cifra
PT EN
Download
private messenger for android · open source

Talk without leaving a trace.

No number, no e-mail, no account. Your identity is created on your phone, and no server knows who you are.

Messages leave your phone encrypted, travel through the Tor network — which hides where you connect from — and reach a server that cannot read them and does not know who sent them.

Download for Android How it works
version 0.1.0 · android 10 or newer · requires orbot · free, no ads
no sign-upNo personal data: no number, no e-mail, no name. Your ID is created on the phone, and only you hold its key.
the server cannot readIt only passes sealed envelopes along, without knowing who sent them, and deletes each one as soon as the recipient’s phone confirms it was saved.
tor network onlyThe app connects no other way. The server never learns where you connect from.
how it works

From zero to the first message in four steps.

No account, no address book: you and the other person install Cifra and exchange IDs. Everything happens on the two phones.

01

Create your identity

One tap, and the app generates an identity that is yours alone, on the phone. It becomes a 16-character ID and a unique pattern you can recognise at a glance. No personal data is asked for.

02

Write down the 12 words

They are the only copy of your identity. With them you recover your ID on a new phone and open your backup; without them, the identity is lost with the device. Whoever has them becomes you: keep them on paper, away from the phone.

03

Share your ID with people you trust

Send your ID any way you like and paste the other person’s into “New chat”. There is no search by name, no contact list and no QR code. Anyone who writes without being a contact arrives as a request, to accept, decline or block.

04

Compare the safety number (optional)

Each chat has a 60-digit number, identical on both phones. If they match, nobody is impersonating your contact. Compare in person, or paste the number the other person sent over another channel, and mark the chat as verified.

the path of a message

Only the two phones can read. The rest of the path sees sealed envelopes.

The cryptography follows Signal’s published protocols, implemented in open code. Nothing home-made.

your phoneSeals the envelopeThe message is encrypted with a fresh key for every send. The sender goes inside the envelope, and every envelope has the same size: from the outside, a long message looks just like a “hi”.
tor networkHides where you connect fromOrbot carries the envelope through the Tor network. The server receives it without learning your location on the internet.
serverHolds it without knowing whoseIt leaves the envelope in the recipient’s box and deletes it once their phone confirms it was saved. It only sees that a box received something, and the hour. If nobody picks it up in 14 days, it is deleted undelivered.
tor networkAgain, no addressThe recipient also fetches their box through the Tor network.
recipient’s phoneOpens the envelopeOnly here do the message and the sender appear.

Photos, videos and files (up to 25 MB) travel separately, encrypted the same way and kept for the same period. Of those, the path only sees the approximate size.

features

You decide what stays and what goes.

Each option explains, in the app itself, what happens when you turn it on. Nothing depends on a cloud.

hidden chats

Gone from the list. Back with a code.

Choose a secret code and hide any chats you want: they leave the list, the search and the notifications. To see them again, type the code into the search field. Without it, nothing on screen suggests they exist.

panic

Hold the button. Everything goes.

In under two seconds, Cifra destroys the keys and erases chats, contacts and settings on this phone; with a connection, it asks the server to delete your ID and your box. There is no undo: the identity only returns with the 12 words, and whatever you saved to the gallery or exported as a backup stays where it was.

Disappearing messagesFrom 10 seconds to 7 days, counted from sending, per chat or per message. They vanish from both phones at the same time. Off by default.
Delete for everyoneAny message, yours or the other person’s, with no time limit and no notice left behind. If they are offline, it disappears when they come back.
Photos and videos without metadataLocation, phone model, date and thumbnail are removed before sending, and photos are downsized (up to 2048 px). Documents go without the file name, with their content as is.
Auto-lockAfter 5 minutes idle (or on exit, 1 min, 15 min, 1 h) the app locks and only opens with your fingerprint or phone passcode. While locked, not even the app itself can read the chats.
Block screenshotsScreenshots and recordings come out blank, and the preview in recent apps is empty. On by default; in a chat, it applies to both phones.
Blind notificationsOnly “new message”, with no name and no text. The alert comes from the app itself, not through Google — which is why it keeps a fixed notification in the bar.
Nothing in the cloudCifra stays out of Google’s backup and of any cloud. If you want, export a backup file that only opens with your 12 words: it carries contacts and settings; messages and hidden chats, no.
Read receipts and “typing…”Off by default. On, they only work between people who also turn them on.
Note to selfA chat with yourself that never leaves the phone.
security

What Cifra protects — and what it does not.

No app is “100% secure”. This is the map of what it does and what depends on you.

protects
The contentOnly the two phones can read. Server and network see sealed envelopes, all the same size.
Who talks to whomThe server does not keep who sent each message, and the Tor network hides where each person connects from.
The locked phoneChats live in an encrypted database that only opens with your fingerprint or passcode. Someone who takes the locked phone reads nothing — and what you deleted does not come back.
The key exchangeThe safety number shows if someone has stepped between you and your contact.
does not protect
Whoever received the messageThey can keep it, copy it or photograph the screen with another device.
A tampered app on the other sideDisappearing messages, delete for everyone and screenshot blocking depend on the other person running the original Cifra.
An unlocked phone in someone’s handsWith the app open, whoever looks at the screen sees. Auto-lock and hidden chats reduce the damage.
The fact that you use TorYour carrier does not see who you talk to, but it sees that you use the Tor network and when the app is active.
tested before release

During development of this version, the app went through 12 acceptance tests on an emulator — among them a forensic examination with IPED, the Brazilian Federal Police’s forensic analysis tool:

locked phone · nothing readable across 36,000 items examined network · tor traffic only, no address exposed server database · no content, sender or address

The tests have not yet been repeated on a physical device, and the code has not had an independent security audit. Cifra is new: keep that in mind.

Read the report →
download

Cifra for Android.

Free, no ads, no tracking. For now, the installer (APK) is downloaded directly from here.

cifra 0.1.0android 10 or newer
Download the APK you will need Android 10 or newer with a PIN, pattern or password screen lock. Without a screen lock the app does not store the identity; if you remove the lock later, the chats on this phone are lost. Orbot, a free, open-source app that connects the phone to the Tor network. Without it, Cifra does not connect. Someone on the other side with Cifra: it cannot talk to people on other apps.

Orbot is available at orbot.app, on Google Play and on F-Droid.

how to install
1Install Orbot and connect it to the Tor network.
2Download Cifra’s APK and open the file. Android warns that it comes from outside the store: that is normal. Allow installation only for the browser you used.
3Open Cifra. With Orbot running, the chat list shows “tor · connected”. If it shows “tor · unavailable”, open Orbot again.
4Write down the 12 words and exchange your ID with whoever you want to talk to. New versions install over the old one, and your chats stay.
not yet available iPhone and a desktop version groups, calls and voice messages several phones on the same identity moving chats to a new phone: identity and contacts come back, messages do not

No dates for any of these. Whatever comes installs over the current version, with the same signature.

Want to check that the file is the original?A tampered file could pass itself off as Cifra. Two checks, for those who want to go all the way.
1 · the file for this version Check the APK you downloaded

Without JavaScript, the check does not run on this page: use the terminal, just below.

official value:957628f370b10ced52808c96a223e7e4fc1631e0a48dd8f1def6bc29f644ff16 The file never leaves your device: the computation happens here, in the browser.
Prefer to check in a terminal?
Windows: certutil -hashfile cifra-0.1.0.apk SHA256 Linux: sha256sum cifra-0.1.0.apk macOS: shasum -a 256 cifra-0.1.0.apk
2 · who signed it Fingerprint of Cifra’s signing key 52:C0:6A:21:D4:DB:82:5A:FA:C2:64:C3:C5:87:E4:71:06:9A:BD:5F:C7:44:6B:DC:3C:6C:D8:A1:BC:6A:33:F4 It is the same in every version. On a computer with the Android SDK, the command below prints the line “certificate SHA-256 digest” — in lowercase, without the colons: apksigner verify --print-certs cifra-0.1.0.apk The fingerprint is also in the source code repository. Check it in more than one place.
If anything does not match, do not install. Delete the file and download it again, only from here.
faq

Frequently asked questions.

Do my friends need to install it too?Yes. Cifra only talks to Cifra: each person installs the app and Orbot on their Android phone, and you exchange IDs. It cannot message people on WhatsApp or any other app.
Why do I need Orbot? Is it safe?Cifra only connects through the Tor network, and on Android Orbot is what makes that connection — a free, open-source app available at orbot.app, on Google Play and on F-Droid. There is no mode without Tor.
Does it work on iPhone? Are there groups, calls or voice messages?Not yet. Today Cifra is Android only and one-to-one only, with text, photos, videos and files. There is no date for the rest.
I changed or lost my phone. Now what?With the 12 words, your identity comes back on the new device and the old one stops receiving immediately. With an exported backup, contacts and settings come back too. Messages stay on the old phone: they do not migrate. Without the words, the identity is lost: create a new one and tell your contacts.
What does the server keep, and what can its operator see?Only what has not been delivered yet, encrypted and without a sender; once delivered, it is deleted, and whatever nobody picks up is gone in 14 days. The operator sees that an ID exists, when its box receives something, when the app is connected and the approximate size of files. Not the content, the sender, your location or your contact list — and nothing is logged.
Can I trust it? Has the code been audited?There has been no independent audit yet, and the tests ran on an emulator. On the other hand, everything is open: anyone can read the app and server code and check the file they install. It is a new app; treat it as one.
How much does it cost?Nothing. No ads, no tracking, no paid plan. The project is supported by donations.
Can I run my own server?The server code is open and anyone can run a copy, but the app in this version only talks to the official server.
open source

Nothing hidden. Check it yourself.

The app, the server and the privacy policy are public, under the GPLv3 licence. Security comes from mathematics, not secrecy: anyone can read the code, point out problems and verify that the file they installed is the one that was published.

View the code on GitHub Privacy policy
why cifra exists “Privacy is necessary for an open society in the electronic age. Privacy is not secrecy. […] Privacy is the power to selectively reveal oneself to the world.” Eric Hughes, A Cypherpunk’s Manifesto, 1993 Cifra exists so you can exercise that power: to talk without handing over who you are — not even to the server that carries the message.
official server · tor network only fmkanegcrocf53hmd7xnz4gnrjkewk4oo4bixebrrlxxrs4u4gpxviyd.onion donations in monero 86QtU9BtiGzRdwNZo5yd9eTbH4EHVd8xd1Cr2DpHLeBJe7Kqiz4JrzzDjq9F79XuTcGuFGi1TnouYX7deAkS7Zr4K1Hmxak Also check the address inside the app before sending. contact appcifra@proton.me