Messages only the people in the conversation can read.
encrypted on your device
the server only relays noise
Ember is a messenger for web and Android where encryption happens on your device, not on a server. Nobody else, including us, can read what you send.
The server carries your message. It never reads it.
Watch one message make the trip. It's encrypted before it leaves your phone, and it only turns back into words on the phone it was meant for.
Animated illustration: a message is typed on your phone and encrypted there. The Ember server receives only ciphertext it cannot decrypt, then passes it on to the recipient's phone, where it is decrypted back into the original text.
A full messenger, not a demo.
Chats, groups, media, calls and voice rooms are all built and in testing. Message content, media and call setup are encrypted on your device. The server passes it along but can't read it.
-
[01]ready
Chats that do what you expect.
One-to-one and group conversations, encrypted on your device before they're sent. Swipe to reply, edit what you wrote, react, and delete a message for yourself or for everyone. Read receipts show who has seen it.
- replies
- edits
- reactions
- delete-for-everyone
- read-receipts
- search-on-device
-
[02]ready
Photos, videos and voice messages.
Media is compressed and encrypted on your phone before it uploads, in direct chats and in groups. The server only stores files it can't open.
- photos
- video
- voice-messages
-
[03]ready
Voice and video calls.
One-to-one calls go straight between the two devices over WebRTC. The call setup itself is encrypted with your conversation key, so the server can't quietly put itself in the middle. On Android, calls ring like a normal phone call.
- webrtc
- encrypted-signalling
- native-ringing
-
[04]ready
Groups with rooms.
A group can hold several text and voice rooms, each open to everyone or only to chosen members. Every text room has its own key, and a new key is issued when someone loses access. Founders, admins and moderators can kick, ban and manage members. In groups on the new encryption every change to members, roles and rooms is signed by the person who made it and checked by every member's app, so the server can't quietly slip someone in.
- text-and-voice-rooms
- per-room-access
- key-rotation
- roles-and-moderation
- signed-membership
-
[05]ready
Voice rooms you can drop into.
Group voice with up to four cameras on at once. Audio and video are encrypted with SFrame before they reach the media server, and the key changes whenever someone leaves. You can keep talking while you read the text rooms.
- sframe
- up-to-8-people
- cameras
- moderator-controls
-
[06]ready
Keys only you hold.
Your private keys are created on your device. A recovery code that only you hold protects your account key and your encrypted history backup, and it's how you add a new device. There is no PIN any more, and the recovery code is never sent to the server. Compare safety numbers with a contact to be sure nobody is sitting in the middle. Recent messages stay cached on the device, so chats open instantly.
- x3dh
- double-ratchet
- recovery-code
- safety-numbers
-
[07]ready
Make it yours.
Pick a theme (Dark, Light, Violet, Ocean, AMOLED, Forest or Rose) or build your own from six colours, set your accent colour, and use your own chat background, animated if you like. The background is encrypted too. Push notifications on Android group messages by conversation.
- 7-themes
- custom-accent
- chat-backgrounds
- push-notifications
Also in your browser.
Windows, macOS or Linux: open Ember in a browser tab, nothing to install. Same account, same chats and the same end-to-end encryption as on Android.
sign in with your alpha account
- Any desktop. Current Chrome, Edge, Firefox and Safari on Windows, macOS and Linux.
- Install it as an app. Use “Install” in the address bar for its own window and icon.
- The same encryption. Keys are created and kept in your browser. The server still only sees ciphertext.
- Calls and voice rooms work in current browsers.
No one to trust. Just math the server can't undo.
-
step 1/3 · your device
You write a message.
It's encrypted on your device before it ever touches the network.
-
step 2/3 · ember server
Ember relays ciphertext.
The server routes an unreadable blob. It has no way to decrypt it.
-
step 3/3 · their device
Only the recipient can open it.
Decryption happens on their device, using a key only they hold.
Make it yours.
Themes from six colors, animated chat backgrounds, photos and short videos, a look for each chat. Copy a ready-made code, paste it in the app, done.
- Themes. Presets, follow-the-system or a schedule, and your own palette you can share as a code.
- Backgrounds. A color, a photo, a GIF, a short video, or a generated animation. Encrypted on your device.
- Per chat. A different look, a nickname and a folder for any conversation. Only you see it.
What's not there yet.
Ember is still in testing. Here is what it doesn't do today, so nothing surprises you.
- Android and web only. There is no iOS app.
- Older chats are still moving to the new encryption. New chats and groups get a fresh key for every message. A one-to-one chat switches once both people have the current app, and a group switches when an admin upgrades it. Until then it keeps one long-term key per conversation and is marked as not end-to-end verified. Calls and voice rooms already use fresh keys.
- The server still sees some metadata. With the new encryption that is your IP address and connection times, which device belongs to which account, your friends and blocks, who is in a group and their roles, call routing as it happens, voice-room presence, and the size and day of your backup. Older chats reveal more: who writes to whom and when, reactions and read state. Profile pictures aren't end-to-end encrypted. The privacy policy lists it all.
- No typing indicators or online status.
- Search covers only what's on your device, which is the most recent 100 messages per chat.
- Disappearing messages are planned, not built.
- Data may be reset during the alpha.
- In the browser, notifications arrive only while an Ember tab is open. Your keys live in that browser, so don't use Ember on a shared computer, and log out when you're done.
“I've been independently developing Ember for the past year as a privacy-focused Android messenger. My goal is to build a communication app that puts user control and data protection first, while still offering a high level of personalization.”
Be one of the first to try it.
The alpha runs through Google Play's closed testing track. Leave your email and you'll be added as a tester.