← Blog

Session vs MurMur: Messengers Without a Phone Number

Two messengers that skip the phone number

Most messengers start by asking for your phone number. WhatsApp and Signal both do. WhatsApp encrypts message content by default, but it belongs to Meta, and Meta keeps the account metadata — who you talk to and when, plus device details. Signal also requires a phone number, even though it collects very little metadata and its protocol is treated as the reference standard in the field. If your goal is a messenger that never sees a phone number at all, the list of serious options gets short fast. Session is the most established one. MurMur is a much younger open-source project that takes a different route. This article compares the two honestly — including the places where Session is simply the better recommendation today.

The short version

	Session	MurMur
Registration	None. A random session ID is generated on your device.	None. Your identity is a cryptographic key (npub) generated on your device.
E2EE by default	Yes	Yes — for messages and calls
Calls	Voice calls between users	E2EE calls, running in the browser
Metadata story	Messages travel through an onion network of independently operated nodes; nothing is tied to a phone number.	A single Rust relay in Europe that cannot read plaintext and keeps encrypted messages only for a limited time.
Install	Native apps from app stores, APK, desktop apps	PWA installed from the browser, no app store needed
Who runs it	The Session Foundation plus a community-operated node network	One open-source relay in Europe, run by the project itself

Where Session is the better choice today

This should be stated plainly. Session has existed for years, its code has been independently audited, it has a large user community, and its apps went through long real-world testing. If you want a no-phone-number messenger that many people already use, with mature native apps, Session is the safer recommendation right now. That is not a caveat — it is the honest answer for most people reading this. A young project with no security audit cannot compete with that track record, and pretending otherwise would be misleading.

Where MurMur differs

• Installation from the browser. MurMur is a PWA. On both iPhone and Android you install it directly from the browser, without the App Store or Google Play. That matters if app stores are an obstacle for you, or you simply don't want another native app.
• Calls in the browser. Voice calls are end-to-end encrypted and run inside the same browser-installed app. Nothing extra to install.
• A simpler model. One cryptographic key is your account. One Rust relay in Europe moves encrypted data. The relay cannot read plaintext and stores encrypted messages for a limited time — enough to receive messages while you were offline, not a long-term archive.
• Push notifications work, so it behaves like a normal messenger in daily use.
• Readable code. The project is open source and small. An ordinary developer can actually read all of it, which is unrealistic for a large codebase.

Honest limitations of MurMur

• No security audit. The code is open, but no independent review has happened yet. If an audited product is your requirement, Session wins today.
• Small audience. The project is young; your contacts are probably not there yet. That is a practical problem, not a cosmetic one.
• A PWA depends on the browser. It lives inside your browser, with the limits that come with that: no native-app polish, and behavior tied to browser updates.
• Key loss means account loss. There is no SMS recovery and no reset link. Lose the key, lose the account. That is the price of having no phone number in the system at all.

FAQ

Does Session require a phone number or email?

No. Session generates a random session ID on your device during setup, and nothing connects that ID to a phone number or an email address.

Is MurMur as secure as Session?

There is no honest way to claim that. Both encrypt messages end-to-end and both are open source, but Session has been through independent audits and MurMur has not. Until an audit happens, treat MurMur as promising but unverified.

Can I install MurMur without the App Store or Google Play?

Yes. MurMur is a PWA: open the site in the browser on iPhone or Android and install it from there. No app store account is involved.

What happens if I lose my MurMur key?

The account is lost. The cryptographic key is the identity, and there is no SMS recovery to fall back on. Backing the key up is on you.

Can the relay or the network read my messages?

Session routes messages through an onion network of community-run nodes, with content encrypted end to end. MurMur's relay cannot read plaintext either — it stores messages only in encrypted form, and only for a limited time.

Trying MurMur

If the browser-based approach sounds interesting, MurMur installs in a couple of minutes from murmurchat.org and works on both iPhone and Android. The source code is on GitHub. Just keep your key safe — there is no reset.