How it works
No phone number, no account. A channel exists only between the phones that were in the room when it was created.
Meet and agree the terms
One person picks the channel name, how long it lives and how long messages last. The others join from their phones, from 2 up to 16 people.
The phones create a key together
A random key is created with noise from the phones' motion sensors and passed between the phones in the room, never over the internet. See below how it travels.
Compare a code, then talk
Everyone checks the same 12-digit safety code. After that each message consumes a slice of the key, which is then burned on every phone. Photos taken with BurnApp's own camera go straight into the chat: they never touch your gallery and burn with the message.
How the key travels
When you create a channel, your phones make one big random key together and send it phone to phone over an encrypted short-range link. Texts, photos and voice notes all use it.
In person
Everyone in the same room: the key goes directly between the phones (64 MB–1 GB). Nothing secret goes over the internet.
Remote, with a link or QR
For when you can't meet: send the invite link (it opens BurnApp straight away) or let them scan your QR code. The key travels over the internet protected by standard end-to-end encryption. These channels are clearly marked in the app.
Camera key — paused
Passing the key screen to camera as a moving QR code, so it never travels over any radio, is paused while we make it reliable on more phones.
Why it's safer
Most encrypted messengers are very good. BurnApp takes a different, older and simpler approach, with some properties they can't offer.
No algorithm to break
BurnApp uses a one-time pad: a random key as long as the messages, used once and destroyed. With perfectly random keys it is the only cipher proven unbreakable, even by future quantum computers. BurnApp's key mixes the cryptographic random generator of every phone in the channel with noise from their motion sensors. There is no cipher algorithm an attacker could crack. The key's strength rests on that randomness and on keeping the setup private.
The key never touches the internet
Other apps agree keys over the internet, which is secure but means the exchange can be recorded today and attacked tomorrow. BurnApp's key goes directly between phones in the same room, over an encrypted short-range link.
Everything burns, always
Messages vanish from every phone after the time you agreed, and each piece of key is destroyed after one use. Even if a phone is seized later, past messages can't be decrypted, because the key that would open them no longer exists.
No identity at all
No phone number, email, contact list or account. The server only sees random mailbox ids. It doesn't know who you are, who you talk to, or which mailboxes belong together.
A server that can't see
The relay stores encrypted blobs, deletes each one when it is delivered or expires, and keeps no request logs. A full copy of the server would be useless to an attacker.
Voice notes
Record up to 2 minutes and send it like any message: encrypted with the one-time pad, gone when the time is up, or heard only once with "1×". Audio is played from memory and never written to disk unencrypted. Available on the High and Standard levels.
View-once messages
Tap "1×" before sending and the text or photo can be opened exactly once. It is deleted from the recipient's phone the moment it opens, and the sender never keeps a copy.
Nothing leaks out of the phone
No cloud backups, screenshots and screen recording blocked, and notifications never show who wrote or what. The key is locked with the phone's secure hardware (Android Keystore).
BurnApp compared
A fair comparison with typical end-to-end encrypted messengers. Details vary by app and settings.
| BurnApp | Typical encrypted messenger | |
|---|---|---|
| Encryption | One-time pad: no cipher algorithm to attack; as strong as its random key | Modern standard algorithms, secure against every known attack. Some apps now add post-quantum layers. |
| How keys are agreed | In person, phone to phone (or a clearly marked remote mode) | Automatically over the internet. Verifying the other person's key is optional. |
| Account | None | Usually a phone number |
| Message lifetime | Always expires, as agreed by everyone | Kept until deleted, unless disappearing messages are turned on |
| Backups | Never | Often optional cloud backups |
| What the server knows | Random mailbox ids, sizes and timing | At least your account and when you connect; some apps also know who talks to whom |
What it can't protect you from
No app is magic. Being honest about the limits is part of the security.
- The people in the channel. Someone can still photograph their screen with another device.
- A hacked, unlocked phone. Malware with full control of a phone can read what is on it while the channel is alive.
- Metadata on the network. Your internet provider and the relay can see that you send something and how big it is, but not what it is or who it's for.
- Key size. The key runs out after enough messages and photos. Then you meet again to create a new channel.
Install
- Tap Download for Android above on your phone.
- Open the file. Android will ask you to allow installing apps from your browser: allow it for this install.
- Open BurnApp, tap New channel, and meet your friends. Or use Start remotely to test with an invite code.
- When asked, allow BurnApp to run in the background so messages arrive instantly.
Using 0.7.0 or older? Update now: the server changed its address on 29 Sep 2026, and older versions can no longer send or receive. Install 0.8.1 over it; your channels are kept.
Had version 0.3.0 or older? Uninstall it first: from 0.3.1 on, BurnApp is signed with its own release key and uses a new package name, so it installs as a new app.
This is an early test build, installed directly rather than from Google Play. The full technical design is in the protocol specification. Privacy policy.
Verify your download
Every official BurnApp build is signed with the same key. If the fingerprint doesn't match, don't install it.
Packagecom.jluisrey.burnapp
Signing certificate SHA-2567C:A3:E0:BC:FD:49:B6:0B:8F:F1:55:14:9E:9E:15:AA:15:F3:84:1E:C8:B0:8C:19:67:27:30:E0:BD:F6:73:9C
BurnApp-0.8.1.apk SHA-256277c5687c2a7fd6df253fa19c84f047315d6c046c782415683443d66e7c481c1
Check the certificate with apksigner verify --print-certs BurnApp-0.8.1.apk, or the file hash with sha256sum / Get-FileHash.