Molly is an independent, hardened fork of the Signal Android client, published under the AGPL-3.0-only license by the GitHub organisation "mollyim" ("Molly Instant Messenger"), which states it is not affiliated with Signal Messenger LLC or the Signal Foundation. Molly connects to Signal's own servers, so users are subject to Signal's Terms and Privacy Policy: registration by phone number, message content that the server cannot decrypt, and third-party providers used for verification codes. On top of Signal's client Molly adds local hardening documented in its wiki and README -- passphrase-based encryption of data at rest with an Argon2id-derived key, RAM shredding, automatic locking, Tor/SOCKS proxy support, and a Molly-FOSS build with no proprietary Google components that can receive notifications via UnifiedPush through a MollySocket relay. No legal entity is named; funding is visible on a public Open Collective ledger under the fiscal host Open Source Collective and an NLnet NGI0 Commons Fund grant. No security incident involving Molly was found; the project has no published security advisories and no SECURITY.md, and no third-party audit of Molly's own changes was found -- Signal-protocol audits do not cover the fork's additions.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
16 ON FILE
COLLECTION
Molly's README states that Molly connects to Signal's servers so users chat with their Signal contacts, directs users to review Signal's Terms and Privacy Policy before signing up, and states that any phone number capable of receiving SMS or calls can be used during registration -- so the phone-number identifier and server-side data practices are Signal's, not Molly's own.
Signal's Terms and Privacy Policy, effective 2018-05-25 and the policy Molly users are subject to, states that an account is registered with a phone number, that profile name and picture are optional and end-to-end encrypted, that Signal cannot decrypt or otherwise access message or call content, that message history is stored on the user's own devices, and that additional server-side technical information is limited to the minimum required to operate the service.
Because Molly accounts are registered on Signal's servers, Signal's published response to a 2021 federal grand jury subpoena describes the server-side data floor for Molly users as well: the only account and subscriber information Signal stated it could provide was Unix timestamps for account creation and last connection.
The GitHub organisation "mollyim" (display name Molly Instant Messenger) has a GitHub-verified claim to the molly.im domain, publishes a support email (support@molly.im) and a Mastodon account, and hosts 28 public repositories including mollyim-android and mollysocket; the page names no company, association or individuals as owners.
NLnet's project page for "Flatline Server" -- an independent, self-hostable Signal-protocol server prototype whose tasks include modifying the Molly client to support server selection -- lists the project as run by MollyIM, with molly.im as the project website, funded through the NGI0 Commons Fund (European Commission Next Generation Internet grant agreement 101135429) starting 2025-06.
Molly's Open Collective page publishes its finances under the fiscal host Open Source Collective: as fetched it showed total raised USD 68,759.55, total disbursed USD 26,076.44 and an estimated annual budget of USD 12,354.97; top contributors listed were the Monero Community Crowdfunding System (USD 31,790.83 since June 2024), Louis Rossmann (USD 12,000 since September 2023), Good Ancestor (USD 5,000 since March 2024) and The Monero Project (USD 4,210.62 since October 2024); the team is listed as two admins, "Dino" and "valldrac". The page describes Molly as started in 2019 as a contribution to Signal to support password encryption.
Molly's LEGAL.md states the app is free software licensed AGPL-3.0-only, attributes newly authored files to "Molly Instant Messenger", and declares that Molly is an independent project not affiliated with, endorsed by, or sponsored by Signal Messenger, LLC or the Signal Foundation; no legal entity, jurisdiction or registration for the Molly project is named.
The Molly project wiki on GitHub attributes its pages to an individual named Oscar Mira, the only personal name attached to the project on any page fetched; the wiki itself is small (four pages: Home, Changelog, Data Encryption At Rest, Migrating From Signal).
Molly's optional UnifiedPush notifications require linking the account to a MollySocket server; the MollySocket README describes it as working like a linked device without an encryption key that holds a persistent connection to the Signal server and, on each encrypted event, notifies the phone through a UnifiedPush push server. Molly's README advises running MollySocket on a server the user controls but allows a public instance -- so, if a public relay is chosen, a third party observes message-arrival events for that account, though not content.
Signal's Terms and Privacy Policy, which governs Molly accounts, states that Signal does not sell, rent or monetize personal data or content, discloses third-party providers that send verification codes to the user's phone number at registration, and lists disclosure to meet applicable law, regulation, legal process or enforceable governmental request; it describes no advertising, analytics or data-partner sharing.
Molly publishes a reproducible-builds guide so anyone can compile a release in Docker and diff it against the officially distributed APK to confirm the source matches the binary, with a CI "Reproducible build" check badge in the README -- a verifiability artifact, though not an independent audit.
Molly's README commits to syncing upstream Signal features and fixes every two weeks and applying security patches as soon as they are available; the fork's users nonetheless depend on the Molly maintainers, not Signal, to ship those patches, and Signal's protocol audits and formal verification do not cover Molly's added code.
The mollyim-android repository's GitHub security advisories page shows no published security advisories, and the adjacent security policy page states the project has not set up a SECURITY.md file; no breach, regulatory action, or third-party audit of Molly's own code changes was found in this research, so the pillar rests on a clean record without a formal audit artifact.
Privacy Guides lists Molly on its real-time communication page as an alternative Android client for the Signal network, under Signal, citing passphrase encryption of the local database at rest, secure shredding of unused RAM data, Tor routing, and reproducible builds; the same listing cautions that Molly users are trusting both the Signal team and the Molly team to deliver safe and timely updates.
Molly's homepage advertises the fork's client-side hardening: a fully FOSS build that contains no proprietary blobs (unlike Signal), passphrase encryption of the database, an ungoogled UnifiedPush notification system, RAM shredding of sensitive data, automatic locking, and SOCKS proxy / Tor support via Orbot; the README's comparison table shows the regular Molly build and Signal both still use Google FCM for push and Google Maps for location sharing, while Molly-FOSS uses WebSocket/UnifiedPush and OpenStreetMap.
Molly's Data Encryption At Rest wiki page (edited 2021-09-19) states that, unlike Signal, Molly encrypts Android Shared Preferences with a key protected by the user's passphrase run through Argon2id with a random salt, entangled with a hardware-backed KeyStore MAC key where available so brute-force attempts must run on the device, and that the encryption key is wiped from memory as soon as the app is locked.