MVP PRO Ember Version 1.2.2
Private messenger for Android

Encrypted messages that burn after they are read.

Ember is end-to-end encrypted, keeps no message on disk, and needs no account, phone number or email.

Download for Android APK · works on any phone · 22 MB

Smaller builds: 64-bit ARM (almost every phone since 2016) · 32-bit ARM (older devices)

Encryption
Signal Protocol, post-quantum key agreement
Account
None. Pair by QR code
Message storage
Memory only, never on disk
Screenshots
Blocked by Android
Requires
Android 8.0 or newer
Licence
AGPL-3.0, source below
Audit
Not independently audited
Installing

Open the downloaded file and tap install. Android will ask you to allow installing apps from your browser. That is a one-time toggle, because this app is not distributed through the Play Store.

Android 8.0 or newer required.

What it does

Built so a message cannot outlive its reading

  • End-to-end encrypted

    The Signal Protocol, with post-quantum key agreement. Keys are generated on your phone and never leave it.

  • Messages burn

    A message starts a countdown the moment it is drawn on screen, then catches fire and is overwritten in memory, on both phones at once.

  • No account, no phone number, no email

    You pair by scanning a QR code in person, then message from anywhere. There is no directory to look anyone up in, because there is no directory.

  • Message text is never written to disk

    No database row, no file, no backup. It lives in memory and dies with the app.

  • Screenshots are blocked

    By Android itself, including screen recording, casting and the app-switcher preview.

What it does not do

The limits, stated plainly

  • Stop a camera pointed at your screen

    No app can. Blocking screenshots stops the device capturing; it does nothing about the person opposite you.

  • Protect you on a compromised phone

    Wiping memory defeats forensic recovery afterwards. It does not defeat malware or a keylogger reading what you type.

  • Hide that you are talking to someone

    Message contents are unreadable to the relay, but a relay necessarily sees that two devices exchanged something and when.

  • Work with no internet

    Everything, pairing included, travels over the network. Two phones side by side with no signal cannot talk to each other.

This has not been independently audited. The cryptography is Signal's own library, which has been; the code around it has not. Judge it accordingly, and read the source. That is what it is there for.
Verify what you downloaded

Every build here is signed with the same key. On a phone you can check with an APK viewer; on a computer, with apksigner verify --print-certs.

Signing certificate SHA-256
BE:DB:39:EF:3A:E9:D5:50:CD:F3:F9:5D:1F:E8:26:B4:
FF:20:AD:41:3F:65:5A:D4:97:1A:33:B1:7E:F2:CA:1B

File checksums (sha256sum)

Universal APK
ember-1.2.2.apk
6794149e7d969dd3d687c695a276d4913d51d7d26c04111f723bbc993cefc747 64-bit ARM
ember-1.2.2-arm64.apk
1116dd874cd439c95cdc03bcc961b74fd10dcbead555983ce1afa05f7a3de0c2 32-bit ARM
ember-1.2.2-arm32.apk
6a6402909b9d44b1f999b843d6d07fde45a55909371f0b6af8e166c90450e218 Source
ember-source-1.2.2.tar.gz
dea80aee088ed248c803e6b5264c25c5579805db4d28b154f01eb6ac7ad380aa
Source code

Ember links against libsignal, which is licensed under the GNU Affero General Public License v3. That licence requires that anyone given the app is also offered its complete source, so here it is, including the relay server.

Download the source (tar.gz)