FAQ
The honest answers about how Markero protects your messages, what it stores, and what it does not.
Yes. Messages are encrypted in your browser with a PGP keypair before they reach our servers. We store only ciphertext and encrypted key material, not readable messages. A server compromise exposes encrypted data and metadata, not plaintext messages. The threat model explains the limits.
No. Markero only asks for a username and a password. No email address, no phone number — which means no way to link your account to your identity.
No. Markero runs in your browser — create an account and start chatting without installing anything. There's also an Android app if you prefer, with native push notifications.
Two-factor authentication (TOTP) is optional and strongly recommended. You can skip it at signup and enable it later in settings. TOTP protects account sign-in; it does not encrypt or unlock your private key. The private key is protected by your password through a separate key-wrap secret. With 2FA enabled, signing in needs your password plus a code, and recovery codes are a backup if you lose your authenticator.
No. 2FA is optional on every account. It is strongly recommended because it protects sign-in, but you can create an account without it and enable it later in settings. TOTP protects sign-in only; it does not encrypt or unlock your private key.
For clearnet sessions, in part: the session record stores the IP address and user agent, and IP addresses are used for rate limiting. Session records expire after 7 days, or 3 days of inactivity, and edge/application request logs may retain network addresses for up to 14 days. Onion sessions store the string “tor” instead of an IP. We do not use IP addresses for advertising or profiling.
Markero uses PGP with a Curve25519 keypair. Passwords are stored as Argon2id hashes. Your private key is encrypted on your device before it is sent; the server stores only the encrypted private key and encrypted key-wrap secret. Messages are encrypted before they leave your device.
Yes. Markero has a native Android app as well as a browser-based web client. Both use the same end-to-end encryption, and you can sign in on multiple devices.
Markero is zero-access at rest: we store encrypted ciphertext and encrypted key material, not plaintext messages, passwords or private keys. It does not require an email or phone number, and two-factor authentication is optional and strongly recommended. The threat model explains the limits, including a malicious server or compromised device.
Private channels are invite-only, end-to-end encrypted broadcasts. Owners and admins post announcements, followers can read and react with notifications, and the channel cannot be found in search or a public directory. Invite links expire after 24 hours, 7 days or 30 days. Free channels support up to 50 subscribers and 250 MB of channel storage; Premium removes the member cap, raises channel storage to 1 GB and allows up to 5 channels.
Yes. The core messenger is free, including end-to-end encrypted chats, group messaging, private channels, voice calls and file sharing. There are no ads, and private channels are free for up to 50 members with 250 MB of channel storage. Premium is optional (from $4/month, paid in crypto) and removes the channel member cap, raises uploads to 100 MB, personal storage to 1 GB, channel storage to 1 GB, and lets you own up to 5 channels. You can also earn Premium for free by inviting friends.
Markero servers are hosted in the European Union, which means your data is covered by GDPR protections.
Contact support, or create an account and try it.