Notes 
Hardened fork of Signal for Android that adds an encrypted local database, automatic RAM wiping on lock, and Tor/SOCKS proxy support via Orbot. Ships in two variants: one with FCM push and one fully FOSS without Google.
Reviewed by Marco Wollank
Molly
molly.im 4.3 (9)
Rate Molly: No account needed
Threat level
Targeted
A targeted-tier tool. Built for a real, capable adversary. Overkill for everyone below. Threat levels
Our take
Molly is the right choice if you already use Signal and want stronger local security without abandoning your contacts. The encrypted database and RAM wiper meaningfully raise the bar against device-seizure attacks that Signal’s own app leaves unaddressed. The catch is dependency: Molly tracks Signal’s upstream on a two-week lag, so you are always slightly behind, and server compatibility means Signal’s own infrastructure still handles your messages. Android only, no iOS path. For most people Signal is fine; for activists or journalists who worry about physical device compromise, Molly is the better build.
GitHub at a glance
mollyim/mollyim-android AGPL-3.0
Stars
3,808
+13 this week
Forks
224
52 watching
Last commit
4d ago
healthy
Latest release
v8.19.2-4
3mo ago, 100+ total
Star history
Issues
53% closed
339
open
377
closed
+14 / -1
opened / closed, last 4 weeks
Opened vs closed, last 12 weeks
Commits, last 26 weeks
714 commits, active 14 of 26 weeks
368 contributors since Dec 2019
Languages
- Kotlin 67.1%
- Java 32.8%
- C# 0%
Updated daily from the GitHub API. Star tracking since Jun 22, 2026.
Website at a glance
molly.im
D score 30
Weak website security headers
Graded by Mozilla HTTP Observatory, tested 13d ago
Inspect this site yourself
Measures the security configuration of the tool's own website, not the privacy of the product itself. A strong tool can still score low here.
Molly alternatives
Signal Similar look and feel of WhatsApp and other commonly used messaging apps, makes switching easy. Signal requires your phone number as an personal identifier.
Delta Chat Delta Chat doesn't have their own servers but uses the most massive and diverse open messaging system ever: the existing e-mail server network. Chat with anyone if you know…
Brave Talk The person creating the call requires to use Brave Browser, but the participants can join from any browser.
Jitsi Meet Desktop version downloads can be found here .
Stoat Open source, self-hostable Discord alternative, formerly Revolt. Built for communities that want off Discord, but it is not end-to-end encrypted.
iMessage Apple's built-in messenger. End-to-end encrypted between Apple devices.
Molly license, in plain English
AGPL-3.0 Strong copyleft · network
Free to use, even commercially. Changes must be published under the same license, and running a modified version as a network service counts as distributing it.
Permits
- Commercial use
- Modification
- Distribution
- Patent use
- Private use
Requires
- Disclose source
- Network use is distribution
- Same license
- State changes
- License and copyright notice
Does not provide
- Liability cover
- Warranty
Why it matters: The network clause is the point. Anyone who runs a modified version as a hosted service has to publish those changes, so the code handling your data stays inspectable. This is why privacy-first projects reach for AGPL.
Plain-language summary of the project's license, not legal advice. Read the full text for the exact terms.