Malachi – messages straight from device to device

A free messenger for Android. No phone number, no account and no server your messages pass through. End-to-end encrypted, with Tor built in.

At a glance

No account, no number

You don't sign up anywhere. You add contacts by exchanging an invitation – ideally in person via QR code, otherwise as a link or code.
No Malachi server

There is no server that stores or relays your messages. Messages, files and calls travel between your devices – via Tor first, then directly whenever possible.
End-to-end encrypted

Every message gets its own key (Double Ratchet). The key exchange combines X25519 with ML-KEM-768, a scheme designed to resist future quantum computers.
Everything a messenger needs

One-to-one and group chats, voice messages, pictures and files, voice and video calls – all encrypted.
Seal mode

Encrypt texts and files for WhatsApp, Signal and others. The other messenger only carries ciphertext. Encrypting is part of the full version, decrypting is free.
Free

The app is free. If you want more, buy the full version for €2.99 once – no subscription, no account.

Invite. You show your contact a QR code (or send a link). It tells their device how to reach yours over Tor. No phone number or username is needed.
Agree on keys. Your devices negotiate secret keys between themselves. You can compare the safety code (shield icon in the chat) – if it matches, nobody is sitting in between.
Write. Each message is encrypted on your phone and only decrypted again on your contact's phone. On the way it is nothing but ciphertext.
Deliver. If both devices are reachable, the message arrives directly. Otherwise it waits, encrypted, on your device and is delivered automatically as soon as you are connected again. There is no storage on the internet in between.

Only you and your contact ever see the content. Who can see your IP address depends on the connection mode you choose in the settings:

Connection modes in Malachi
Connection mode	How it connects	Who can see your IP address
Fast (default)	Via Tor first, then directly if possible. For the direct route the app asks two public STUN services run by German providers for its own public address.	The two STUN services asked (no content, no contacts) and your contact during a direct connection.
Private (without STUN)	Like "Fast", but without STUN services. A direct connection works less often – otherwise it stays on Tor.	Only your contact, and only during a direct connection.
Maximum anonymity (Tor only) – full version	Never a direct connection. Calls are voice only over Tor, no video.	Nobody, not even your contact.

For a message to arrive, both devices have to be reachable at the same time at some point – there is no server that keeps it in the meantime.
No encryption helps against malware on the phone itself or an unlocked device in someone else's hands.
Encryption hides content, not every trace: depending on the connection mode, STUN services or your contact can see your IP address (see above).
Malachi has not been reviewed by an independent auditor yet.
Malachi is currently only available for Android (version 7.0 and later).