Everything people ask us first

A private messaging app that combines real end-to-end encryption with zero-knowledge identity verification on Midnight Network. You can prove control of a registered key without sharing a phone number or government ID. Messages use MLS encryption. Registration does not prove that someone is a unique human or verify their real-world identity.

Midnight Messenger uses a device-generated key and a username for your account, without requiring a phone number, email or crypto wallet. Messages use MLS (RFC 9420); Midnight Network supports proofs of control over your registered identity.

Yes. Chatting is free and stays free, and we pay the network fee when you sign up. Later we plan optional paid extras, such as premium usernames and a supporter badge. Nothing paid exists today. See About for how the service is paid for.

Not yet. Today it is one-to-one chats with text, replies, profile pictures and disappearing messages. Photos and voice notes come next, with location and camera data stripped, the way profile pictures already are. Group chats come after that. MLS, the encryption we use, is built for groups.

English only, for now. Tell Sky in our Discord which language you want first.

No. There is no token, no airdrop, no points, and nothing to buy. Anyone offering one is a scammer. We will never ask you to connect a wallet.

Never. Not support, not Sky, not the team. Anyone who has your 24 words owns your account. We will never ask for a code or your Midnight PIN either. If someone asks, block them and ignore them.

Block, ignore or delete the chat. Keep the contact code on, the default, so strangers cannot message you with only your username. Tell us about scams pretending to be us at support@devbyone.com. Our Abuse and reports page has the full list.

No. Messages are encrypted on your device with MLS (RFC 9420) before they are ever sent. Our relay server only stores and forwards ciphertext. It has no way to decrypt it, and neither do we.

No, and we consider that a firm rule, not a preference. Every cryptographic primitive we use, from message encryption to identity proofs, comes from established, independently maintained libraries. We do not invent our own ciphers.

Very little. Relays hold encrypted messages until they are collected, 7 days at most. The chain holds a public commitment and your public key. Our directory holds a hash of your username, your public keys, and who may add you, with a one-way hash of your contact code, never the code itself. Our alert service keeps your phone's push token so it can say "New message". Your chats, contacts, block list and Midnight PIN stay on your phone. Profile pictures, typing and status go only to the people you chat with, encrypted, and are never stored on our servers. A chat backup, if you make one, is a file you keep wherever you choose, encrypted with your 24 words. We never get a copy. See our Privacy Policy for the full breakdown of what is kept where, and what we deliberately never see.

Only "New message", never who wrote or what they said. Alerts reach iPhones through Apple's push service and Android phones through Google's Firebase Cloud Messaging. Apple or Google learns that your phone got an alert, and when, and nothing about the conversation. Firebase analytics are switched off in the app.

Your message is held on our relay as ciphertext we cannot read, and delivered the next time their device connects. It is deleted from the relay the moment their device collects it. Anything never collected is deleted automatically after 7 days.

We build only on established, widely used cryptographic libraries, never our own. A full third-party security audit is planned before mainnet, targeted for the second half of 2027, and we will publish the results. We'll share the GitHub links after the beta test.

A relay is a server that passes encrypted messages between phones, and holds them for up to 7 days for someone who is offline. We run two of our own, and from build 10 the beta apps send every message through both. Independent operators can run relays too, and the first one is already running. Every approved relay, ours and theirs, is listed with its uptime on our public relay status page. From build 11, Settings lists both relays your app uses.

From build 10, your chats keep going. Every message goes through two of our relays: relay A, a relay we run, and relay B, a relay at a hosting company. Your phone encrypts each message once and sends the same copy to both, and the other phone uses whichever arrives first. If one relay is down, or the network service in front of our servers, messages still get through while the app is open. "New message" alerts, username lookups and adding contacts still need our main servers, so they wait until those are back. Older builds use relay A only.

Only encrypted traffic. A relay cannot read your messages, and it never sees usernames. Like any server that carries traffic, it can see how big each encrypted message is, when it passes, and the internet address it comes from. That is far less than content, but it is not nothing. An operator's relay sees exactly what ours does, and never any content. If you turn on typing or status, a relay can also see that a short update went by, and when, never what it says. See Replies, Pictures and Status below.

Beta testers can. Sign in with your beta code at beta.midnightmessenger.app/window to watch a delayed view of what our relay sees: each message's journey, chat requests left in inboxes, sizes rounded up to 256 bytes, and the last few bytes of the encrypted data. It shows that the relay only passes on encrypted bytes it cannot read. It never shows a room, a key, an address, or whether anyone is online. It runs 30 seconds behind, and it lives in the relay's memory only, never stored. It covers our relay, not relays run by operators. It is part of the beta on the test network, and it goes away before launch.

A relay cannot read a message, but it can see how big the encrypted message is. Without padding, it could tell a quick "ok" from a long paragraph. Padding fixes that. Before a message is encrypted, the app adds filler inside it, so every message comes out at one of a few fixed sizes (256 bytes, 1, 4 or 16 KiB). From outside, "ok" and a few lines look the same. Only the other phone sees the filler, and it takes it out. Read receipts are padded the same way. Padding hides how long a message is. It does not hide when a message was sent, or that one was sent at all. Padding is on in the beta apps.

Yes, since October 5, 2026. The iOS and Android beta apps pad every message and read receipt they send, and older builds that cannot read padding are asked to update.

Yes. In the beta apps a message can be up to 16,382 bytes, about 16,000 letters of English. Emoji and some alphabets take more bytes per letter, so they fit fewer. The limit is there so that every message, once padded, still fits the largest size. If a message is too long, the app tells you and does not send it.

Midnight Network supports zero-knowledge proofs. We use it to verify control of a registered key without exposing its secret. This verifies a messaging identity, not someone’s legal identity or whether they are a unique human.

No. Your device generates a secure identity key automatically the first time you open the app, and registration is fully sponsored, meaning we pay the network fee on your behalf. You never install a wallet or hold cryptocurrency to use Midnight Messenger.

A cryptographic commitment is public, but it is a one-way value that reveals nothing about the secret behind it, and nothing about who you are. Anyone can verify that a registration exists. No one can work backward from it to your identity. You can inspect the identity contract on the Preprod explorer and see exactly what it does and does not record.

No. Network fees for registration are sponsored by us, not paid by you. You do not need to acquire, hold, or spend any cryptocurrency to use the app.

When you register a username, it is hashed on your device before it is ever sent to our servers. We only ever store and see the hash, never the plaintext name you chose. That keeps the directory from being read as a list of every registered name. It does not hide your name from someone who knows or guesses it: they can look you up by exact match, which is how people find you, and a common name is easy to guess. In the beta apps, finding you is not the same as reaching you. By default, a new person also needs your 6-digit contact code to send you a chat request. If you choose "Anyone with my username" in Settings, under "Who can add me", your name alone is enough. Someone who looked you up while that was on keeps what they need to send you a request, even after you change it back.

No. A username belongs to the account that registered it. Once taken, a name is never given to anyone else, and we do not release or reassign names on request: a recycled name would let a stranger inherit someone's contacts.

Usernames under five characters and any all-numeric handle are reserved as premium inventory rather than available on public self-registration, similar to how short domain names or vanity handles work elsewhere.

Not by default. In the beta apps, a username alone does not reach you. A new person also needs your 6-digit contact code. In Settings, under "Who can add me", you can instead let anyone with your username add you, or let nobody new add you. People you already chat with never need the code.

Usernames are easy to guess. With a code, guessing your name is not enough to start a chat with you. The app refuses easy codes like 123456, and guesses at a code are limited.

Tell it to someone to type in, show your QR code, or send your contact link. The QR code and the link carry your username, code and key together, and fill in the add-contact screen for the other person, who still confirms. Their app checks that the directory has the same key for you, and adds nobody if it does not. Share it only with people you want to hear from. You can change the code any time. The old one stops working at once, and chats you already have keep working.

Block and Ignore stay on your phone. The person is not told, and we never learn who you blocked. Ignore drops their chat requests for 7 days. Block drops them until you unblock, and blocking someone you chat with also removes that chat. You can unblock people in Settings.

Yes. Blocking someone, or deleting a chat, also stops alerts from that chat: your phone tells the relay to stop waking it there. The relay is not told why. To it, a block looks the same as a deleted chat.

Check their safety code. Each chat has a "Verify @name" screen with a 60-digit code made from both of your keys. Both phones show the same code. Compare it in person, or on a call where you know their voice. If every digit matches, mark them verified, and a seal shows in the chat.

Yes, in person. Your QR code now carries your key. On the Verify screen, scan their QR code, and if the key matches, they are marked verified. A contact link that was tapped or pasted is checked the same way, but it never marks anyone verified, because it may have been forwarded. A QR code from an older version of the app has no key, so compare the numbers instead.

A username's key never changes, not even when someone restores their account with their 24 words. So if the directory, a link or a chat request ever names a different key for a contact, the chat keeps the key it started with and shows a red warning: someone may be trying to pose as them. Compare the safety code to be sure.

No. Your phone remembers each contact's key after the chat is gone. If the name comes back with a different key, the app refuses it. Only scanning their QR code in person can change the key it remembers.

The safety code is made on your phone and never sent. From build 11, when you mark someone verified, they see a line in the chat: "@yourname verified your safety code". It travels inside the encrypted chat like a message, so our servers never learn who you verified. It does not mark you verified for them: each of you checks the other. To notice a changed key, opening a chat looks the name up in our directory once a day, the same lookup as adding a contact. Our Privacy Policy says exactly what that tells the directory.

From build 11, swipe a message, or long-press it, to reply. Your reply shows a quote of it. Only a reference to that message is sent, never its text again. The other phone finds the message in its own copy of the chat and shows the quote. If it no longer has it, it shows "Original message not available".

No. A quote is never a copy. When the original message disappears, so does the quote.

Yes, from build 11, in Settings, Profile picture. Your phone makes it square and smaller, and strips location, camera and time data from it. It goes only to the people you chat with, encrypted inside each chat, and shows in place of your initials. It is never stored on our servers. If a contact is offline, a relay holds the encrypted pieces for them, up to 7 days, like a message, and does not wake their phone for it. Remove it any time, and your chats are told.

Only if you turn it on. From build 11, typing dots and your status are off by default, each with its own switch in Settings: "Show when I'm typing" and "Share my status". Both work both ways. With one off, you do not send it, and you do not see anyone else's either. Nothing is sent while the app is locked.

You pick online, away or offline. Your contacts see a green, orange or red dot. Offline works as invisible: the app says so once, then sends nothing more. A contact whose app has been closed for a couple of minutes also turns red. Someone who never shared a status shows no dot.

Never what an update says. It can see that a short typing or status update went by, and when. If updates to several chats line up in time, it could guess they belong to one person, so each chat's status runs on its own timer, started at a random moment. Relays never hold typing or status: if the other phone is away, the update is simply lost. That is why both are off unless you choose them. Our Privacy Policy has the details.

In a chat, open the menu and tap "Disappearing messages". Choose 1 minute, 5 minutes, 1 hour, 1 day, 1 week or 4 weeks, or Off. It is off until someone sets it. Either of you can set it, and both of you see a line in the chat when it changes. It applies to messages sent from then on.

Your copy disappears that long after you send it. Their copy disappears that long after they first see it in the open chat, not when it arrives, so nobody loses a message they never saw. A message they have not read stays until they read it. Changing the timer later does not change messages already sent.

The message is gone from both phones: from the chat, from the chat list, and from the history the app saves. Nothing is left in its place. The timer travels inside the encryption, so our relay never sees it.

The other person can still copy the text or take a screenshot before it goes, and a modified app could ignore the timer. The app says so where you set it. Disappearing messages mean less history is kept. They are not a way to take back what you sent.

Yes, in the beta apps, under Settings, App lock. Choose Off, your phone passcode (screen lock on Android), or a Midnight PIN: 6 digits that only this app knows. Face ID or your fingerprint still opens it, unless you choose otherwise (below).

Yes, from build 11. With a Midnight PIN, choose how Face ID or your fingerprint counts. "Face ID or PIN", the default, opens the app with either. "PIN only" means Face ID never opens it. "Face ID and PIN" asks for both, every time, so someone who can use your face or finger, while you sleep or by force, still needs the PIN. If Face ID cannot be used in that mode, your phone passcode is asked for in its place. On Android these say Fingerprint instead of Face ID. Moving to a weaker choice asks you to unlock first.

For when someone else knows your phone passcode, like a partner or a family member. With a Midnight PIN, getting into the app takes a code they do not know. A face or fingerprint added to the phone since you last typed the PIN does not open the app until the PIN is typed again. Turn on "Shuffle the keypad" and the digits move every time, so nobody can learn your PIN by watching your hand or from marks on the screen.

After 5 wrong tries, each wrong one makes you wait: 1 minute, then 5, then 15, then 60. The app never deletes anything over wrong tries. If you forget the PIN, your 24-word recovery phrase removes it, and the app goes back to your phone passcode until you choose a new one.

Only on your phone, and never as the PIN itself. The app keeps a salted Argon2id hash of it: a one-way scramble made to be slow to guess. Easy PINs like 123456 are refused. The PIN is an extra door, not a replacement for a strong phone passcode, so keep that too.

From build 11, open Settings and tap "Back up chats", under Backup. The app makes one encrypted file, and you choose where to save it: your phone's files, a computer, a drive. It makes a file only when you ask. Nothing is uploaded to us, and we never keep a copy.

In it: your chats, replies included, your contacts and whether you verified them, each chat's disappearing-messages setting, your profile picture and your contacts' pictures, and a few settings, like your typing and status choices. Never in it: disappearing messages (any message with a timer, or any message in a chat where the timer is on), messages still waiting to send, your 24 words, your keys, your Midnight PIN, or which app lock you use. If your chats are too large for one file, the app says so and saves nothing.

Only you. The file is encrypted with a key made from your 24-word recovery phrase, so there is nothing new to remember, and it opens only into the same account. If you keep it on a cloud drive, the drive holds a file it cannot read. The trade-off: someone who has both the file and your 24 words can read your chat history. Your 24 words already give them your account, so keep them safe either way.

Sign in with your 24 words, and the app offers to pick your backup file right away. You can also do it later, in Settings, "Restore from a backup". Your chats, contacts and pictures come back, and each chat connects again with its contact by itself and keeps its history. Your app lock does not come back: set it again. Restoring the same file twice changes nothing. A contact already on your phone keeps its key and verification exactly as they are. Your messages that had not been delivered come back shown as sent, and are not sent again.

It is a standard 24-word phrase generated on your device that can regenerate your identity key on any new device. It is the only way to restore your account if you lose access to the device you registered on, so write it down and store it somewhere safe. It also opens your chat backups.

No. Your recovery phrase is generated and stored only on your device. We never see it and never store it, so nobody, us included, can recover the account. This is a deliberate tradeoff in favor of privacy over convenience. To start again on the same phone, you wait until 3 months after its last free account (see below). A reset you can ask for, so someone who lost everything is not stuck waiting, is planned before mainnet, targeted for the second half of 2027. Deleting the app, or signing out, without your 24 words is final, so save them first.

Signing back in with the 24 words brings back their account, but not their chats, unless they restore a chat backup. Either way, the chat connects again. Without a backup, when a message you send them has waited 30 minutes, your app leaves them a chat request. When they accept it, the chat reconnects, and messages still waiting for them are sent again.

To protect against bots. We pay the Midnight network fee for every signup, so nobody needs a wallet or a token, and that fee is real money. Without a limit, bots could make accounts by the thousand, use up the money, and fill the app with spam. So each phone gets one free account. When you sign up, Apple or Google checks that it is our real app on a real phone, without telling us who you are. We store nothing about the phone, and never link it to your account. A phone can make another free account 3 months after its last one. If you lose your 24 words before then, nobody can recover the account, by design, and you wait the 3 months. Deleting the app, or signing out, without your 24 words is final, so save them first. During the beta you also need a beta code.

You can restore your identity on a new device with your recovery phrase today. Seamless multi-device sync, where multiple devices stay active at once, is on our roadmap.

In the app, open Settings and tap Delete account, at the bottom under Sign out. Confirm, then unlock with Face ID, your fingerprint, your phone passcode or your Midnight PIN. Your username stops working at once and can never be used again, by you or anyone. To keep it that way, our directory keeps only the hash of the deleted username, your public key and your signed request to delete, with the date. The app then erases your keys and chats from the phone, and your 24 words won't bring the account back. It needs the latest beta version of the app. No app any more? Sign back in with your 24 words on any phone and delete from there. Your registration on the Midnight blockchain is permanent, but it holds no name or message, and no name points to it any more. The full steps, and where to ask for help, are on Delete your account.

Tell Sky, the AI assistant in our Discord. Go to #midnight-messenger, mention Sky, and say what happened: a bug, something confusing, or an idea. If it is a bug, she asks which app you use (iPhone or Android) and what you did right before. Nothing personal. The team reads the feedback she collects. You can also send feedback with a screenshot from TestFlight on iPhone, or from Google Play testing on Android.

No. The channel is public to everyone in the server. Sky's answers come from an AI, Anthropic's Claude, so what you ask her is processed by Anthropic to answer it, and we keep a copy of her conversations. Sky never asks for your username, contact code or recovery phrase, so never post them. Nothing from the app goes to Sky. Our Privacy Policy has the details.

Privately, by email to support@devbyone.com. Please do not post it in Discord or anywhere public. Email lets us look at it before anyone else can use it.

The iOS and Android apps are in a private beta on Midnight Network's Preprod testnet, and not in the app stores yet.

We are building and testing on Midnight Network's Preprod testnet first. Mainnet is targeted for the second half of 2027 (Q3 or Q4). The independent security audit and making proofs on the phone are targeted for the same time. Join Discord or follow us on X for mainnet launch updates.

The beta runs on Midnight's Preprod test network. We will publish exactly what happens to beta accounts well before the switch to mainnet.

Messaging and signup stay free. Later we plan optional extras you can pay for: premium usernames and a supporter badge. Nothing paid exists today. Privacy and the free basics will never be something you pay for.