Private messaging
Private messaging that stays private, even if someone has your phone.
No phone number. No email. Nothing tied to your identity.
- End-to-end encrypted, post-quantum
- Duress & decoy passcodes
- Deleted on both sides, for real
- Open source, AGPL-3.0
iPhone · Free during the beta · A$14.99 one-off payment at launch
Six things Vardum protects
More than messages. Nothing bolted on.
Other encrypted apps stop at your chats. Vardum protects everything private on your phone, with the same keys, in the same app.
Your messages
Post-quantum encrypted chats, groups of up to 100, photos and voice notes. Messages burn after they're opened, and either side can wipe a whole thread from the server.
Your files
Encrypted vaults, sealed on your phone before upload, with an optional hidden second volume inside the same container.
Your notes
Locked behind your password and sealed with a key from your 24 words, so they come back on a new phone even after a full wipe.
Your photos
Each photo, video and voice note is sealed with its own key. Built-in steganography hides a message inside an ordinary picture.
Your identity
24 random words made on your phone. No name, no email, no number. Share your Vardum QR instead, and start over with a new Vardum ID whenever you like.
The phone itself
Decoy and duress passwords, Nothing-at-Rest key storage, hold-until-unlock and a self-destruct countdown, for the moment the phone isn't yours any more.
Why pay for Vardum?
Free apps protect your messages. Vardum protects your whole phone.
Other encrypted messengers stop at your chats. Vardum starts with private messaging and goes further: your messages, files, notes, photos, your identity and the phone itself, all sealed with the same keys, in one app.
To match it with free apps you'd need a messenger, a file vault, a notes locker and a panic wipe, none of them sharing keys.
With a free messenger
Your chats are encrypted. Your files, notes and photos are on their own, and a phone number is often the price of entry.
With Vardum
Chats, vaults, locked notes, hidden messages in photos, decoy and duress passwords, and an identity with no number or email.
No other app in our top 10 has these together
What sets Vardum apart
Checked against the ten leading encrypted messengers. See the comparison
Get started in a minute
Three steps. No sign-up form.
Create a new identity
One tap makes your Vardum ID and a one-time 24-word phrase on your phone. No email, no code, no phone number.
Write down your 24 words
They're shown once and never saved. They're the only way to bring your identity, contacts and notes back on a new phone.
Share your Vardum QR
Friends scan it in the app, or you send it as a picture. Compare the safety code once, then talk freely.
How your 24 words are made
Made on your phone. Shown once. Never stored.
When you tap Create, your iPhone's secure random generator makes 256 random bits. No server is involved and nothing about you goes in: not your name, number, time or location. The bits become 24 words from the standard BIP39 list, with a built-in check that catches typos.
Your keys, your Vardum ID and your hidden sign-in are made from the words one way only. Nothing we hold can be turned back into them, not even by us.
What leaves your phone
- Your public key and Vardum ID
- A random-looking sign-in label made from your words
- A check value for a hidden password you never see
What never does
- Your 24 words
- Your private keys
- Your name, email or phone number
2256 possible phrases: a 78-digit number. The paper copy is the only place your words exist, so it's the thing to protect.
You set the rules
Every privacy setting, in your hands
Other apps give you a disappearing-message timer. Vardum lets you decide how long everything lasts, what your phone keeps, and what happens if it's ever taken. See every control
Messages
Lock and emergency
Keys and history
The honest comparison
Only Vardum protects your whole phone.
Of the top 10 encrypted messengers, Vardum is the only one that also protects your files, notes, photos and the phone itself. On messaging alone, we’re second only to SimpleX, largely because our independent cryptographic audit is still to come. It’s planned for early 2027.
We scored Vardum against the top 10 encrypted messengers by the same rules, and we show where we lose. Here's the full-phone ranking: identity privacy, seized-phone protection and everything beyond messaging, out of 30.
Who Vardum is for
Built for the conversations that matter most
If a leak would change your life, this is your messenger.
Everyday privacy-minded people
You don't need a threat model to want your chats off a company's server. Vardum works like a normal messenger, with messages that burn after they're read and nothing readable left on the server.
Journalists and whistleblowers
Protect sources with safety-code checks and messages that delete themselves. Nothing-at-Rest can keep no conversation keys on the phone at all: nothing to seize, nothing to pull.
Survivors of stalking and abuse
Messages that burn after opening, the power to end and wipe a conversation from your side at any time, and a duress password that wipes your keys and records, then shows an ordinary-looking app.
Activists
Decoy and duress passwords, encrypted vaults and hold-until-unlock, for the moment a phone isn't yours any more.
Professionals and teams
Privileged conversations and sensitive team discussions, with post-quantum groups, signed membership and instant removal.
Intimate and personal sharing
Photos, voice notes and private moments with the same protection as everything else: each file sealed with its own key, burned after opening, and wipeable from either side.
Honest limits
What our server can and can't see
Never
Your messages, photos, voice notes, notes or vault files. Your 24 words or private keys. Your name, email or phone number. Your contact list.
Does see
Which Vardum IDs exchange messages and when, sizes and timing, and your IP address as you connect, which it stores only as a one-way code that changes daily and is deleted within 48 hours. Calls work on the same Wi-Fi network for now; internet calling is on the roadmap.
Vardum's cryptography is self-reviewed today, and the code is public under the AGPL-3.0 licence. When the audit is published, we'll re-score ourselves and post the report. Every claim is labelled in the claims register.
Why we built this
Built by one founder, in the open
I started Vardum after New South Wales expanded laws compelling access to a phone under threat of criminal penalty, and I realised end-to-end encryption alone no longer covers the whole threat. The design goal became simple: comply fully with any lawful search, and there is nothing to extract.
In September 2026 Apple's review flagged the first version over the platform it was built on, not its encryption. So I rebuilt Vardum as a fully native iPhone app and moved it onto servers I own and run myself. Every claim on this site is labelled, because a one-person team asking for your trust should show the receipts first.
Message the founder on Vardum
Scan this code in the Vardum app, or tap it on your phone. It carries only the public Vardum ID, nothing else.
Vardum ID EC2oRHsF2uRS98rb
Questions
FAQ
Do I need an email address or phone number?
No. You tap Create a new identity and that's it: there is no sign-up form. Vardum makes your identity from 24 random words on your phone, and your 24 words are the only way to recover it.
How much does Vardum cost?
Vardum is free during the TestFlight beta. At launch it's a one-off payment of A$14.99 for the full app.
How long do opened and unopened messages last?
Two separate dials. Burn after opening is 5 minutes to 24 hours after the person opens the message. Unopened messages expire 12, 24, 36 or 48 hours after sending, with a separate 30-day tier for the Founding Tester Forum. A background download doesn't start the burn clock. Expired records are removed by the server every 2 minutes.
Can the server read my messages?
No. The relay stores ciphertext only. Encryption and decryption happen on your phone, and the private keys never leave it.
Does Vardum download my messages while the app is locked?
That's your choice. With hold-until-unlock on, a locked phone fetches nothing at all: messages wait, encrypted, on the relay until you unlock. With it off, messages download in the background so they're waiting when you open Vardum. How hold-until-unlock works
What happens when a conversation ends?
Either person can end a chat at any time. That removes its session and messages from the relay, and the other phone clears its copy at its next sync. A phone that stays offline, or someone who already copied a message, can't be assumed to have erased it.
Do you support groups?
Yes, up to 100 members including the creator, with post-quantum sender keys and signed membership. Invites travel privately inside your encrypted chat with each person.
What is the media limit?
25 MB per file. Photos, videos and voice notes are encrypted on your phone, and their keys travel only inside encrypted messages.
Does Vardum support internet calling?
Not yet. Calls work between phones on the same network. Internet calling is on the roadmap.
Is Vardum open source? Has it been audited?
The app's code is public on GitHub under the AGPL-3.0 licence. The cryptography is self-reviewed today; an independent cryptographic audit is planned for early 2027.
Why does post-quantum matter?
A future quantum computer could break today's key exchange, and messages recorded now could be decrypted later. Vardum mixes classical ECDH P-256 with ML-KEM-768, a NIST-standard algorithm, when a chat starts and as it continues.
What if I lose my phone?
Your 24 words restore your identity, contacts and notes on a new phone. Vardum never emails a recovery link. If you still have the old phone, a one-time 10-minute encrypted transfer can move your live chats.
24 words. That's all it takes.
No form, no email, no phone number.
Support: support@tryveil.app · Reporting a security issue? Read the responsible disclosure policy.