Zerion
Encrypted chats, calls and channels over Tor. No phone number, no email.
New in version 3.0.18
Contacts find each other again after an address change. Group posts can be deleted for everyone and replied to; members may invite contacts when the owner allows it. Channel posts are cards with chat-like comments. Message states, one selection bar and an in-app media viewer. Tor 0.4.9.14 with transports built from source, refreshed bridges and signed bridge list updates. Largest font and TalkBack supported.
Zerion is a private messenger. Online messaging runs over Tor, so your IP address stays hidden from the people you talk to and from the Tor relays in between (your provider can see you use Tor). There's no phone number, no email, and no account on anyone's server. Your data lives encrypted on your own device; no Zerion server keeps a copy.
One-to-one, group and mesh messages are end-to-end encrypted with hybrid post-quantum cryptography: today's proven algorithms together with the new NIST quantum-resistant ones. Channels and account transfer use Tor and classical cryptography. Keys move forward as you talk, so a key taken today cannot decrypt messages recorded earlier. If large quantum computers arrive sooner than expected, the content of past messages stays protected.
WHAT YOU CAN DO
• One-to-one chats, end-to-end encrypted
• Group chats up to a few dozen people
• Voice calls over Tor, on by default, plus opt-in beta video calling
• Send photos, videos, voice notes, and documents
• Disappearing messages, with an optional default timer for new chats
• Stickers
• Introduce two of your contacts to each other, securely
• A built-in vault for passwords, notes, and private files, with search and sort
• Back up your account to an encrypted file, or move it to a new phone over Tor
• Channels, a one-to-many broadcast layer with optional discussion threads
• Translated into more than 35 languages
CHANNELS
One person writes, many people read.
• Public channels: anyone with the invite link can subscribe
• Private channels: only people with the private invite link can read
• Discussion threads: the owner decides, per channel, whether subscribers can reply
• Reactions, pinned posts, and attachments
• Mute notifications for any channel
• Subscribers are not listed to each other; people who comment or react are visible to all
HARDENED MODE (OPT-IN)
Three independent protections under Security settings, all off by default:
• Refuse to start on tampered devices (unlocked bootloader, modified system)
• Refuse to start when a debugger, root, or hooking framework is detected
• Sign out automatically, or wipe, if USB debugging or file transfer is switched on
PRIVACY AND SECURITY
• Tor, mandatory and always on while online. Online messaging never bypasses it; the optional Bluetooth mesh is off by default, and Offline mode turns off all internet messaging
• No phone number, no email, no central server
• No telemetry, no analytics, no crash reporting
• No logging in Zerion's code, verified at build time
• Encrypted at rest with SQLCipher and a key derived from your password
• Screenshots blocked inside the app by default
• Notifications never reveal message contents
• Sensitive copies are cleared from the clipboard after 60 seconds while the app runs
• Fully open source, GPL v3, reviewed internally before each release
UNDER THE HOOD
• Hybrid post-quantum key exchange (X25519 + ML-KEM-768)
• Hybrid signatures (Ed25519 + ML-DSA)
• Forward-secret message ratcheting
• Calls encrypted with AES-256-GCM; storage with SQLCipher (AES-256)
SUPPORT THE PROJECT
Zerion is free and open source, with no ads, no trackers, and no investors. If you'd like to help keep it independent, you can donate:
https://zerion.chat/donate.html
WHO IT'S FOR
People who want to talk to other people without a third party in the middle. Journalists and their sources, activists, lawyers and their clients, people in countries that block secure messengers. Anyone who doesn't want to hand a phone number to a tech company every time they install a messenger.
WHAT IT WON'T DO
• It won't message people who aren't on Zerion
• Online messaging needs an internet connection for Tor; the optional Bluetooth mesh can carry messages between nearby phones without one
• It won't restore your account if you forget the password. There is no recovery, and that's the point
LEARN MORE
• Website: https://zerion.chat
• Source: https://github.com/zerionproject/Zerion
GPL v3.
One-to-one, group and mesh messages are end-to-end encrypted with hybrid post-quantum cryptography: today's proven algorithms together with the new NIST quantum-resistant ones. Channels and account transfer use Tor and classical cryptography. Keys move forward as you talk, so a key taken today cannot decrypt messages recorded earlier. If large quantum computers arrive sooner than expected, the content of past messages stays protected.
WHAT YOU CAN DO
• One-to-one chats, end-to-end encrypted
• Group chats up to a few dozen people
• Voice calls over Tor, on by default, plus opt-in beta video calling
• Send photos, videos, voice notes, and documents
• Disappearing messages, with an optional default timer for new chats
• Stickers
• Introduce two of your contacts to each other, securely
• A built-in vault for passwords, notes, and private files, with search and sort
• Back up your account to an encrypted file, or move it to a new phone over Tor
• Channels, a one-to-many broadcast layer with optional discussion threads
• Translated into more than 35 languages
CHANNELS
One person writes, many people read.
• Public channels: anyone with the invite link can subscribe
• Private channels: only people with the private invite link can read
• Discussion threads: the owner decides, per channel, whether subscribers can reply
• Reactions, pinned posts, and attachments
• Mute notifications for any channel
• Subscribers are not listed to each other; people who comment or react are visible to all
HARDENED MODE (OPT-IN)
Three independent protections under Security settings, all off by default:
• Refuse to start on tampered devices (unlocked bootloader, modified system)
• Refuse to start when a debugger, root, or hooking framework is detected
• Sign out automatically, or wipe, if USB debugging or file transfer is switched on
PRIVACY AND SECURITY
• Tor, mandatory and always on while online. Online messaging never bypasses it; the optional Bluetooth mesh is off by default, and Offline mode turns off all internet messaging
• No phone number, no email, no central server
• No telemetry, no analytics, no crash reporting
• No logging in Zerion's code, verified at build time
• Encrypted at rest with SQLCipher and a key derived from your password
• Screenshots blocked inside the app by default
• Notifications never reveal message contents
• Sensitive copies are cleared from the clipboard after 60 seconds while the app runs
• Fully open source, GPL v3, reviewed internally before each release
UNDER THE HOOD
• Hybrid post-quantum key exchange (X25519 + ML-KEM-768)
• Hybrid signatures (Ed25519 + ML-DSA)
• Forward-secret message ratcheting
• Calls encrypted with AES-256-GCM; storage with SQLCipher (AES-256)
SUPPORT THE PROJECT
Zerion is free and open source, with no ads, no trackers, and no investors. If you'd like to help keep it independent, you can donate:
https://zerion.chat/donate.html
WHO IT'S FOR
People who want to talk to other people without a third party in the middle. Journalists and their sources, activists, lawyers and their clients, people in countries that block secure messengers. Anyone who doesn't want to hand a phone number to a tech company every time they install a messenger.
WHAT IT WON'T DO
• It won't message people who aren't on Zerion
• Online messaging needs an internet connection for Tor; the optional Bluetooth mesh can carry messages between nearby phones without one
• It won't restore your account if you forget the password. There is no recovery, and that's the point
LEARN MORE
• Website: https://zerion.chat
• Source: https://github.com/zerionproject/Zerion
GPL v3.
- License: GNU General Public License v3.0 only
- Website
- Issue Tracker
- Source Code
- Changelog
- Build Metadata
- Reproducibility Status
Donate
Versions
Although APK downloads are available below to give you the choice, you should be aware that by installing that way you will not receive update notifications and it's a less secure way to download. We recommend that you install the F-Droid client and use that.
Download F-Droid-
arm64-v8aarmeabi-v7aThis version requires Android 10 or newer.
It is built and signed by the original developer, and guaranteed to correspond to this source tarball.
Download APK 84 MiB PGP Signature | Build Log
-
arm64-v8aarmeabi-v7aThis version requires Android 10 or newer.
It is built and signed by the original developer, and guaranteed to correspond to this source tarball.
Download APK 80 MiB PGP Signature | Build Log
-
arm64-v8aarmeabi-v7aThis version requires Android 10 or newer.
It is built and signed by the original developer, and guaranteed to correspond to this source tarball.
Download APK 63 MiB PGP Signature | Build Log
New in version 3.0.17
Network status no longer falls back to "Publishing". Disappearing messages accept any time from one minute to one year. GitHub installs can check for updates over Tor, with signed notices only. All texts are translated in every supported language. Replies show the quoted message in full width with its author, and tapping the quote opens the original. Clearer notification icon.
New in version 3.0.3
v3.0.3: safer account deletion and clearer contact status
The lost-password screen can erase an account without the password, so it now asks you to type DELETE before the wipe can run. This prevents an irreversible deletion from being triggered by accident or by someone with brief physical access to an unlocked device.
A contact added over a link is now labelled Cryptographically paired rather than Verified. Link pairing sets up an encrypted channel but does not confirm the person's identity i
The lost-password screen can erase an account without the password, so it now asks you to type DELETE before the wipe can run. This prevents an irreversible deletion from being triggered by accident or by someone with brief physical access to an unlocked device.
A contact added over a link is now labelled Cryptographically paired rather than Verified. Link pairing sets up an encrypted channel but does not confirm the person's identity i