Murmur is a messaging app for private chats with friends, family and groups. Your messages, photos and files are end-to-end encrypted, so Murmur can’t read them. You sign up with a username and a password, with no phone number and no email.
End-to-end encrypted means your messages are locked on your device and can only be unlocked by the devices in the conversation. Our servers pass them along without a key to open them. We call this sealed, and every chat and every group is sealed, on phones and on computers, with nothing to switch on.
Murmur works like the chat apps you know, with one-on-one chats, groups of up to 1,000 members, photos and documents, voice messages, replies, reactions, polls, todo lists, pinned messages, scheduled messages and disappearing messages. You see when friends are online, Vault keeps your own notes and saved messages, and backgrounds and bubble colors make your chats yours. It works on iPhone, Android, Windows and Mac, with up to 5 devices on one account. An account can even live only on a computer.
Murmur is made for writing, with voice messages for when typing won’t do. There are no voice or video calls, and no audio or video files, so the only sound you can send is a voice message.
Murmur keeps what you say private, and who you say it to. Our servers don’t know who sent a message, or who is in a chat or a group. To deliver messages, they still see a few details, like when a sealed message arrives. The full list is in What Murmur can see.
Murmur is for anyone who wants private chats without giving out a phone number. It’s built especially for groups and communities that live in writing, and for the people in them.
That includes families and friends, clubs and associations, open-source and tech groups, and the moderation teams of large communities. Admins get moderation tools that never read your messages.
Private, even from us.
Our servers don’t know who sends a message, or who is in your chats and groups. What they still see is listed in What Murmur can see.
Run a community that lives in writing? We’d love to hear from you at community@murmur.free.
Messaging is free. Security, privacy, group size and basic moderation never cost extra. People and communities who want more can pay for optional extras, or simply support us.
No ads, no selling data, no crypto token. Those are on our never list.
Optional extras add a few cosmetic touches, and a community can choose a plan with more room for its files.
Accessibility settings never cost extra either, whether text size, high contrast, an easy-to-read font or reduced motion.
If you buy an optional extra, our server sees a “supporter” flag on your account, without your payment identity. A group with a community plan is flagged the same way. Both are in the full table (rows 18 and 19).
Murmur is made by Murmur Labs LLC, the company that runs its servers too. Murmur is in English and French. Choose your language in Settings › Language. Each device keeps its own choice. Write to us at the addresses below.
A murmur is meant for the people beside you, not the whole room. That’s the idea behind the name, a quiet place for the conversations that matter. Murmur is made for writing, and it stays calm, with no ads, no noise and no alarms unless something is really wrong.
Every message is sealed on your device, and only the devices in the conversation can open it. Our servers carry sealed envelopes they have no key for. That’s why Murmur can’t read your messages.
Think of our server as a mail carrier that drops sealed envelopes into numbered mailboxes. It doesn’t know who sent them or whose mailboxes they are, and it never gets the key.
Messages, voice messages, photos, files, reactions, poll votes, todo lists, group names and photos, profiles, and when you’re online are all sealed. Vault, your own chat, is sealed for your devices alone.
Each of your devices has its own keys. Your phone and your computer are two separate members of each of your conversations.
When someone joins or leaves, the keys change. A removed device can’t read what comes next.
There’s nothing to switch on. Every chat and every group is end-to-end encrypted, on every device. There’s no unencrypted path.
What’s left on the outside: the mailbox it goes to, when it arrives and a rounded-up size. The sender’s name travels inside, sealed, and our servers can’t link a mailbox to an account or tell who is in a group. See At a glance.
What you can do: compare your security code with the people you write to most. It confirms you’re really writing to them, and once you’ve both marked it, the lock at the top of your chat turns green.
Try sealing a message in your browser
Nothing you type leaves this page.
MT
Maude’s phone
You, writing to Karim
Your message
Saturday’s ride leaves the park at 9:30. Bring a spare tube!
Tried with a key it made up. The check failed and nothing came out.
No key for this. The server can’t open it.
The real server doesn’t know who sent it or whose mailbox it is. Row 6
KB
Karim’s laptop
One of Karim’s 2 devices
Waiting for a sealed message
Sealed message from Maude
Saturday’s ride leaves the park at 9:30. Bring a spare tube!9:30 AM
Opened with the key on this device.
This message was changed on the way, so Karim’s laptop refused to open it.
Turn on JavaScript to seal your own message. Nothing would leave this page.
Your browser can’t run the sealing demo here, so this is a recorded example.
Seal a message first
What just happened
You just sealed a message in your browser. The middle panel shows everything a server would get, meaning a mailbox, when, and a rounded-up size, but not who sent it. Only the device with the key could open it.
This is a demonstration, not Murmur’s protocol. The real apps use MLS, where every device has its own keys and the group gets new keys whenever someone joins or leaves.
Technical notes
Cipher
AES-256-GCM, from your browser’s Web Crypto
Key
one random 256-bit key per visit, not extractable, shared by the two demo devices
Nonce
96 bits, random for every message
Padding
a 0x80 byte, then zeros, up to the next multiple of 256 bytes
Tamper check
a 128-bit authentication tag, which adds 16 bytes to what’s sent, so changing one bit makes opening fail
Murmur uses MLS, an open standard from the IETF for encrypting group conversations, for every chat, one-on-one included. We don’t invent our own cryptography.
A one-on-one chat is a group of two accounts and all their devices. Every device is its own member, with its own keys.
Our server is a delivery service. Group changes, like adding or removing someone, are sealed for the group’s members like everything else. The server puts them in order and passes them on without seeing who is added or removed, and every member’s app checks them against the group’s rules. Your messages themselves are always encrypted, and the server holds no key that could open them.
Messages are signed by the device that sent them. That’s what lets moderators trust a report, and it also means you can’t deny having written a message.
If one of your devices were ever compromised, the conversation heals at that device’s next key update. In one-on-one chats, that’s within 24 hours of activity or 50 messages; in groups, it depends on their size, up to 30 days in the largest ones.
Technical notes
Protocol
MLS (RFC 9420), through OpenMLS, for every conversation
Members
one per device; a one-on-one chat is a group of two accounts and all their devices
Key changes
every join, leave or key update starts a new epoch with new keys
Signatures
Ed25519; messages are signed, so they can’t be denied
Cipher suites
an allow-list pinned in every version, so a group can never move to a weaker suite
Cryptography
standard, reviewed libraries only; no home-made primitives
Padding
256-byte steps up to 4 KiB, then Padmé
Attachments
a random 256-bit key per file; ChaCha20-Poly1305 in 64 KiB chunks; kept on our servers for 30 days
Transport
TLS 1.3 only, with a pinned certificate authority; no third party terminates our connections
Server role
puts every group change in order without seeing who it adds or removes; each app checks it against the group’s rules, and the member list comes from the group’s own tree, never from what a client claims
To be sure your messages reach only your contact’s devices, compare your security code once, in person or over a channel you already trust. When you’ve both marked it as verified, the lock at the top of your chat turns green.
Where: tap the lock at the top right of a chat. While it’s gray, it offers Verify Security Code, or View Security Code once you’ve marked it and are waiting for your contact. The Security Code screen shows you and your contact side by side, each Verified or Not yet, then a QR code and the 60 digits. It’s the one place the code appears.
How: scan your contact’s QR code in person, and if it matches, it’s marked as verified on your side. Or read the 60 digits to each other on a call or by text message, not in Murmur, and tap Mark as Verified. Your contact does the same on their phone.
Both of you: the lock turns green only once you’ve both marked the code. If your contact marked it first, the lock tells you “Now it’s your turn”. Marking the code sends your contact a sealed word, so on our servers it’s one more envelope, like any message. Unverify takes it back.
What changes the code: adding a device doesn’t. Setting Murmur up again without your other devices or your Recovery Key does, and so does resetting your security identity. Murmur then tells the people you chat with, and a green lock turns gray until you’ve both marked the new code.
Safer from the start: contact links and QR codes carry a fingerprint the app checks. Finding someone by username trusts our server’s answer until you compare codes.
What you’ll see in a chat
Karim marked the security code as verified. Your turn. Tap to compare.
Karim marked the code first. Tapping the line opens the Security Code screen.
You marked the security code as verified.
You marked it first. The lock stays gray until Karim does.
You and Karim both marked the security code as verified. The lock turned green.
Once you’ve both marked it.
Karim unverified the security code.
Karim took it back. The lock turns gray until Karim marks it again.
Karim’s security code changed. This is normal after a reinstall or a new phone. Tap to verify.
For a contact you hadn’t verified. A quiet line that never blocks you.
Karim’s security code changed, so Karim is no longer verified. Tap to verify.
For a contact you had verified. The lock turns gray until you both mark the new code.
A sample, drawn as the Security Code screen shows it. Your real code comes from both accounts’ identity keys.
Technical notes
Security code
60 digits in 12 groups of 5, derived from both accounts’ identity keys (Ed25519); tied to the account, not the device
QR code
holds the 60 digits and both usernames; scanning a matching code in person marks it as verified on your side
Marking it verified
an end-to-end encrypted word to the other person, bound to both identity keys; the lock turns green only when each side holds the other’s word for the keys of now
Contact links
the identity fingerprint travels after the #, so it never reaches a web server
Lookup by username
trust on first use, until you compare security codes
Notices
a change signed by the old identity shows a calm line, and a warning to a contact who had verified you; a change without that signature shows a clear warning to every established contact
A Murmur account is a username and a password. No phone number, no email, no real name. What we don’t hold can’t leak or be handed over.
No phone number means your account isn’t tied to your SIM card, your carrier or your real name. People reach you by your exact username, or through a link or QR code you choose to share.
You choose a name of 5 to 20 lowercase letters, numbers and _, starting with a letter, and Murmur adds a dot and two digits, like alibaba.46. Up to 99 people can share a name, each with their own number, and you sign in with the whole username. It can’t be changed later, so pick one you’ll keep. Your display name is separate. It has 1 to 25 characters, and you can change it any time.
Murmur is for people 16 and older. By creating an account, you confirm you are; our server keeps only the version of the terms you accepted.
Signing up asks for a username and a password, nothing else. People see your @username until you add a name in Settings, if you ever do.
Murmur keeps what you say private, but our servers still see some details to deliver messages. See At a glance.
Technical notes
Account
a random 128-bit ID plus a unique username, made of the name, a dot and two digits from 01 to 99
Usernames on our side
stored as keyed hashes (HMAC); seen in clear only for a moment, at sign-in and lookup
The number
picked by our server at random among the numbers no account has for that name, and kept 10 minutes (30 at most) for the first sign-up shown it; if someone else was shown it first, the app offers another number before the account is made; accounts made before numbers got one automatically and keep it; a deleted account’s username waits 90 days before anyone can get it
Lookalikes
names too close to reserved or banned names are refused; there is no username market
Sign-in
OPAQUE (RFC 9807), so the password never leaves your device
Anyone who types your exact username, number included, can find you and send you a request. It’s on by default, and you can turn it off in Settings › Privacy › Find Me by Username. You can also share a link or QR code, like a business card. A request from someone you haven’t added waits in Message Requests until you accept it.
Turned off, searching for your username gives the same answer as searching for one that doesn’t exist, and takes the same time. Your link and QR code keep working. Search never suggests names.
Adding someone: their username, QR code or link leads to Send Request. You can add a note of up to 100 characters to say who you are; no first message needed. They see your note and choose whether to accept.
Who can write to you: in Settings › Privacy › Allow Requests From, choose Everyone (anyone with your username or link, the default), My Groups (only people you share a group with) or Nobody (only people you’ve added).
Message requests: the sender won’t know you’ve seen theirs until you accept it. Until then, they see one check and no delivered, read, typing or online signal, and a stranger’s photo stays hidden until you tap it. You can Delete, Accept, or Report and Block. Until you reply, a stranger can send 3 messages at most, links don’t open and get no preview, and a request with no answer disappears after 30 days.
A request from an account made less than a week ago comes with an alert that says “This account was just created. Make sure you know this person before you accept.”
Groups: your contacts can add you to a group directly. When anyone else adds you, the group arrives as a request that names who added you, under the same Allow Requests From setting.
Blocking happens on your device and sends them no message. If they had your profile photo, their phone just loses it and shows your initials, and they no longer see when you’re online. Our servers keep no list of who you blocked.
Inviting a friend: Contacts › Invite a Friend writes the invitation, with the official download link, in your own Messages app. You choose who gets it and send it from your phone, so Murmur never sees their number.
Technical notes
Contact links
app.murmur.free/add#…, group invites app.murmur.free/join#…, where the part after the # never reaches a web server and carries the identity fingerprint your app checks
Lookups
findable or not, the answer has the same shape and timing; at most 30 searches a minute and 300 a day per device, and 120 key lookups by name a minute and 1,000 a day
Consent
adding an account needs a consent token signed by one of its devices; contacts get one automatically, valid up to 90 days and renewed in the background
Blocking
changes your profile key and cancels consent tokens; the server only keeps a single counter, never a block list
Your profile is a name, a photo and a short bio, all optional. You choose who sees your photo and your bio, and by default it’s only your contacts. Your profile is sealed, so our servers can’t read it.
Name and bio: in Settings › Profile › Edit Profile. A name is 1 to 25 characters; until you add one, people see your @username. A bio is up to 80 characters, shown under your username.
Photo: Take Photo, Choose Photo, or Text, for 1 to 3 letters or an emoji on one of 12 colors. Or pick one of 20 ready-made pictures made for Murmur, like Tulip, Whale or Lighthouse. The same choices set a group’s photo.
Who sees them: Settings › Privacy › Profile Photo and Bio each offer Everyone (the people you chat with), My Contacts (the default) or Nobody. Whoever loses access has it removed from their phone.
Your name on forwards: Settings › Privacy › Forwarded Messages chooses who can add your name when they forward what you wrote. By default it’s Nobody, so a forward says only “Forwarded”. When you allow it, it says “Forwarded from” and your name.
Edit Contact: tap Edit on someone’s card, or in a chat’s info, to give them a name and a photo that only you see. Nothing goes to them, and their @username stays under the name.
My Stats, in Settings › Profile, counts your contacts, your groups, and the messages and photos you sent. It’s counted on your own devices, and Murmur can’t see it.
Technical notes
Profile
sealed for each person allowed to see it; when you narrow who sees your photo, it’s sent again with a new key, and the old file is deleted from our servers
Photos
every choice, ready-made pictures and Text included, becomes an ordinary photo, encrypted on your device and padded to at least 256 KiB, so our servers can’t tell which kind you chose
Forwards
your choice travels sealed with your profile; the forwarder’s app applies it, and the label travels inside the sealed message
Edit Contact, My Stats
kept on your devices and synced among them, sealed so only they can open it; nothing goes to the other person
Your password proves it’s you when you sign in, and it never unlocks your messages. We never see it, not even when you create it, so we can’t reset it for you. If you forget it, your Recovery Key gets you back in.
What it protects: your sign-in. A stolen copy of our database doesn’t reveal your password. Someone who took over our servers completely could try to guess it offline. That’s why your password never protects a key.
What it doesn’t do: bring back your history or your contacts on its own. Those live on your devices and behind your Recovery Key.
Rules: at least 6 characters. No rules about symbols or capitals, no forced changes, and pasting and password managers are welcome. A password that’s easy to guess, like your username, a common password or a simple run of keys, is refused, and the app tells you why. The check runs on your device, and nothing is sent to another service.
What you can do: choose something long that only you would think of, keep it in a password manager, and save your Recovery Key from the Security Center. In the Security Center, your password shows as Good or Strong, or as “Use a stronger password” while it’s weak.
Forgot it? Your Recovery Key lets you set a new one, from Forgot password? on the sign-in screen or on a device that’s still signed in. Without it, see If you lose your phone.
Wrong guesses: five free tries, then waits that double from 1 minute up to 1 hour, on our server’s clock. After 100 failures in a row, at least 24 hours between tries. There’s never a permanent lockout, so someone guessing on purpose can slow down new sign-ins, but can’t lock you out for good, and your signed-in devices are never blocked.
Calm alerts: a daily summary in the app, and a notification at 20 and at 100 failures. Murmur never sends a link about this.
Murmur will never ask for your password or Recovery Key on a website or in a message.
That’s why even this website never asks for one.
Technical notes
Sign-in protocol
OPAQUE (RFC 9807) via opaque-ke, with ristretto255, TripleDH and SHA-512
Slow hashing
Argon2id, with costs set by measuring real devices
What we store
a registration record that doesn’t reveal the password; the secret that guards it lives in a hardware module, apart from the database
Strength check
on your device, against common and leaked passwords and the account’s own words; it says why, never sends the password
Your Recovery Key is the spare key to your account, made of 48 characters in 12 groups of 4. Murmur creates it on your device when you sign up, and you save it whenever you like, from Settings › Security Center. Keep it somewhere safe, like a password manager or a sheet of paper. We keep no copy and will never ask for it.
Until you save it, “Save your recovery key” stays first on the Security Center’s checklist. Saving it shows the key once, asks you to type it back, and never shows it again.
Any time, Settings › Account › Recovery Key lets you check that the key you kept still works, or replace it.
Recovery Key plus password gets you back right away. With only one of them, it takes longer, and your contacts are told that you recovered your account.
Be careful who sees it, because anyone who holds your Recovery Key could read your encrypted text backup, if you turned one on.
Replacing it takes a device that’s past its first 72 hours, plus your password or your current key.
Good to know: lose all your devices and your Recovery Key, and your messages are gone. That’s because we never hold your keys.
Until you save it, if you lose your only device, the only way back is a fresh start, which gives you a new identity under the same username after 7 days, without your contacts, groups or history. Someone who has your phone and can unlock it could stop that fresh start, so save your key early.
A sample, drawn as the app shows it. Your real key appears only in the app.
Technical notes
Format
232 random bits as 48 Crockford Base32 characters (no I, L, O or U) in 12 numbered groups of 4, with an 8-bit checksum (it catches 255 of 256 random typos; a challenge with the server is the final check); older keys of 13 groups keep working
What it unlocks
a sign-in key (we keep only its public half) and a sealing key for a root bundle that holds your identity key and account state
Before you save it
the key waits on your device; nothing made from it reaches our servers until you confirm it
Typing it
capitals, spaces and hyphens don’t matter
Backups
turning on the encrypted text backup asks you to save the key first; the backup has no forward secrecy, so whoever holds the key can read it
Pick up from another signed-in device, or with your Recovery Key. Recovery Key plus password gets you back right away. With less, it takes longer, and your contacts are told.
I still have:
Back right away.
Recovery Key plus password restores your account immediately, with the same identity, contacts and groups. Your history comes back from your encrypted backup, if you turned one on.
With nothing
Without a device, a password or a Recovery Key, nobody can get the account back, including us. We hold no keys, so we can’t open your account for anyone.
With your password
After 7 days, you get a new identity under the same username, without your contacts, groups or history. Your contacts see a clear warning. If it wasn’t you, any of your devices or your Recovery Key can cancel it.
With your Recovery Key
Same account, contacts and groups. For 72 hours your new device can chat but can’t make changes you can’t undo, and your contacts see that you recovered with a Recovery Key. If your other devices were lost or stolen, you can suspend them.
With another signed-in device
Keep chatting there. To add a new device or set a new password, you’ll need your password or your Recovery Key.
With your password and Recovery Key
Recovery Key plus password restores your account immediately, with the same identity, contacts and groups. Your history comes back from your encrypted backup, if you turned one on.
With a device and your password
Type your password on the new device, then scan its QR code from the device you still have and compare the short code. Your recent history comes along. For 72 hours, the new device can’t make changes you can’t undo.
With a device and your Recovery Key
On the device you still have, your Recovery Key lets you set a new password right away. Then link your new device with a QR code.
With all three
Link your new device from the one you have. Keep your Recovery Key safe, because it’s your plan B if every device is lost.
The four ways back, paths A to D, are explained step by step in the Technical notes.
With another signed-in device, link your new phone from Settings › Devices › Link a Device, with a QR code, a short code and your password. Your recent history comes along.
With your Recovery Key and your password, you’re back right away, with the same account, contacts and groups. Your history comes back from your encrypted backup, if you turned one on.
With your Recovery Key alone, you’re back, but for 72 hours your new device can’t make changes you can’t undo, and your contacts see that you recovered with a Recovery Key.
With your password alone, you get a fresh start after 7 days, under the same username but without your contacts, groups or history. Your contacts see a clear warning, and if it wasn’t you, any of your devices or your Recovery Key can cancel it.
With nothing, the account can’t be recovered, by anyone, including us. We hold no keys, so we can’t open your account for anyone.
Lost or stolen? From a device you still have, remove the lost one in Settings › Devices. You can also suspend your other devices for 72 hours (it’s reversible) or reset your security identity.
Good to know: if you’ve forgotten your password and someone else has your Recovery Key, they can take over your account. Keep the key where only you can reach it.
Technical notes
Path A
from a signed-in device, where the new device shows a QR code only after the right password; the code holds a commitment, not a key, and lasts 10 minutes; you compare 7 emoji, or 12 digits in 3 groups of 4; then 72 hours of probation
Path B
with no camera, the password plus approval with 7 emoji on a signed-in device; no history, backups or account root key until the 72-hour probation ends or you scan it in person (path A)
Path C
with the Recovery Key, immediate with the current password; with the key alone, always 72 hours of probation, even for an account that was dormant
Path D
with the password alone, a new identity after a 7-day wait enforced by your contacts’ apps through a signed reset record; a signed “Not me” from the old identity cancels it for good; 14-day cooldown after a cancellation
Device only
a device’s own unlock can only remove the most recently added device; anything you can’t undo needs the password or the Recovery Key
Forgot password
with the Recovery Key on an established device, immediate; with the key alone, through probation; with neither, the account can’t be recovered, and it’s deleted after its time without use
During probation
chatting works; linking, approving or revoking established devices, changing your password, replacing the key, resetting identity, loosening settings, exporting history and downloading backups don’t; other devices can be suspended for 72 hours, reversibly
Checking the design
the recovery rules are model-checked against three theft cases (phone thief, paper-key thief, phisher) and were reviewed independently, and you can read the report
Murmur’s defaults protect you without you changing anything. Where a default trades a little privacy for everyday comfort, like read receipts, being findable by username or showing when you’re online, you can change it in Settings › Privacy.
Murmur’s default settings, with the app’s own names
Setting
Default
Find Me by Username
On, for anyone who types your exact username, number included
Allow Requests From
Everyone, as a request; or My Groups, or Nobody
A stranger adding you to a group
Arrives as a request, under the same setting
Read Receipts, Typing Indicators
On, never in requests
Link Previews
On, made by the sender, never while typing, never in requests
Last Seen & Online
Everyone, meaning the people you chat with; or My Contacts, or Nobody
Profile Photo, Bio
My Contacts
Forwarded Messages
Nobody, so a forward says only “Forwarded”
Screenshot Protection
Off
Hide Messages in Chat List
Off
Default Timer
Off, so messages stay until you delete them
Screen Shield, Incognito Keyboard
Off; on in Lockdown Mode
App Lock
Off, and recommended in the Security Center
Previews (Notifications)
Name Only
Message Sounds, In-App Banners
On
Lockdown Mode
Off
Screenshot Protection, when you turn it on, makes screenshots and screen recordings of your direct chats show a black screen on the other person’s phone. Hide Messages in Chat List shows only names and new message counts in your list of chats.
On Windows, Screen Shield starts on, to keep your chats out of Recall. On Android, the screens with your Recovery Key or your password are always shielded.
You can take your data with you and delete your account whenever you want, from the app. Deleting it is immediate.
Export: Murmur lets you export all your data in a form you can import again.
Delete: in Settings › Account › Delete Account, Murmur lists what happens, then asks for your password. One confirmation, and it can’t be undone, not even by us. On a device added less than 72 hours ago, the deletion waits until those hours end, so someone who slipped a device in can’t delete your account in a hurry.
What’s erased: your account, sign-in record, keys, devices, notification tokens, profile, links and invites, and your encrypted text backup, except a note for each device that left (180 days at most) and what an open safety case or the law requires us to keep. Your devices are signed out and erased. Messages still waiting for you can’t be linked to you, so they expire within 30 days. Your username waits 90 days, unlinked from you, before anyone else can take it. Our server backups roll over within 14 days.
What stays with others: the people you talked to keep the messages they already have. To take back what you sent first, use Clear All Chats for Everyone (see Deleting messages and chats).
Away for a long time? Choose to have your account deleted after 1, 3, 6, 12, 18 or 24 months without use. The default is 12 months, and you’re warned first.
Hold the microphone to record a voice message, and let go to send it. It’s sealed on your phone, like a photo, and padded to the next of a few set sizes, so our servers never learn who sent it, and learn at most roughly how long it is.
Recording: with the message field empty, hold the microphone at the right and speak. Let go to send. Slide left to cancel, or slide up to lock it and talk hands-free. Stop lets you listen before you send it or throw it away. A voice message can last up to an hour.
Listening: play it at 1x, 1.5x or 2x, and the next one you haven’t heard plays on its own. On the lock screen, it shows as “Voice Message”, never with a name.
Like any message: reply, react, pin, forward or Save to Vault. You can also send it without sound, or schedule it up to a week ahead. In a group, it takes the Send Photos and Files permission.
Nothing extra: no “recording” signal and no “listened” receipt. The dot that marks a message you haven’t played stays on your phone.
Technical notes
Format
AAC audio in an MP4 file, up to 60 minutes or 15 MiB; its length and waveform travel inside the sealed message
Sealing
a random 256-bit key per file, like any attachment
Padding
the encrypted file is padded to the next size step, from 64 KiB and doubling at each step, so every message up to about 15 seconds weighs the same, and longer ones fall into a few sizes
On our servers
an encrypted file, kept 30 days at most, linked to no sender or chat (row 15); its size can suggest a voice message, never what it says, how long it is within its step, or who sent it
In the iPhone app, Murmur can turn a voice message into words, right on your phone. It’s off until you turn it on, and the words never leave your iPhone.
Turning it on: it’s off by default. You turn it on in Settings, on a page of its own that says what it does and how it stays private.
Reading one: a button on a voice message shows its words right under it.
Private: Apple’s speech recognition does the work on your iPhone, never on a server, ours or anyone else’s. The words aren’t sent to anyone or synced to your other devices, and they go away with the message.
Hold Send to send a message without sound, when the other person is online, at a time you choose, or later, when you’re ready. A scheduled message waits on our servers, sealed, so it goes out on time even if your phone is off.
Hold Send (or right-click it on a computer) to open the menu:
Send Without Sound: it arrives quietly, with no sound on their phone.
Send When Online: no notification wakes their phone; they see it the next time they open Murmur. One-on-one chats only.
Schedule Message: pick a day and a time, up to a year ahead, or a week for a photo, a file or a voice message.
Save for Later: keeps the message on your own devices, ready when you are. It’s never sent on its own.
Waiting Messages: the clock in the message field, or the row in the chat’s info, lists what’s scheduled and what’s saved. Until a message goes out, you can send it now, change its time, edit it or delete it, from any of your devices.
If the chat changes: block the person, leave the group, or lose the right to write there, and a scheduled message doesn’t go out; its words wait in Saved for Later. Deleting the chat deletes its waiting messages too.
Technical notes
Scheduled
sealed on your device, one envelope for each device that should get it, with a one-time key; our servers hold them until their time, then deliver them like any message
What our servers see
that sealed envelopes for some devices wait until a given time, with a rounded size and whether to wake a device; never what they say, which chat they’re for, or who scheduled them (row 39)
How long
until their time, a year at most; then 30 days after they go out or are cancelled, to answer “already sent”; then deleted
Changing or cancelling
a random secret shared only among your devices; our servers keep only its hash
Saved for Later
synced among your devices, sealed so only they can open it; never sent to anyone and not in the encrypted text backup; a saved voice message stays on the device that recorded it
Without sound, when online
a sealed flag, or a message that wakes no device; nothing new for our servers
Share a checklist in any chat, for groceries, a trip or the chores. Everyone in the chat can check items off and sees who checked what. Like everything else in Murmur, the list is sealed, so our servers never see it.
Making one: tap + in a chat, then Todo List. Give it a title if you like, then one item per line, up to 100. Choose its Sort, either Order Added, the default, or Done at Bottom, which puts checked items last; everyone in the chat sees the same order. In Vault, a list stays your own.
Checking items: tap an item to check it, and tap it again to uncheck it. The box shows the face of whoever checked it; only they can uncheck it, or in a group, whoever can edit the list. When everything is done, a green seal stamps the list “All done”. Up to 8 items show whole in the chat; a longer list shows its first 6 and Show All 14 Items (for a list of 14), which opens the card right there (Show Less folds it back).
Changing it: tap ••• at the top right of the list, then Edit List, to rename it, add, remove or reorder items, or change its Sort. Pin it to keep it at the top of the chat, with its progress; a tap on the pinned list takes you to its card.
In groups: everyone can check items off. Who can edit lists is the Edit Todo Lists permission, on by default; whoever made a list, and the admins, always can.
Notifications: a new list rings like a message, and so does a list that’s all done. Checking an item never does.
Technical notes
Sealed
a list is a message, sealed for every device in the chat; each check or edit is a small sealed envelope that wakes no device, except the one that completes the list, which rings once, like a message
What our servers see
sealed envelopes, as for any message; a list change is one size step above a reaction, never what it says or who made it
Limits
a title of 80 characters, 1 to 100 items of 150 characters each
Kept
on the devices in the chat; not in the encrypted text backup, and devices or members added later don’t get earlier lists
The people you chat with see when you’re online, and when you were last seen. You choose who, in Settings › Privacy › Last Seen & Online, between Everyone, My Contacts or Nobody. Your status travels sealed between devices, and our servers neither keep it nor count it.
Everyone, the default, means the people you chat with, including in groups. My Contacts means only the ones in your contacts. Nobody hides the exact time, and your contacts see an approximate one instead, “last seen recently” or “last seen a long time ago”.
What they see: under your name at the top of a chat, “online”, or “last seen 5 minutes ago”, “last seen today at 2:32 PM”, “last seen yesterday at 9:10 PM”, then a weekday or a date. In Chats and Contacts, a small dot on your picture while you’re online.
Never shown to strangers or in message requests, and never in Vault or in Murmur’s own chat. Hiding yours doesn’t hide theirs from you.
Changing your mind: a narrower choice, or Nobody, tells the phones that had your status to forget it. Blocking someone stops it from reaching them, without telling them. Their phone keeps the last time it saw you, which only gets older, as if you had stopped using Murmur.
On every device: your choice follows you to each device you’re signed in on, and Lockdown Mode sets Nobody on all of them, without even the approximate time.
Technical notes
How it travels
a small sealed word, sent while Murmur is open, only to the devices of the people who may see it; our servers carry it like any other envelope and leave it out of every count
What our servers see
only that a device has an open connection, in memory, for about 90 seconds (row 13)
The approximate time
a sealed sign sent at most once a day, never to a blocked person, carrying only the day; our servers hold it a random 1 to 12 hours before they deliver it, so it never tells when you opened Murmur. “Recently” means within the last 30 days
Your choice
kept in your account’s sealed state; a device that hasn’t received it yet shares nothing until it does
Delete a message for everyone and it leaves nothing behind on any phone in the chat, not even a “message deleted” line. You can also empty every chat at once, on your devices or for everyone.
One message: press and hold it, then Delete. Delete for Everyone works on the messages you sent, with no time limit. Delete for Me removes a message from your devices only. The bubble fades and the chat closes up.
One chat: Delete Chat keeps nothing of it on your devices, its scheduled and saved messages included.
Every chat, on this device: Settings › Chats › Clear All Chats deletes every message, photo and file from this device. Other people’s devices aren’t affected, and Vault is kept.
Every chat, for everyone: Clear All Chats for Everyone empties every chat on your devices and deletes every message you sent, for everyone in each chat and group. What others sent stays on their phones, chats you already deleted aren’t included, and Vault is kept. Messages you scheduled don’t go out. Someone offline gets the deletion when they’re back, within 30 days.
Both ask for your password first.
On their own: disappearing messages delete themselves after 1 minute, 5 minutes, 1 hour, 8 hours, 1 day, 1 week or 4 weeks. Set a timer for one chat, or for every new chat in Settings › Privacy › Default Timer; in a group, only the people allowed can change it. A photo sent as View once opens only once.
Good to know: deleting for everyone relies on the other phones. A copy someone saved to their Vault or forwarded stays with them, and so does anything a modified app chose to keep. Someone who blocked you keeps what you sent them.
Technical notes
Delete for Everyone
a sealed request to every device in the chat, which removes the message and its photo or file, and leaves no line in its place; our servers see one more envelope
Clear All Chats for Everyone
the same request for each chat and group, waiting for devices that are offline until they fetch it, 30 days at most
Disappearing messages
each device deletes the message, its files and thumbnails, its quotes and its search entries when the timer ends; they’re never backed up, exported or sent to a new device
Password
checked by our server before either clear; waits after wrong tries run on the server’s clock
Vault is your own chat, for notes, photos and files you keep for yourself, and copies of other people’s messages. Only you can read it, not even Murmur. It lives on your own devices, not in a cloud.
It sits at the very top of Settings, and in Chats like any other chat.
To keep a message, hold it and tap Save to Vault, or forward it with Vault ticked. The copy stays even if the person deletes the original, and it keeps “Forwarded from” with their name, so you know where it came from.
Only you: no checks, no typing, no last seen, no notifications or sounds, no timers. Clear Vault empties it, and Clear All Chats leaves it alone.
With more than one device, Vault passes sealed through our servers to reach the others, and is deleted there once they have it.
Good to know: if you lose your devices or sign out of them all, Vault is gone with them.
Give each chat its own background and bubble colors, and the whole app a color of your own. Our servers learn nothing from it. In a one-on-one chat, Same Background shows the same one on both phones, until either of you turns it off.
Chat Background: in a chat’s info, tap Chat Background. Choose one of 27 photos, 10 wallpapers, 33 patterns on seven base colors or 9 gradients, or one of your own photos, blurred if you like. Default shows the App Background.
Match Colors, on by default, lets the background set the bubbles. Turn it off to choose one of 10 bubble colors yourself, from Wax to Rose.
Try, then Save: a tap changes only the preview at the top. Save, at the top right, applies it; going back without saving keeps what you had.
Same Background, in a one-on-one chat, is on by default, so the background you save goes to the other person too, and theirs comes to you. Either of you can turn it off, and your choice then stays on your devices. In groups and in Vault, only you see your background.
Settings › Appearance has Light, Dark or Automatic, then App Background, with Default, Color or Glow, in the 10 bubble colors, behind Chats, Contacts, Settings and every chat without its own background, tried and saved the same way. With Color or Glow, menus, buttons, rows and the tab bar take that color too. Then Chat Text Size and, on iPhone, App Icon, with Murmur, or the discreet Weather and Timer, each in Automatic, Light or Dark. The name under the icon stays Murmur.
Private: your choices follow your own devices, sealed so only they can open them. Your Photo leaves your device only for the other person, with Same Background on, sealed like any photo. The other pictures are the same for everyone, so fetching one says only that some phone chose it.
Use Murmur on up to 5 devices with one account, all equal. A phone and a computer, or only a computer, since no phone is needed. Each device has its own keys.
To add one, open Murmur on the new device and type your password. Then, on a device you already have, go to Settings › Devices › Link a Device, scan the QR code and compare the short code on both screens.
Your text history and the last 30 days of photos and files come along, end-to-end encrypted.
Every new device alerts all your others, and you can remove it in one tap. Settings › Devices lists each one, with when it was last active.
A device that stays offline for 90 days is removed, after a notice at day 75. Your last device never is.
Technical notes
Limit
5 active devices per account; an account can live only on a computer
Removing a device
a new signed device list, removal from every conversation, new account-state and profile keys; the server deletes that device’s keys and notification token; messages waiting for it can’t be linked to it and expire within 30 days
A new device can chat right away, but for its first 72 hours it can’t do anything you can’t undo. If a thief got in, that gives you time to notice and remove it. And if anyone asks you to approve a device for them, it’s a scam.
During those 72 hours, the new device can’t link or approve other devices, remove your established ones, change your password, replace your Recovery Key, loosen your settings, export your history or download backups.
Linking always starts in the app, and asks for your password on the new device, even with a QR code. Attackers have tricked people on other messengers into scanning fake linking QR codes; asking for the password blocks that trick.
No camera? You can approve the new device from one you have, by comparing 7 emoji. That device stays restricted until its 72 hours are over, and a banner reminds you, “Remove it before it receives your history.”
When someone asks you to approve a device, the app tells you straight, “If someone asked you to approve this, it’s a scam.”
Technical notes
QR code
holds a commitment, not a key; valid for 10 minutes
Short code
7 emoji, or 12 digits in 3 groups of 4, the same on both screens
Approval without a camera
commit-then-reveal with 7 emoji; at most 5 requests an hour; 3 refusals in 24 hours pause requests for 24 hours
No probation for
the device that created the account, and a recovery with the Recovery Key plus the current password
Your messages are stored encrypted on your devices, and App Lock can ask for a PIN or Face ID to open Murmur. Photos lose their location before they’re sent, and files never open on their own.
What it protects: a device that’s lost or stolen while it’s off.
App Lock (Settings › Privacy) asks for a 6-digit PIN, or Face ID, to open Murmur, even when your phone is unlocked. It locks as soon as you leave, or after 1 minute up to 1 hour, as you choose, and after 5 wrong PINs it makes you wait.
Photos are re-encoded on your device, with location and camera details removed. Animated images are sent as a still picture. A picture you send with File goes as it is, like any document.
Documents of any type except audio and video files. They never open on their own, and on a computer they’re marked as downloaded from the internet.
Screen Shield hides Murmur when you switch away from it. On Windows it’s on from the start and keeps your chats out of Recall. On Android it always guards the Recovery Key and password screens. On Mac and iPhone it’s best effort. Incognito Keyboard asks your keyboard not to learn what you type.
Notifications show the sender’s name only, by default. What travels through Apple or Google is sealed, so only your device can open it.
What it can’t stop: a device that’s unlocked or infected with spyware, and copies your phone’s system keeps, like notification history. For the other person’s phone, Screenshot Protection, in Settings › Privacy, turns screenshots of your direct chats black.
What you can do: turn on App Lock, keep your system up to date, and use disappearing messages for chats that shouldn’t linger.
Technical notes
Database
SQLCipher with a random 256-bit key, never derived from your password, wrapped by the system keystore (Keychain, Android Keystore or StrongBox, Windows DPAPI with TPM)
Writes
messages and group state in a single transaction; disappearing messages also purge the search index
App Lock
a second key wrap tied to a hardware key that needs your unlock; a 6-digit PIN, with a blocklist; a 30-second wait after 5 wrong PINs
Images
decoded only by memory-safe Rust decoders with size, pixel and time limits, fuzz-tested; in a separate process on Android and computers, not on iPhone
Files
audio and video files refused when sending (a voice message is recorded in Murmur); on computers, files carry the system’s mark for files downloaded from the internet
Limits
the encrypted database protects against offline theft, not against malware running in your own session; a short PIN doesn’t stop forensic tools on a phone that was unlocked since it last started
One place in the app answers one question, “Am I well protected?” It shows what’s done, suggests what’s next, and never gives you a score.
No score and no percentage, only “You’re protected”, or how many recommendations are left.
What’s left shows in amber, never in red, and until it’s done, Settings shows a row like “Two ways to stay safer”.
It runs on your device. Opening it sends nothing to our servers.
The checklist: save your recovery key, use a stronger password, turn on App Lock, hide notification content, review your devices, verify your contacts, compare security codes that changed, and choose a default timer for disappearing messages. Below it are Encryption Details, a log of recent security events, a check of the version you’re running, and Lockdown Mode.
Lockdown Mode
Stricter settings in one switch, at the bottom of the Security Center. When it’s on:
Notifications never show names or messages.
Nobody can find you by username.
Only people you’ve added can message you. Other requests are filtered.
Nobody sees when you’re online.
Link previews are off.
Murmur hides itself when you switch away (Screen Shield).
Your keyboard is asked not to learn what you type.
App Lock, once you turn it on, locks as soon as you leave.
It can’t protect a phone that’s already compromised. And you don’t need it to hide who you talk to, because in every mode, our servers don’t know who sends a message or who is in a group (see What Murmur can see).
Nobody joins your group unless a member lets them in, and every member’s app checks it. When someone who isn’t your contact adds you to a group, it arrives as a request. Admins decide who gets in.
Starting one: Contacts › New Group, with a name of 3 to 20 characters and a photo, a ready-made picture, or a few letters on a color. Its name, photo and description are sealed for its members.
Ways in: a join request with questions, a personal invite, or a link. Invite with a Link lets you choose when it expires and how many people can join with it, shows who joined with it, and lets you reset it or turn it off. The app warns you before you share one, “Anyone with this link can join and read new messages.”
Approve New Members, on that same screen, is off by default. Turn it on and the link only lets people ask to join. Whoever made the link approves or declines each request, on any of their devices. Our servers don’t know the group, so they learn nothing new.
By default, only the owner and admins can add members or create invite links. Groups above 200 members ask for approval by default.
A community pass helps the people of your community create a Murmur account, but it never lets anyone into your group. Passes often end up in public, so letting people in stays your team’s call, whether by hand or with one of your devices set to let in only personal invites or names on your list.
Everyone in a group can see who else is in it.
History for new members is optional. Each older message keeps its original signature, so newcomers can tell who really wrote it.
Polls are counted by each member’s app, never by us. Votes are visible to the group.
Good to know: group rules run inside the apps. Every member’s app checks each group change against its own copy of the group’s sealed rules, and the owner’s word holds; our server only puts changes in order and can’t see roles. A modified app can ignore the rules on its own side, but the other members’ apps still check every group change.
Technical notes
Validation
the server puts every group change in order and each member’s app checks it; a member can’t veto their own removal
Budgets
each member can make only so many group changes in a given time
Consent
adding an account needs a consent token signed by one of its devices
Joins by link
allowed only in defined cases, with a proof that members verify
Split views
If the server shows different versions of a group to different members, this is detected unless it cuts the group off completely; checks through your other conversations make that harder to hide.
Inactivity
devices silent for 90 days leave groups (notice at day 75) and can rejoin on their own for 12 months, unless banned
Admins get real moderation tools, and none of them need our servers to read a word. Murmur doesn’t scan your private messages, on our servers or on your device.
Admins are members, so they read the group like everyone else. What’s missing is a server or a bot reading everything.
Roles: an owner, admins with the rights the owner gives them, and members. When the owner leaves, the admin who became admin first becomes the owner or, with no admin, the member who joined first.
What members can do is set in Group Info › Permissions. Admins can always send messages, photos, files and voice messages, and edit todo lists. Everyone can check items off a list.
What members can do in a new group
Permission
In a new group
Send Messages
On
Send Photos and Files
On
Add Members
Off
Pin Messages
Off
Edit Todo Lists
On
Change Group Info
Off
Create Invite Links
Off
Set Disappearing Messages
Off
Admin Rights are given one by one, with Change Group Info, Add Members, Create Invite Links, Pin Messages, Delete Others’ Messages, Manage Permissions and Add Admins. Exceptions let one member do more, or less, than everyone else. Slow Mode lets members send one message every so often; admins aren’t limited.
And more: join requests with questions · limits for newcomers · remove, ban or restrict · flood limits · an under-attack mode · reports to admins · rules members accept before joining · an admin log · light auto-moderation and statistics that run on the admin’s own device.
Your device signs your messages, so the people who receive them can prove they came from you. That makes abuse reports trustworthy.
Reports in a group go to its admins, to Murmur’s safety team, or both. Our team sees only the messages you choose to send.
Protecting children is not optional. We have a written procedure, we make reports as the law requires, and a safety team is on duty every day of the week.
Technical notes
Enforced by every member’s app
roles, permissions and exceptions, slow mode, bans, join approval and per-topic permissions, checked against each app’s own copy of the group’s sealed rules; the owner’s word holds
Enforced by the server
the order of group changes, and limits on how many it accepts; it never sees roles
On the admin’s device
light auto-moderation
Reports
encrypted, carrying the original signatures, so moderators can check who sent a message without breaking encryption
Murmur can’t read your messages, photos or files, and our servers don’t know who sends them or who is in your chats and groups. To deliver them, they see only a few details, like when a sealed message arrives. Here is the short list; the full table follows.
Murmur can’t see
Sealed on your devices
Your messages, voice messages and todo lists
Photos and files, their names and types
Who sends each message
Who you talk to
Who is in your groups, and their roles
Your profile
Group names, photos and topics
Your contacts, and who you block
Most of your settings, and your backgrounds
Your “online” and “last seen” status
Your Vault
Your password
Poll results
Your IP addressNever kept or tied to you
Murmur can see
Details our servers handle
That your account and devices existYour username, as a keyed hash
Sealed messages for anonymous mailboxesWhen they arrive, and a padded size
Sealed filesA padded size, not linked to any sender
Scheduled messages, until their timeSealed, never who scheduled them
That a device is connectedAbout 90 seconds, in memory
Notification tokensApple or Google can link them to you
The address of a link you previewNot tied to you, not stored
A username, when someone searches for it
Messages you choose to report
Private, not anonymous. Murmur hides what you say, and who you say it to, even from our own servers. Your account, your devices and their notification tokens are still known to us, as listed here.
Everything our servers can see or keep, row by row, with how long it’s kept. This table is checked against the code at every release, and a stored field that isn’t listed here fails the build.
We hold no message content and no keys. We hold the metadata in this table, and it can be compelled.
“Compelled” means a valid legal order, from a court for example, can force us to hand it over.
Show
Showing 39 rows
What Murmur can see, in 39 rows, one per kind of data
#
What
Can our servers see it?
How long it’s kept
Going further
1
Your messages, voice messages, photos and files, their names and types, reactions, edits, read receipts, poll votes and todo lists
No
Encrypted, until each device has fetched it (30 days at most). In large groups (over 256 devices), until its 30 days are up, even after delivery. An encrypted copy can sit in server backups for up to 14 days.
Already sealed.
2
A group’s name, photo, description, pins and topics
No (sealed with the group’s key)
Stored encrypted
Already sealed.
3
Profiles, contacts, blocks and other settings, chat backgrounds included
No
Stored encrypted
Already sealed. The few settings our servers apply are row 25.
4
Your account ID and @username (the name you chose, a dot and two digits), with a second keyed hash that spots look-alike names
Yes. Your username is stored as a keyed hash; it appears in clear only for a moment, at sign-in and when someone looks it up.
Until you delete your account, then 90 days of quarantine, unlinked from you
Being findable by username is on by default. You can turn it off in Settings › Privacy.
5
Your identity key, device certificates and device list, so the number of your devices and their platform types, with the earlier signed versions of the list and of your identity key
Yes
Until you delete your account
Compare security codes to check these keys yourself.
6
Who is in which chat or group, including who has a one-on-one chat with whom
No. The member list is sealed for the members, and messages go to anonymous mailboxes our servers can’t link to accounts.
Stored encrypted
Already sealed.
7
Roles, bans and group modes (join requests, slow mode, announcements)
No (sealed for the group’s members)
Stored encrypted, in the group’s state
Already sealed.
8
Who added or removed whom, and when; whether an add was accepted
No (group changes are sealed for the group’s members)
Stored encrypted
Already sealed.
9
Who sends a message
No. The sender’s name travels only inside the sealed envelope.
Never known, so never kept
Already sealed.
10
Sealed messages arriving for an anonymous mailbox: when they arrive, a rounded size, the version of the chat’s keys, whether to wake a device, and whether it’s a direct chat or a group
Yes
Queued until delivered (30 days at most); in large groups, until their 30 days are up
Padding, and batched notifications.
11
Username lookups, and the username you’re choosing
Yes, for a moment
Rate counters only. The number shown at sign-up: 10 minutes in memory (30 at most), with a scrambled form of the name
You can connect through a VPN or Tor.
12
Your IP address
Not kept. It only carries your connection, and it’s never tied to your account.
Never stored or logged. To slow down abuse, a hash of it is counted in memory, 1 hour at most.
You can connect through a VPN or Tor.
13
Presence (an open connection)
Yes
About 90 seconds, in memory
Last Seen & Online travels sealed between devices; our servers neither keep it nor count it. The daily sign behind “last seen recently” carries only the day, and our servers hold it a random 1 to 12 hours before delivery (see Last Seen & Online).
14
Push notification tokens, wake-up times, each device’s Direct Chats and Groups choices, and whether its notifications carry the sealed message
Yes, only on the notification relay, under a random ID. Apple or Google can link a token to your Apple or Google account, and authorities can ask them.
Deleted after 30 days without device activity
What a notification carries is sealed. In the Android app from murmur.free, UnifiedPush is an option.
15
Sealed files, voice messages included: rounded size and upload time; which files are pinned
Yes, not linked to any sender, nor to any chat, except that a pinned file is tied to its group (never to its members) to count the group’s quota
30 days; pinned files while they’re pinned, within the group’s quota
Downloads by capability; files re-encrypted on every forward. Voice messages are padded in steps that double, so only a rough length shows. Files sent between your own devices for Vault are deleted once they have them.
16
Invite link use; sizes and update times of encrypted records
Yes
As long as they exist
Padding.
17
The address of a link you send, to make its preview
Yes, through a relay that keeps no log, not tied to your account, never the part after a #
Not stored
Link Previews are on by default. You can turn them off in Settings › Privacy.
18
Groups with a community plan
Yes
While subscribed
None.
19
A “supporter” flag on accounts that bought an optional supporter item
Yes, without your payment identity
As long as the benefit lasts
None.
20
Totals: protocol health, accounts and devices (in all and active), messages, photos and files passing through and their volume, notifications, link previews, username lookups, sign-ups, deleted accounts, how many new accounts stay, reports, recoveries, blocked attempts, speed and errors
Totals only, never tied to anyone
13 months. Devices connected right now and by notification service: not kept
What the person reporting chooses to send (text and signatures), with the report’s category and status, and a keyed hash of the reporting account
90 days after the case is closed; at least 1 year after a decision on an account; 1 year when a mandatory report is made; longer only under a legal hold
Minimal by default.
22
Account data: the day it was created (only the month after 12 months), trust level and restrictions, failed sign-in and daily counters, the number of upheld reports, the version of the terms you accepted, the “16 or older” declaration, pending timers
Yes
With the account; counters 30 days at most; upheld reports 180 days; a reset, until 30 days after it ends (see the Privacy Policy)
None.
23
Each device: the public keys that let people start a chat with you, whether its sign-in key is in secure hardware, a random notification ID, the day it was added, its last active day, when its first 72 hours end and the app version it last connected with. Once a device leaves, a note of its ID, its account, why it left and the day
Yes
Until the device is removed; its last active day is replaced each time. A device offline for 90 days is removed, never your last one. The note that a device left: 180 days at most
You can remove a device at any time.
24
Your Recovery Key data: your identity key and account-state key, with the 2 previous versions
No. It’s sealed so only your Recovery Key opens it. We see only the public half of a sign-in key made from it.
Until you delete your account; any change alerts all your devices
Nothing reaches us until you save your key.
25
Choices our servers apply: whether you’re findable, who can send you a request, Lockdown Mode, whether a password-only fresh start is allowed, whether password sign-in is on, whether you saved a Recovery Key, and your inactivity delay
Yes
Until you change them or delete your account
Being findable is on by default. You can turn it off.
26
A block counter
Yes, a single number that changes when you block someone, never a list of who you blocked
Sign-in and linking sessions: a sign-in in progress, a puzzle your device is solving, and the box that hands your keys to a new device you link
Yes, for a few minutes. The box is sealed for your new device.
In memory. A sign-in 1 minute, a puzzle 5 minutes, a linking box 10 minutes
None.
28
Your encrypted text backup, if you turn one on: your messages, reactions, edits and pins, and any Telegram archives you imported; never photos, files, voice messages, todo lists or disappearing messages
No. Only your Recovery Key opens it. We see only its size and when it changes.
The last 2 copies. Deleted when you delete your account
Off until you turn it on. Anyone who holds your Recovery Key could read it, so keep the key somewhere safe.
29
History sent to a new device or to a group’s new members
No (encrypted)
24 hours at most
Already sealed.
30
Group changes, for a group mailbox: their order numbers, how many the group made today, and whether it has more than 256 devices
Yes, not linked to the group’s members. Each change itself is sealed for the members (row 8).
Changes: 30 days. Today’s count: 1 day. Whether it has more than 256 devices: while the group exists
None.
31
Your contact link’s encrypted card, and community passes: their limits, expiry and number of uses
Yes, never who used a pass
As long as the link or pass exists
You can reset your contact link at any time.
32
Message requests: whether each was answered, and how many messages it holds (3 at most)
Yes, never who sent it
Until answered, 30 days at most
A stranger can send only 3 messages until you reply.
33
Muted chats, when your device can’t skip notifications on its own, or by your choice in a very large group
Yes, for that chat’s mailbox, which our servers can’t link to you
Until you unmute it. When you delete your account, your device clears it; otherwise, until the mailbox is no longer used
Muting stays on your device whenever it can.
34
Sign-up tokens, on the separate service that issues them
Yes, never linked to an account, meaning used tokens, a scrambled form of each device’s check key, and a count
Used tokens: until its keys change, every month. Counts: 30 days
The result of the device check is never stored.
35
What our staff did on an account
Yes, in a log no one can rewrite
2 years, longer only under a legal hold. After you delete your account, no longer linked to it
Legal and bulk actions need two people.
36
Support and diagnostics you choose to send: messages to our official account, emails (with your address), crash and debug reports
What you choose to send
Until the problem is fixed, or as long as we need it to answer you
Crash reports are sent only if you agree, with a preview of what leaves your device.
37
Community and panel reports
Totals only, that a group’s admins or panel members choose to share
13 months
Only from people who agree.
38
Server logs and outage traces
Yes, a closed list of fields, never account, device or group IDs, IP addresses or tokens
Logs: 7 days. Outage traces, only during an outage: 72 hours
No access logs.
39
Scheduled messages: sealed envelopes waiting until their time, for which devices, with a rounded size and whether to wake a device
Yes, never what they say, which chat they’re for or who scheduled them
Until their time (1 year at most), then 30 days after they go out or are cancelled
Phone number, email, real name, date of birth, device models, location, your address book, a log of who sent what, who talks to whom, who invited whom to join Murmur, device check verdicts, payment identity. Who is in a group, and who added whom, is sealed for the group’s members (rows 6 to 8). We don’t store IP addresses or access logs either (row 12).
What travels through Apple or Google is sealed, so only your device can open it. But notifications let Apple or Google link your device to your Apple or Google account. You choose what shows on your screen.
Authorities can ask Apple or Google for that link.
Under a random ID, our notification relay knows only a token, when to wake your device, whether direct chats and groups notify it, and whether its notifications carry the sealed message. Tokens are deleted after 30 days without device activity.
Each message tells our server two things about notifications. One is whether to wake your device, and the other is whether it’s a direct chat or a group, so your Direct Chats and Groups choices apply.
What shows on your screen is up to you, in Settings › Notifications › Previews, between Name and Message, Name Only (the default), or No Name or Content. You also choose whether direct chats and groups notify you, and whether Murmur plays its soft sounds and shows banners while it’s open.
Lockdown Mode makes sure notifications never show names or messages.
When a message disappears, Murmur removes its notification too, but your phone’s system may keep a copy.
In the Android app from murmur.free, UnifiedPush is an option.
Our servers keep no IP address, no IP logs, and nothing that ties an address to your account (see our data table). To slow down abuse, a hash of it is counted in memory for an hour at most.
Your network can still see that you use Murmur, when, and roughly how much data you send. Murmur doesn’t hide that, but you can connect through a VPN or Tor, and people who do are welcome, because the counters only ask your device for a little extra work and never block you.
Link previews are fetched by our relay, which keeps no log, so the sites you link to never see your IP address, and what you preview isn’t tied to your account.
Technical notes
Counters
hashed per address (IPv4 /32, IPv6 /64), in memory, 1 hour at most, never logged
Server logs
a closed list of fields, never account, device or group IDs, IP addresses or tokens; kept 7 days on our own machines; no access logs
We count totals, not people. No trackers, no analytics kits, and no activity log per person.
How: totals only, never tied to anyone, and we never use them to single anyone out. Our server counts them as it does its work.
Crashes: crash reports only if you agree, with a preview of exactly what leaves your device.
Technical notes
Active accounts
today’s are counted in memory with a salt destroyed every day; over a week or a month, from the last day each device was active; only totals are kept
Totals we keep
protocol health counters; accounts and devices, in all and active; messages, encrypted packets, photos and files passing through each day, and their volume; notifications sent and failed; link previews; username lookups; sign-ups by kind of check, and sign-up invitations; deleted accounts; new accounts still active after 4 weeks and 30 days; reports received, and spam reports per 1,000 new accounts; how recoveries go; attempts blocked by our limits; how many people use several devices, a computer or a text backup; speed and errors; never tied to anyone, kept 13 months
Counted on the spot
devices connected right now; devices by notification service (Apple, Google, another service or none), read from what the server already holds to send notifications; nothing new is kept
Server logs
a closed list of fields, never account, device or group IDs, IP addresses or tokens; kept 7 days on our own machines; no access logs
Outage traces
how a request moved through our servers, for a small sample (0.1 to 1%), only while we handle an outage; the same closed list of fields as the logs; kept 72 hours
Panels and admin reports
totals that a group’s admins, or people who join our research panel, choose to share; kept 13 months
Guardrail
the build fails if the server stores a field that isn’t in the data inventory
Never
third-party analytics or crash kits, device fingerprints, per-group activity rows; typing and Last Seen & Online signals are left out of every count
If someone took over our servers, or forced us to cooperate, they would still hold no key to your messages. To read anything, they would have to cheat in ways you can catch, like swapping keys. Here is everything they could still try, and how you’d notice. We publish this list as it is.
1
Swap keys when someone first contacts you by username search.
How you’d noticeComparing security codes reveals it. Links and QR codes carry a fingerprint the app checks, so they’re not affected.
2
Forge a reset or a fake device list.
How you’d noticeYour contacts’ apps show a clear warning and wait 7 days on their own; one “Not me” from your old identity cancels it for good. The server could also show different records to different people.
3
Remove people or stop delivering messages.
How you’d noticeEach app checks removals for inactivity against its own view, so pushing out an active member shows.
4
Cut a group off from everyone else.
How you’d noticeIf the server shows different versions of a group to different members, this is detected unless it cuts the group off completely; checks through your other conversations make that harder to hide.
5
Start logging metadata from now on, for example under a legal order.
How you’d noticeYou might not. That’s why we publish what the server can see, and why we hold no content and no keys.
What it still can’t do:
Open messages sealed for your devices.
Let someone join your group without a member’s signature.
The code that seals your messages, meaning the encryption, the protocol and the server, is published. Anyone can read it and check how your messages are protected. It’s at murmur.free/source.
What’s published is Murmur’s engine, the code that decides what can be read and by whom:
The encryption that seals and opens your messages on your devices.
The protocol, the format of everything your devices send.
The server, so anyone can check what it keeps and what it can’t see.
The rest of the app, its screens, isn’t published. The engine comes with its specifications and test vectors, under open-source licenses.
The Murmur name and logo aren’t part of the licenses, so a copy has to change its name.
Contributions are welcome. Contributors sign a contributor agreement. They keep their copyright, and what they give stays open source.
Published code lets anyone read the engine and rebuild it. Each release lists the fingerprint of the engine it carries, so experts can check that the app runs the published code. See Checking your download.
Independent security firms reviewed Murmur’s design, audited its code and tried to break in. Every report is published.
A design review asks experts whether the plan holds. An audit asks whether the code really does what the plan says. Murmur went through both, with two design reviews and two audits.
We use standards, not inventions, and people are accountable for every line. AI tools may draft code, but people write the protocol and the tests that judge it, and a cryptographer approves every sensitive change.
Real encryption from the first line of code, so there has never been an unencrypted path.
Standards only, with MLS for messages, OPAQUE for sign-in and an encrypted database on your devices. No home-made cryptography.
The rules that hold groups together are checked by a formal model, and by simulations where our own server misbehaves on purpose. Every decoder is fuzz-tested.
Dependencies are pinned and reviewed, and advertising, analytics and third-party crash kits are blocked from the apps.
Found a security problem? Write to security@murmur.free. Please don’t send real people’s data in a report.
We follow a published disclosure policy, with coordinated disclosure within 90 days. You can encrypt your report with our public key, also listed in our security.txt file.
Murmur comes only from murmur.free, the App Store and Google Play. Anything else is not us. Murmur will never ask for your password or Recovery Key on a website or in a message.
Where each version of Murmur comes from
Platform
Where
iPhone
App Store
Android
Google Play, or a direct download from murmur.free
Windows
murmur.free
Mac
murmur.free
We use one web address for downloads and links, and we watch for lookalike addresses.
Updates: Murmur updates itself, and your chats stay as they are. To see your version and what each update brought, go to Settings › About Murmur › Updates.
Every update of the desktop apps downloaded from our site carries signatures from 2 of our 3 release keys, held by 3 different people. For some versions, you can also check that you got the same build as everyone else. App store versions can’t be checked this way.
A version made for one person would be detectable for desktop builds downloaded from our website and for the direct-download Android app. Not for iPhone or Google Play builds.
Why not everywhere: app stores sign and deliver those builds themselves, so we can’t prove what they ship. The app says so too, in its Security Center.
Two protections: the 2-of-3 signatures mean one stolen key isn’t enough to push an update, and the public log means a version made for one person would show.
The engine inside: each release lists the fingerprint of the engine it carries, the published code that seals your messages. Experts can rebuild the engine from that code and check that it matches. The stores’ own builds still can’t be rebuilt independently.
No remote code: we can’t change the app’s code remotely. The few settings we can switch from our side can only make the apps more careful, never weaken encryption.
What you can check, version by version
Version
What you can check
Windows
Updates signed by 2 of our 3 keys, a public log and the engine’s fingerprint
Mac
Updates signed by 2 of our 3 keys, a public log and the engine’s fingerprint
Android, direct download
Signed with our own key, fingerprints published, a public log and the engine’s fingerprint
Google Play
The store signs these builds, so they can’t be checked this way
iPhone
The App Store signs these builds; we publish the engine and its fingerprint
How to check
1
Download from murmur.free.
The Windows or Mac app, or the Android app as a direct download. App store builds can’t be checked this way.
2
Compare its fingerprint.
Every version from our site is listed on murmur.free/verify, with its fingerprint and its entry in the public log. The fingerprint of your download should match.
3
Check it in the app.
In Settings › Security Center, “Verify this version” shows how your version is signed and its entry in the public log.
Technical notes
Updates
the desktop updater requires a manifest signed by 2 of 3 Ed25519 keys, held by 3 people in 3 places; it refuses rollbacks and expired manifests
Public log
apps refuse a build whose hash has no proof of inclusion in an append-only public log
The engine
the published engine can be rebuilt from its code; each release lists the fingerprint of the engine it carries, so experts can check that the app runs the published code
This site is plain files, hosted by Cloudflare. No cookies, so no cookie banner. No analytics, and no fonts, images or scripts from anywhere else.
The numbers below are counted by this page as you read it.
0Outside requests
0Cookies
0Things stored in this browserOnly your theme, if you changed it
Turn on JavaScript to see the live count. The page loads nothing from other sites either way.
Hosting: this website is hosted by Cloudflare. To send you a page, Cloudflare receives your IP address and the page you ask for, and uses them only to deliver the page and protect the site from attacks. We use no analytics, no cookies and no trackers, so no visitor is tracked. The Murmur app never goes through Cloudflare, and talks only to our own servers.
A valid legal order can force us to hand over what we hold about an account. What we hold is minimal, and nothing in it says who a person is, or who they talk to. We hold no message content and no keys, so those can’t be handed over.
Could be handed over
Username
The day the account was created (only the month, after a year)
The last day it was active
Its devices and their platform types
Notification tokens, which Apple or Google can link to an account
Abuse reports and anything preserved with them
Not held
Message content, photos and files
Keys and passwords
A name, a phone number or an email
Contacts and blocks
Who you talk to, and who is in your groups
Your Last Seen & Online status
IP addresses
Notification tokens are the one exception, because Apple or Google, not us, can tie one to an account of theirs. The full list, and how we answer requests, is in our law enforcement guidelines.
Twice a year, we publish a transparency report, with requests received and data handed over, by country and type.
There’s no spare copy of your keys on our side and no hook to scan content. Both are on our never list.
Where a server sits doesn’t change what it can reveal. Ours, and their encrypted backups, hold no message content and no keys, and everything else they see is listed in the full table.
What protects you is the design, not a place. We hold no message content and no keys, we keep no IP addresses, our servers don’t know who writes to whom, and we publish the rest. A legal order, wherever it comes from, can only reach what’s in the full table.
Every messenger makes trade-offs. Here are ours, compared with the best-known encrypted messengers, showing where Murmur is stronger, and where it’s weaker.
Stronger
No phone number on any platform, iPhone included.
Our servers don’t know who sends a message or who is in a group, without ever asking for your number.
Accounts that can live only on a computer.
Moderation tools that never need the content.
Group joins checked by members, and adds that need your consent.
The code that seals your messages is public, server included.
Weaker
Your device signs your messages, so the people who receive them can prove they came from you. You can’t deny having written them.
A first contact found by username relies on our server’s answer, unless you compare security codes. Links and QR codes are checked.
Encryption protects your messages on the way and on our servers. It can’t protect a device that’s infected or unlocked by someone else, or stop the person you write to from sharing what you said.
A device that’s infected, or unlocked by someone else.
The person you write to, who can save, copy or forward what you said.
The fact that your connection talks to our servers. Murmur doesn’t hide that from your network, but you can connect through a VPN or Tor.
Traces your phone’s system keeps, like notification history, keyboard memory or built-in AI features.
An account whose password and Recovery Key are both lost.
If your safety is at stake.
Murmur hides what you say, and who you say it to, even from our servers. The weak spot is usually the device, so keep it locked, and see What stays on your device.
A phone or computer signed in to your account. You can have up to 5. Up to five devices
Disappearing messages
Messages that delete themselves after a time you choose, from 1 minute to 4 weeks. Deleting messages and chats
End-to-end encryption
Messages are locked on the sender’s device and unlocked only on the devices in the conversation. Murmur’s servers can’t read them. End-to-end encryption
Epoch
A version of a group’s keys. It changes, with new keys, every time someone joins or leaves. How Murmur encrypts, in detail
A long secret number that locks or unlocks messages. Your keys live on your devices. End-to-end encryption
Last Seen & Online
What the people you chat with see under your name, “online” or when you were last seen. You choose who sees it; with Nobody, your contacts see only an approximate time. Last Seen & Online
Lockdown Mode
Stricter settings in one switch, so nobody can find you by username or see when you’re online, only people you’ve added can message you, and notifications never show names or messages. The Security Center
Message request
A request or a first message from someone you haven’t added, with a note if they wrote one. It waits in Message Requests until you accept it, and they can’t tell you’ve seen it. How people find you
Messaging Layer Security, an open standard from the IETF (RFC 9420) for encrypting group chats. Murmur uses it for every chat. How Murmur encrypts, in detail
OPAQUE
A way to sign in with a password that never leaves your device (RFC 9807). Your password
Open source
Code anyone can read, check and rebuild. Murmur’s engine, the code that seals your messages, is published, server included. Open source
A new device’s first 72 hours, when it can chat but can’t do anything you can’t undo. Adding a new device
Recovery Key
The spare key to your account, 48 characters in 12 groups of 4 that you save from the Security Center. Your Recovery Key
Reproducible build
Rebuilding published code and getting exactly the same file. Experts can rebuild Murmur’s engine and check it against the fingerprint each release lists. Checking your download
The place in the app that answers “Am I well protected?” The Security Center
Security code
A code of 60 digits, or a QR code, on the Security Code screen, that you compare with a contact to make sure nobody is in between. Making sure it’s really them
TLS
The standard encryption for connections on the internet. Murmur uses it around everything, as an extra layer. How Murmur encrypts, in detail
Transparency report
A report we publish twice a year on legal requests received and data handed over. What the law can require
Vault
Your own chat, for notes, photos and files you keep and messages you save. Only you can read it. Vault
Verified
What you mark on the Security Code screen once the code matches. When you’ve both marked it, the lock in your chat turns green. Making sure it’s really them