Private messaging
Private messaging that stays private, even if someone has your phone.
No phone number. No email. Nothing tied to your identity.
- End-to-end encrypted, post-quantum
- Duress & decoy passcodes
- Deleted on both sides, for real
- Open source, AGPL-3.0
iPhone · Android: small-group beta, by request · Free during the beta · A$14.99 one-off at launch
Deleted on both sides
End a chat, and it's gone for both of you.
Either person can end a conversation at any time. The whole thread, every message and the session record, is hard-deleted from our server, and the other phone clears its copy at its next sync. Not hidden, not archived.
A phone that stays offline, or someone who already copied a message, can't be assumed to have erased it.
Six things Vardum protects
More than messages. Nothing bolted on.
Other encrypted apps stop at your chats. Vardum protects everything private on your phone, with the same keys, in the same app.
Your messages
Post-quantum encrypted chats, groups of up to 100, photos and voice notes. Messages burn after they're opened, and either side can wipe a whole thread from the server.
Your files
Encrypted vaults, sealed on your phone before upload, with an optional hidden second volume inside the same container.
Your notes
Locked behind your password and sealed with a key from your 24 words, so they come back on a new phone even after a full wipe.
Your photos
Each photo, video and voice note is sealed with its own key. Built-in steganography hides a message inside an ordinary picture.
Your identity
24 random words made on your phone. No name, no email, no number. Share your Vardum QR instead, and start over with a new Vardum ID whenever you like.
The phone itself
Decoy and duress passwords, Nothing-at-Rest key storage, hold-until-unlock and a self-destruct countdown, for the moment the phone isn't yours any more.
See the app
One app for everything private on your phone.
Real screens from the current beta. Swipe through on a phone.
No other app in our top 10 has these together
What sets Vardum apart
Checked against the ten leading encrypted messengers. See the comparison
You set the rules
Every privacy setting, in your hands
Other apps give you a disappearing-message timer. Vardum lets you decide how long everything lasts, what your phone keeps, and what happens if it's ever taken. See every control
Messages
Lock and emergency
Keys and history
Get started in a minute
Three steps. No sign-up form.
Create a new identity
One tap makes your Vardum ID and a one-time 24-word phrase on your phone. No email, no code, no phone number.
Write down your 24 words
They're shown once and never saved. They're the only way to bring your identity, contacts and notes back on a new phone.
Share your Vardum QR
Friends scan it in the app, or you send it as a picture. Compare the safety code once, then talk freely.
How your 24 words are made
Made on your phone. Shown once. Never stored.
When you tap Create, your phone's secure random generator makes 256 random bits. No server is involved and nothing about you goes in: not your name, number, time or location. The bits become 24 words from the standard BIP39 list, with a built-in check that catches typos.
Your keys, your Vardum ID and your hidden sign-in are made from the words one way only. Nothing we hold can be turned back into them, not even by us.
What leaves your phone
- Your public key and Vardum ID
- A sign-in label made from your words
What never does
- Your 24 words or private keys
- Your name, email or phone number
2256 possible phrases: a 78-digit number.
The honest comparison
Only Vardum protects your whole phone.
Of the top 10 encrypted messengers, Vardum is the only one that also protects your files, notes, photos and the phone itself. On messaging alone, we’re second only to SimpleX, largely because our independent cryptographic audit is still to come. It’s planned for early 2027.
We scored Vardum against the top 10 encrypted messengers by the same rules, and we show where we lose. Here's the full-phone ranking: identity privacy, seized-phone protection and everything beyond messaging, out of 30.
Why pay for Vardum?
Free apps protect your messages. Vardum protects your whole phone.
Other encrypted messengers stop at your chats. Vardum starts with private messaging and goes further: your messages, files, notes, photos, your identity and the phone itself, all sealed with the same keys, in one app.
To match it with free apps you'd need a messenger, a file vault, a notes locker and a panic wipe, none of them sharing keys.
With a free messenger
Your chats are encrypted. Your files, notes and photos are on their own, and a phone number is often the price of entry.
With Vardum
Chats, vaults, locked notes, hidden messages in photos, decoy and duress passwords, and an identity with no number or email.
Now taking orders · Vardum Phones
Private at every layer, from the Wi-Fi radio to your last message.
A Google Pixel running GrapheneOS Hardened "Graph", the hardened, Google-free version of Android, with Vardum and your favourite apps installed before it reaches you. Graph protects the phone and its network; Vardum protects your conversations and private files.
Who Vardum is for
Built for the conversations that matter most
If a leak would change your life, this is your messenger.
Everyday privacy-minded people
You don't need a threat model to want your chats off a company's server. Vardum works like a normal messenger, with messages that burn after they're read and nothing readable left on the server.
Journalists and whistleblowers
Protect sources with safety-code checks and messages that delete themselves. Nothing at rest keeps conversation keys in memory only, so a lost or stolen phone holds none.
Survivors of stalking and abuse
Messages that burn after opening, the power to end and wipe a conversation from your side at any time, and an optional duress password that erases Vardum on the phone and asks our server to delete your records.
Activists
Decoy and duress passwords, encrypted vaults and hold-until-unlock, for the moment a phone isn't yours any more.
Professionals and teams
Privileged conversations and sensitive team discussions, with post-quantum groups, signed membership and instant removal.
Intimate and personal sharing
Photos, voice notes and private moments with the same protection as everything else: each file sealed with its own key, burned after opening, and wipeable from either side.
Honest limits
What our server can and can't see
Never
Your messages, photos, voice notes, notes or vault files. Your 24 words or private keys. Your name, email or phone number. Your contact list.
Does see
Which Vardum IDs exchange messages and when, sizes and timing, and your IP address as you connect, which it stores only as a one-way code that changes daily and is deleted within 48 hours. For calls, Vardum's own call server sees both phones' IP addresses while a call runs, and when and for how long.
Vardum's cryptography is self-reviewed today, and the code is public under the AGPL-3.0 licence. When the audit is published, we'll re-score ourselves and post the report. Every claim is labelled in the claims register.
Why we built this
Built by one founder, in the open
I started Vardum because privacy now has to cover the whole phone, not just messages in transit. Phones get lost, stolen and taken, and AI makes stored data easier to mine than ever, so end-to-end encryption alone no longer covers the whole risk. The design goal became simple: encrypt everything on the phone, keep as little as possible, and be honest about the rest.
In September 2026 Apple's review flagged the first version over the platform it was built on, not its encryption. So I rebuilt Vardum as a fully native iPhone app and moved it onto a server I rent and run myself. Every claim on this site is labelled, because anyone asking for your trust should show the receipts first.
Message the founder on Vardum
Scan this code in the Vardum app, or tap it on your phone. It carries only the public Vardum ID, nothing else.
Vardum ID EC2oRHsF2uRS98rb
Questions
FAQ
Do I need an email address or phone number?
No. You tap Create a new identity and that's it: there is no sign-up form. Vardum makes your identity from 24 random words on your phone, and your 24 words are the only way to recover it.
How much does Vardum cost?
Vardum is free while in TestFlight. At launch it's A$14.99, one-off, for the full app.
How long do opened and unopened messages last?
Two separate dials. Burn after opening is 5 minutes to 24 hours after the person opens the message. Unopened messages expire 1, 6, 12, 24, 36 or 48 hours after sending, with a separate 30-day tier for the Founding Tester Forum. A background download doesn't start the burn clock. Expired records are removed by the server every 2 minutes.
Can the server read my messages?
No. The relay stores ciphertext only. Encryption and decryption happen on your phone, and the private keys never leave it.
Does Vardum download my messages while the app is locked?
That's your choice. With hold-until-unlock on, a locked phone fetches nothing at all: messages wait, encrypted, on the relay until you unlock. With it off, messages download in the background so they're waiting when you open Vardum. How hold-until-unlock works
What happens when a conversation ends?
Either person can end a chat at any time. That removes its session and messages from the relay, and the other phone clears its copy at its next sync. A phone that stays offline, or someone who already copied a message, can't be assumed to have erased it.
Do you support groups?
Yes, up to 100 members including the creator, with post-quantum sender keys and signed membership. Invites travel privately inside your encrypted chat with each person.
What is the media limit?
25 MB per file. Photos, videos and voice notes are encrypted on your phone, and their keys travel only inside encrypted messages.
Does Vardum support internet calling?
Yes, newly added: calls go through a call server Vardum runs, so neither phone learns the other's IP address. It has had limited testing so far; if the call server can't be reached, calls fall back to the same network.
Is Vardum open source? Has it been audited?
The app's code is public on GitHub under the AGPL-3.0 licence. The cryptography is self-reviewed today; an independent cryptographic audit is planned for early 2027.
Why does post-quantum matter?
A future quantum computer could break today's key exchange, and messages recorded now could be decrypted later. Vardum mixes classical X25519 with ML-KEM-768, a NIST-standard algorithm, when a chat starts and as it continues.
What if I lose my phone?
Your 24 words restore your identity, contacts and notes on a new phone. Vardum never emails a recovery link. If you still have the old phone, a one-time 10-minute encrypted transfer can move your live chats.
24 words. That's all it takes.
No form, no email, no phone number.
Support: support@tryvardum.app · Reporting a security issue? Read the responsible disclosure policy.