Mold — Can't kill it.

001 / Why Mold

They block one domain.
Ten more appear.

Like mold, it spreads through spores, grows on any surface, and cannot be eradicated. The more you fight it, the more it spreads. Mold is messaging infrastructure built on the same principle.

E2E

End-to-end encrypted

Noise Protocol XX + ChaCha20-Poly1305. The server stores only encrypted blobs. Not even we can read your messages.

DGA

Domain Generation Algorithm

New domain every day. Block one — the client already knows tomorrow's address. Like spores: cut one, a hundred emerge.

DPI

Invisible to deep packet inspection

uTLS makes traffic indistinguishable from Chrome visiting a regular website. Cloudflare front masks the destination. DPI sees nothing.

No phone number

Cryptographic identity. Your account is a key pair, not a phone number. No SIM, no tracking, no identity leak.

Mold was here before us.
It will be here after.
It survives radiation, vacuum, acid.
It cannot be destroyed.

Spores spread ↔ DGA — new domains daily Kill here, grows there ↔ Block a domain — another appears Grows on anything ↔ Any OS, any network, any device Invisible underground ↔ Traffic looks like regular HTTPS No center ↔ No single point of failure Fight it — it spreads ↔ Block it — more users come

002 / Features

Built to survive.

Noise Protocol XX

Same cryptographic framework as WireGuard and WhatsApp. Forward secrecy built in. Zero trust in the server.

Domain rotation

SHA-256 seeded by date generates a new domain every 24 hours. Client and server always in sync. Censors always behind.

Cloudflare shield

All traffic routes through Cloudflare. The real server IP is never exposed. Blocking means blocking Cloudflare — and half the internet.

Cover website

A reverse proxy makes the domain look like a regular website. Active probing sees a tomato shop. Only authenticated clients see the messenger.

Chrome fingerprint

uTLS spoofs the TLS handshake. Traffic is byte-identical to Chrome browsing the web. DPI cannot distinguish Mold from YouTube.

Seed recovery

12-word seed phrase. Your identity is a key pair stored only on your device. Lose the phone — restore from words. No server involved.

003 / How it works

Three minutes to freedom.

Download & install

Get the APK from Telegram bot, GitHub, or a friend's link. No app store, no tracking, no account required to download.

Key generated instantly

Open the app. Your cryptographic identity is created in under a second. No phone number, no email, no personal data. Write down your 12-word recovery phrase.

Add contacts by QR

Scan a friend's QR code, share an invite link, or exchange a 6-digit code. No contact list uploaded. No server knows who you talk to.

Talk freely

End-to-end encrypted from the first message. Your traffic looks like Chrome visiting a website. Nobody can read, block, or trace your conversation.

004 / Comparison

How Mold compares.

	Mold	Signal	Telegram
E2E encryption	All messages	All messages	Secret chats only
Phone number required	No	Yes	Yes
Anti-censorship	DGA + Cloudflare + uTLS	Domain fronting (limited)	MTProto proxy
DPI resistance	Chrome fingerprint	Partial	Detectable
Blocked in Russia	Cannot be blocked	Blocked	Under pressure
Open source	AGPL-3.0	GPL-3.0	Client only
Infrastructure cost	$5-7/mo	$50M+/year	$$$

005 / Download

Spread the spores.

Available for Android and Web. No sign-up walls. No tracking. Get Mold, share it with someone who needs to speak freely.

Android APK Web Client Source Code

Open source · AGPL-3.0 · No tracking · No analytics

Mold.

They block one domain. Ten more appear.