Get started

Download Ghost Protocol

Android · v0.1.380.0 · AGPL-3.0-or-later · Now on Google Play

Which install path is right for me?

If you are…Install from
Anyone who wants to install todayGoogle Play
You want the easiest, auto-updating installGoogle Play
Privacy-aware, avoiding Google servicesF-Droid (coming soon)
In a country where Google Play is blockedDirect APK (with our open-source release)
A developer building from sourceOpen-source release (planned)
Option 1 — Coming with our open-source release

Direct APK download

A source-verifiable APK — no Google account, no Play Store — that you download and check against our public signature before installing. This path returns when we publish our open-source code. Until then, install from Google Play.

Install from Google Play
Source-verifiable direct downloads (SHA-256 + Sigstore) arrive with our open-source release. The verification steps below show how that will work.

Verify the download (recommended)

Before installing, verify the APK matches exactly what we built and signed. This catches any tampering between our server and your device.

Linux / macOS

# Verify SHA-256 hash
sha256sum -c apk-sha256.txt

# Verify Sigstore attestation
cosign verify-blob \
  --bundle ghost-release.apk.sigstore.json \
  --certificate-identity-regexp \
    'https://github.com/bayramcsb/ghost-protocol/.github/workflows/release-sign.yml@.+' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghost-release.apk

Windows (PowerShell)

$expected = (Get-Content .\apk-sha256.txt -First 1).Split(' ')[0]
$actual   = (Get-FileHash .\ghost-release.apk -Algorithm SHA256).Hash.ToLower()
if ($expected -eq $actual) { "OK — hash matches" } else { "FAIL — do not install" }
If either check fails, do not install the APK. Re-download or contact us at the email in security.txt.

Install on your phone

  1. Transfer the .apk to your phone (USB, or download directly via Tor Browser on the phone).
  2. Open the file from your phone's Files app.
  3. Android asks "Allow this source to install apps?" — tap Settings, enable the toggle, go back, tap Install.

Samsung, Xiaomi, Huawei users may need to disable an extra restriction first:

  • Samsung: Settings → Biometrics and security → Install unknown apps
  • Xiaomi (MIUI/HyperOS): Settings → Privacy protection → Special permissions → Install unknown apps
  • Huawei: Settings → Apps → Permissions → Install unknown apps
Option 2

F-Droid

F-Droid is an open-source app store that builds apps from source code on its own infrastructure. No Firebase, no Google services. Push notifications use UnifiedPush — we recommend Ntfy as the distributor.

Submission to F-Droid is in progress. Until the listing is approved, use the Direct APK path above. Once listed, install via: F-Droid app → search "Ghost Protocol" → Install.
Option 3 — Available now

Google Play

The simplest way to install today — same source code, end-to-end encrypted, no phone number required. Auto-updates via the Play Store.

Get it on Google Play
Note: the Play build includes Firebase Cloud Messaging. The push payload is a wake signal only — no message content reaches Google — but Google sees that your device received a wake-up. If that is in your threat model, use F-Droid or the direct APK once available.

After installing

  1. Write down your 24-word recovery phrase when the app shows it during onboarding. Store it offline and offline only. We cannot recover your identity for you — that is the whole point.
  2. Verify your contacts' safety phrase in person or over a previously trusted channel before sending anything sensitive. Ghost Protocol's 8-word safety face is in Contact Details.
  3. Consider Strict Tor (Settings → Network). Slower cold-start but Cloudflare is removed from the path entirely.
  4. Install Ntfy for push notifications if you chose the F-Droid or Direct APK build. Open Ntfy → settings → set as UnifiedPush distributor.