Whospair, Protect by design

A messenger with no server behind it.

Messages, voice notes, files and calls go from one Android phone straight to the other, over Tor. No account, no phone number, no company in the middle keeping a copy.

Download Whospair 1.4.1 APK, 39 MB · Android 10 or newer · check it first

How it works

Your phone is the only place your words exist.

When you install Whospair, your phone creates a key pair and gets its own Tor onion address. That key is your identity. To add someone, you scan each other's QR code, ideally in person.

From then on, your phones talk directly. If your contact's app is closed, the message waits on your phone until it's open again. Nothing waits on a server, because there isn't one.

Turn the phone face down and the screen goes black. With the optional camera shield, it also hides when you look away or someone looks over your shoulder.

What it does

Made for the day someone starts paying attention to you.

Encrypted end to end

X25519 and AES-256-GCM, every message signed and numbered. On the phone, an encrypted database sealed under your PIN.

Messages that expire

5 min, 15 min, 1 h, 5 h, 8 h, 24 h or 7 days, chosen when you send. Then gone from both phones.

PIN, not fingerprint

A finger can be forced onto a sensor, a code can't be forced out of you. Ten wrong PINs, or a duress PIN, erase everything.

Contacts you've met

Add people by QR code. Compare security codes in person, and you know nobody slipped in between.

Calls and voice notes

Voice calls over Tor, with a key that changes about every ten seconds. Files up to 25 MB, view-once if you want.

A screen that hides itself

Face down, it goes black. With the optional camera shield, it hides when you look away or someone else looks.

Updates without a store

Signed, delivered over Tor by your contacts or the update distributor. A stopped download picks up where it left off.

21 languages

Including Arabic, Persian and Hebrew, right to left. Day and night modes, six chat backgrounds.

Install

Check it's the real app, then install it.

  1. Download the APK with the button at the top, or from the releases page.
  2. Android asks you to allow installs from your browser or file manager. Allow it for this one install.
  3. Open Whospair, go to Settings, About, Version, and compare the fingerprint there with this one.
Signing certificate, SHA-256
3212f1262680b4cb1e2fafac1900435aa603c37047a867f93582cfa2a30bc9fb

If they don't match, it isn't Whospair: uninstall it and download it again from here. Once installed, updates arrive by themselves.

What it can't do: protect a phone that already has malware, or one someone holds unlocked. Your network operator can see you use Tor, not who you talk to. Lose the phone and your identity goes with it; there's no password reset.