Most messengers start the same way: enter your phone number, wait for an SMS code, hand over a piece of personal data that links everything else you do to a SIM card. Some services let you hide your number from contacts later, but the account is still built on it — and still recoverable through it.
MurMur takes a different route. It doesn't ask for a phone number at all. Not at registration, not as a backup, not anywhere.
When you open MurMur for the first time, the app generates a cryptographic key pair for you. Your public key — your npub — is your identity. That's the whole registration process: the key exists, therefore your account exists.
No phone number. No email address. No name, no birth date, no contact list upload. There is nothing to verify with an SMS code because there is nothing to verify — possession of the private key is the proof of identity.
The practical consequence: you don't need a SIM card to use MurMur. A laptop with a browser is enough. If your number changes carriers, gets recycled, or you simply don't want to attach it to another service, none of that affects your account.
Every messenger needs infrastructure to deliver messages when the other person is offline. MurMur's relay is a small, single-purpose server: it receives encrypted blobs, holds them, and passes them on.
Because the relay never holds decryption keys, it cannot read your conversations. It knows that some encrypted data existed, when, and between which key pairs — metadata at this level is hard to eliminate entirely for any messenger that isn't peer-to-peer. What it doesn't know is what you said.
Hosting in Europe means the relay operates under European jurisdiction, not in an undefined location. And the limited retention window means encrypted messages aren't archived on the server indefinitely — there's a window for offline delivery, and then the data is gone.
A messenger asking for your trust should state its weaknesses plainly. Here they are:
MurMur makes sense if one or more of these describe you:
If you need a messenger with a hundred-million-user network effect or an independently audited protocol on day one, MurMur isn't there yet. That's stated plainly so you can decide with the facts.
There's no install wizard and no form. Open the site, and the key is generated in your browser:
Open MurMur at murmurchat.org →
The landing page explains the product; the actual app is at murmurchat.org/pwa/. Source code: GitHub.
Yes. Registration creates a cryptographic key pair in your browser; no phone number, email, or SMS code is involved. Any device with a modern browser works.
Your identity is your npub — a public key string. You share it directly (as text or a link) with people you want to talk to. There's no contact-import from your address book.
Your identity lives in your keys. If the private key is lost and you made no backup, the account can't be recovered — the same property that keeps it free of phone numbers also means there's no SMS-based reset. Back up what the app offers you to back up.
No. It's a PWA: you open it in the browser and can add it to your home screen on iOS and Android directly from the site, bypassing App Store and Google Play.
Not yet. The code is open source and the design is documented, but no third-party audit has been completed. This is listed among the project's known limitations.