresses of linked computers don’t change yet. And because your app checks all its mailboxes over one connection, the server can see that a set of addresses belongs to one device — not whose it is. Without Tor, it also sees your IP address.
A hacked device is a hacked device.
Encryption protects data on the way and on the server. If someone controls your phone or computer, they can read what you read. Umbera Shield helps you check your phone.
If we find a bug
We fix it, ship the fix in an update and say what was wrong. We have done this before: every audit item is listed in the code with what it fixed.
Found a weakness yourself? Write to us — the rules are in SECURITY.md on GitHub.
For developers and cryptographers
Formats, formulas, labels and test vectors — everything you need to check our work.