Note: foomms relies on foodjis and on a PGP ID identity. To keep up, join our mailing lists .

foomms is an SMS and MMS messaging app for Android whose messages can only be read with their recipient’s security key. It replaces the phone’s messaging app, and you keep your habits — conversations, bubbles, a field at the bottom. Only now you can encrypt and sign what goes out, and decrypt or verify what comes in. It has been on Google Play since mid-October, and can also be downloaded from its own site.

Why SMS, in 2026? Because a phone number is the one address every phone answers. No account to open, no app the other person must have joined, no extra servers, which are usually polluting and indiscreet. Only the carriers transport the message, as usual. Your messages therefore travel by much shorter and more direct ways than over the Internet. And if, like your postman or the countless machines of the Internet, your carriers see who writes to you, they no longer see what is written. Your messages at last travel in a real envelope, truly sealed, sheltered as firmly as can be from prying eyes.

The number designates the key

A message for a number is encrypted for the certificate that number designates. There is nothing to choose when writing, and nothing to mix up.

PGP was invented so that you can control and filter who writes to you. For that, PGP asks each person to publish, themselves, a minimum of data by which they can be identified.

Yet until today few people used PGP. So, to keep away unwanted messages and other spam, the only way was to try, in vain, to give out no personal data at all; and still today, few people put their mobile number in their certificate.

So the link between a number and a key is made where numbers already live, in the phone’s address book. With your consent, foomms writes there the certificate’s address on a keyserver — the form the KEY property of a vCard gives it (RFC 6350, section 6.8.1 ) — and fills in the name, addresses and face where the contact does not say them yet. The link is yours: each person decides for themselves which certificate a number designates.

A signed message from a number not yet linked offers to link that number to its signer’s certificate. That is how the address book fills up, one conversation at a time.

No cryptography in foomms

foomms holds no key and does no cryptographic computation. It asks foodjis for everything, through Android’s OpenPGP provider interface, the one mail apps already speak: foodjis keeps the keyring, encrypts, checks signatures, and opens a message with the security key held against the back of the phone. The private key never leaves the security key, and the phone holds nothing but public material.

Two consequences, both deliberate:

• foomms has no Internet access. It does not ask Android for that permission: the phone’s own service carries a message, and whatever is asked of a keyserver is asked through foodjis.
• One touch of the key opens several messages. Pressing an encrypted message opens with it the ones around it in the conversation — seven on each side by default, from none to fifteen — and a few unread messages from other conversations. foodjis says in its window each step of what it is doing; the phone signals when the key can go.

What travels

A text stays a text. What goes out is a PGP message in its armor (RFC 9580, section 6 ): characters an SMS carries without damage. Under about 900 characters, the message goes as SMS; beyond that, as a single MMS. Whoever receives it without foomms sees a message that is plainly encoded, and can copy it into foodjis.

A photo, a sound, a video, a file go as MMS. Encrypted or signed, the file becomes a PGP message of its own, under its name followed by .pgp, which foodjis opens like any file. A photo is scaled down before it is encrypted: a carrier can no longer do it afterwards. An MMS stays under 300 KB, or under your carrier’s limit if you choose it.

Four colours say what each message is worth, without having to read a word: red, neither encrypted nor certified; yellow, encrypted and not certified; blue, certified and not encrypted; green, both. Certified means signed by someone you have certified, or, for what you send, signed by you for someone you have certified. A message not opened yet is grey: what it is worth is only known once the key has been used.

The plain text is never written

What an encrypted message holds is decrypted only in memory, for the time you choose — five minutes by default, from thirty seconds to twelve hours —, then it closes again. The phone’s message store, the one every messaging app reads, keeps only what travelled: the sealed envelope.

The same goes for everywhere foomms writes:

• The backup saves messages in the format most messaging apps read (that of “SMS Backup & Restore”), and PGP messages stay encrypted in it.
• Drafts stay in foomms, and are not lost when you switch to another app.
• An encrypted message is also encrypted for you, so that you can read it again. Unless you set otherwise: you will then no longer be able to open, yourself, the envelopes you sealed for the people you write to.

Writing to several people, and the rest

One message for several people: named one after the other when writing, each receives it in their own conversation. Encrypted, it is a single PGP message for all their keys, like a letter with several recipients.

And also: a short video or a sound recorded in foomms, watched full screen; a long voice message that keeps playing outside the conversation, its controls in the notifications; a missing certificate looked up on the keyservers, through foodjis; a text, an image or a file shared from another app, to one or several people.

Version 1.3.3

Version 1.3.3 brings together everything done since 1.2.5:

• MMS groups, conversations among several people as in any messaging app. There is a pitfall, which we ran into for real: several carriers rewrite the “To” field of a group MMS, so that on arrival not everyone sees the same members. foomms therefore attaches to each message a small vCard, foomms-group.vcf, naming the members: the group is recognised by it, whatever the route. Encryption is optional there; a group can be named, on your phone only, and holds up to twenty members by default;
• a multiple send: the same message sent to each person in their own conversation, each copy encrypted for its recipient alone, and signed only once — one touch of the key for the whole send;
• three pages, Conversations — where one-to-one exchanges and groups follow one another —, Unread and My profile. At launch, foomms asks which address book contact is yours: it never reads the SIM card’s number;
• drafts kept where Android expects them, so that another app sees them, but as a marker without text: what you were writing stays in foomms;
• a message the carrier refused says so under its bubble: a refusal proves the message did not leave, while an acceptance does not prove it arrived;
• pixel faces, drawn from the certificate’s fingerprint, for those without a photo; the frame in the certificate’s colours in a conversation’s title; a silent voice note, the microphone taken by a call, is not sent; after foodjis is updated, foomms reconnects on its own.

What comes next

The next version, 1.4.0, is nearly ready:

• the carrier’s limits, read from the configuration Android keeps for each network, are shown in the settings. You choose up to how many SMS a long text goes as SMS, from one to thirty-two, and how large an MMS may be, between 300 KB and what the carrier announces;
• an encrypted attachment arrives whole. We saw a carrier take out, on the way, a 316 KB attachment it judged too heavy for the receiving phone, and put a sentence of its own in its place. A photo in clear can be scaled down without much harm; an encrypted attachment scaled down is lost. An MMS can forbid it: with the field X-Mms-Adaptation-Allowed: No (OMA-MMS-ENC 1.3), a 574 KB encrypted attachment arrived whole. foomms sets it on every MMS that carries an encrypted or signed attachment, and should a carrier take one out all the same, the bubble says so;
• what you send encrypted shows open in your bubble, the photo as well as the text, for the same countdown;
• received photos open full screen: zoom in, move around, rotate;
• two more shades: a message certified, but signed by someone other than the person of the conversation — a forwarded message, for one — is violet, or yellow-green if it is also encrypted;
• an MMS the phone could not download is reported, and asked for again for seven days;
• My profile gathers drafts and unread messages, each on its own line, opening onto the list of the conversations concerned; a long press on a conversation, a group or one of its members opens its menu; what is encrypted stays open fifteen minutes by default;
• sharing a photo or a video from its full screen, with a button; if it arrived encrypted, foomms first warns that it will leave in clear.

Download

foomms can be downloaded from foomms.foopgp.org , from Google Play or directly: each version comes with its fingerprint and its detached signature, made by a PGP ID identity. It needs foodjis, installed the same way from foodjis.foopgp.org , and an NFC security key.

To download the sources: foomms-1.2.5.tar.gz.pgp — the archive signed by u4sRyUhEbNU5OwyLEjfSwaXAe_42.17-002.76; your usual PGP tool checks its signature and gives back the archive. foomms is free software, under the GPL version 3.

To spread the word about foomms and foodjis, a leaflet to print, A4 folded in three, in French: flyer_foomms-foodjis_fr_2026-11-09.pdf .