Skip to content
Malachi

Malachi for Android

Malachi is available as an APK file right here – no app store, no account. Please verify the file before installing; it takes a minute.

Current version

Version
1.0.0 (version code 1)
Released
20 October 2026
Requirement
Android 7.0 or later
File
malachi-1.0.0-arm64-v8a.apk (83.2 MB)
SHA-256
083635e1e24cb1f452bd13cb155fac2ca27748246e7312a34333e29bfadc5db2
Download Malachi 1.0.0 (arm64-v8a, 83.2 MB)

Also works over Tor: open p75bcu4mna6lik35occlsoeoyke46zyikfuq2ugu3wdvu44e5c4wanyd.onion in the Tor Browser.

What's new?

Malachi 1.0 – the first version.

Malachi is a private messenger for Android without a server: messages go straight from device to device, end-to-end and post-quantum encrypted, via Tor when needed. No account, no phone number, no contact list on our side.

Free:
- Chats, groups with pictures and voice messages, calls, and joining group calls
- Pair contacts via QR code or by matching phone numbers over Tor (the numbers are not stored anywhere)
- App PIN and fingerprint, Tor with bridges, disappearing messages, view-once media, Secret Chat and safety code
- Open and decrypt Seal messages from other messengers
- Copy messages safely (removed from the clipboard after 60 seconds)
- Available in 18 languages, including Arabic and Persian

Full version (one-time, no subscription):
- Emergency PIN, wipe after 5 wrong PINs and remote wipe
- Maximum anonymity: everything over Tor only
- Seal mode: send encrypted messages over WhatsApp and others
- Start group calls
- 21 design themes including a matching app icon
- Screen protection can be switched off, for example for your own screenshots (Secret Chat and Seal always stay protected)

Updates come signed directly in the app (over Tor) or from this website.

Which file do I need?

There is a separate, smaller file for each processor type. Almost all phones from about 2017 onwards need "arm64-v8a". If the file won't install ("App not installed"), take "armeabi-v7a" (older 32-bit devices). "x86_64" is only for emulators and some Chromebooks.

All files of this version
ProcessorFileSizeSHA-256
arm64-v8amalachi-1.0.0-arm64-v8a.apk83.2 MB083635e1e24cb1f452bd13cb155fac2ca27748246e7312a34333e29bfadc5db2
armeabi-v7amalachi-1.0.0-armeabi-v7a.apk69.8 MB0ab10f842ab5d2dbd565051dee1cea3f9e7594956a27f00e44acc45199467d0c
x86_64malachi-1.0.0-x86_64.apk89.1 MB5e498a798143c3db4828693fc57135ecfc3e81a575343ed435b173f662a82a64

Verify the file

This is how you make sure the file is complete and really comes from Malachi. To be safest, also compare the values over a second route, for example once via the normal address and once via the onion address.

1. Compare the checksum (SHA-256)

The output must match the value in the table above exactly. Upper and lower case don't matter.

All checksums are also listed in the file SHA256SUMS. On Linux, sha256sum -c --ignore-missing SHA256SUMS checks all downloaded files at once.

2. Compare the signing certificate

Every Malachi APK is signed with the same key. Its certificate has this SHA-256 fingerprint:

fbd5d54b7e34af9c1b21910ba52049ad267e22d48140f3ac6a6c740846a9aec0

With apksigner from the Android SDK Build-Tools (on Windows apksigner.bat):

apksigner verify --print-certs malachi-1.0.0-arm64-v8a.apk

The line Signer #1 certificate SHA-256 digest: must show exactly the value above. keytool -printcert -jarfile malachi-1.0.0-arm64-v8a.apk shows the same value written with colons:

FB:D5:D5:4B:7E:34:AF:9C:1B:21:91:0B:A5:20:49:AD:26:7E:22:D4:81:40:F3:AC:6A:6C:74:08:46:A9:AE:C0

3. Advanced: signed version list

The file updates/manifest.json lists version, size and SHA-256 of every file. It is signed with an Ed25519 key that is never stored on this server (manifest.json.sig, Base64). The public key is ETAIGUc3F9MDfCh79kCJk4FhnxSLifZqdBwqA6WZ0OM (Base64url, 32 bytes; as a file: update-schluessel.pem). Verify with OpenSSL 3:

base64 -d manifest.json.sig > manifest.sig.bin
openssl pkeyutl -verify -pubin -inkey update-schluessel.pem -rawin -in manifest.json -sigfile manifest.sig.bin

Expected output: Signature Verified Successfully. Then compare the SHA-256 of the APK with the value in manifest.json.

Install

  1. Download the APK on your phone (in the browser or in Tor Browser for Android).
  2. Open the file. Android asks whether the app you open it with (browser or file manager) may "install unknown apps". Allow this for that one app only.
  3. Tap "Install".
  4. Afterwards, revoke the permission from step 2 in the Android settings.

Updates: You simply install a new version over the old one; your chats are kept. Android only accepts an update if it is signed with the same key as the installed app. A fake APK with a different key therefore cannot replace your installed Malachi – Android stops with an error message. In that case, don't install anything; download the file from here again.