Germ DM

Bluesky built an open social network, then shipped direct messages without end-to-end encryption. Germ DM exists to close that gap. Developed by Germ Inc., the iPhone app plugs into the AT Protocol, the open network underneath Bluesky, and adds the one thing native Bluesky DMs lack: messages that neither Bluesky nor Germ itself can read.

The encryption comes from Messaging Layer Security (MLS), a standard from the IETF. That choice matters more than any single feature. Germ’s security rests on a publicly specified protocol, not a home-grown scheme, which gives outside experts something concrete to examine and gives users a reason to trust the foundation, if not yet the implementation.

Identity is the second defining decision. Germ asks for a Bluesky or AT Protocol handle, never a phone number. Existing AT Protocol connections become the address book, and conversations start from a Bluesky profile badge, a shareable link or a QR code. For anyone who has avoided encrypted messengers because they didn’t want to hand a phone number to strangers, that removes the main objection.

The positioning is narrow and deliberate. Germ isn’t chasing the mass market that WhatsApp and iMessage own. Its audience is Bluesky users, and specifically the slice of them who care where their private conversations live. Coverage from TechCrunch and 404 Media framed the launch as a third-party end-to-end encrypted messenger built into Bluesky. 404 Media also flagged that the app’s security had not been independently audited at the time, and the Bluesky integration still carries an experimental public beta label.

The store rating is 4.6 out of 5 from 19 ratings, a thin sample. The interface is the weak point in the design, and the ease of starting a chat is a clear strength. Nineteen ratings cannot carry a verdict, so the design has to.

• MLS end-to-end encryption: Text and voice messages are encrypted with the IETF’s Messaging Layer Security standard, so neither Germ nor Bluesky can read them.
• Handle-based sign-in: A Bluesky or AT Protocol handle replaces the phone number, and people you’re already connected with are findable from the start.
• Three entry points: Chats open from a Bluesky profile badge, a shareable link or a QR code.
• App Clip onboarding: On iPhone, the recipient lands in the conversation through an App Clip, with no full app download required first.
• Multiple profile cards: Separate cards control what each contact sees, including disposable burner cards for one-off or low-trust contacts.
• Consent-first discovery: Discovery is opt-in only, Germ never suggests people, and contacts can’t pass your details along without permission.
• Contact management: Private nicknames and notes on contacts, plus notification settings for each type of connection.

The Encryption Bet

A small company asking users to trust it with its most sensitive conversations has to borrow credibility, and Germ borrows it from a sensible place. Building on MLS means the hard cryptographic design is shared, documented work, and Germ’s job narrows to implementing it faithfully. That narrows the risk without eliminating it. Implementation is where the remaining danger lives, and that is the part 404 Media reported as independently unaudited at launch.

We treat this as the central caveat in the review. For everyday privacy, keeping DMs out of a platform’s readable storage, the architecture is sound and the claim that neither Germ nor Bluesky can read messages follows directly from the end-to-end model. For journalists, organisers or anyone with a serious threat model, unaudited code is a reason to confirm that a third-party audit has since been published before moving critical conversations over.

Identity Without a Phone Number

A phone number is a persistent, real-world identifier that follows a person across services. A handle can be whatever its owner makes it. Germ’s handle-based sign-in fits the AT Protocol world neatly, because the social graph users already built on Bluesky becomes the contact list without any number-matching.

The trade-off is that a Bluesky handle is itself a public identity, often tied to a posting history. Germ’s answer is the profile card system, and it is the distinctive piece of the design.

Profile Cards and Burner Cards

Most messengers give each user a single face that every contact sees. Germ lets users build several profile cards and choose which one each contact gets. Burner cards extend that into disposable identities: a card for a marketplace buyer, a first date or a one-time source, which can be discarded without touching the main account.

This maps to how people actually segment their lives, and it turns the anonymity on offer into a concrete mechanism. The cost is cognitive load. Multiple cards, per-contact visibility and disposable identities are more concepts than a typical messenger asks users to hold, and that complexity plausibly feeds the interface’s weakness. Power over identity demands clear UI to manage it; Germ hasn’t fully solved that yet.

The Onboarding Loop

Encrypted messengers face a chicken-and-egg problem: a secure channel is worthless if the other person won’t install anything. Germ attacks it from four directions. The profile badge catches people already browsing Bluesky, the link travels through any channel, the QR code handles in-person exchanges, and the App Clip removes the install step entirely for the person on the receiving end.

That last piece is a practical growth decision. The recipient gets a working encrypted chat before committing to a download, which collapses a major point of onboarding friction into a tap. The ease of starting a conversation is a clear strength and the main argument for Germ’s long-term viability. The catch: App Clips are an Apple mechanism, so the frictionless path assumes the recipient is also on iPhone.

Consent as the Default

Social apps usually grow by surfacing people you might know. Germ refuses. Discovery is opt-in only, there are no suggestions, and contacts can’t share your details without permission. For a privacy product, this is the correct stance, and it is consistent with the burner-card philosophy: the user decides who can find them and through which face.

The smaller tools reinforce that philosophy. Per-connection-type notification settings let a burner contact stay quiet while close friends break through. Private nicknames and notes solve a problem the card system creates: remembering who that anonymous handle from last week actually was. These are the features of an app designed for managing many loose, low-trust ties alongside a few close ones.

Where It Falls Short

The feature set is lean: encrypted text and voice messages. That covers the essentials of private conversation, and it leaves Germ competing on principle rather than breadth. The experimental public beta label on the Bluesky integration means the badge entry point, one of the four doors into a chat, sits on less settled ground than the rest of the app. A security product that is still finding its interface and still awaiting outside validation asks for patience from exactly the users most likely to need it.

The UI’s central challenge is conceptual density. Profile cards, burner cards, per-type notifications, nicknames, notes and three entry points add up to more moving parts than a standard chat list. The interface is the weak point, which suggests the visual design hasn’t yet made that complexity feel light. The design priority should be making the active card obvious in every conversation, since sending a message under the wrong identity is the one mistake this model makes easy.

On performance, expectations are modest by design. Text and voice messaging is a light workload, and end-to-end encryption for chats of this kind is light on hardware. App Clips are built to be small and quick to open, which suits a pitch built on getting a stranger into a chat instantly.

• iPhone only: Germ runs on iOS today. Its touch-first design suits the use cases: QR codes are scanned with the camera, voice messages are recorded on the device in hand.
• App Clip dependency: The no-install chat path is an iPhone feature. It is a strength on iOS and a hard limit beyond it.
• Android on the roadmap: An Android version is planned but unreleased, so Android users have no native Germ client yet. For a messenger, that gap matters more than for most apps, because one contact’s platform choice can block the whole conversation.

Germ DM makes the sensible architectural calls: it builds on an open IETF standard instead of inventing its own cryptography, ditches the phone number for an AT Protocol handle, and treats identity as something users shape per contact, with burner cards as a clear expression of that idea. The App Clip onboarding tackles the chicken-and-egg problem that commonly sinks encrypted messengers, and the consent-first discovery model matches the privacy promise instead of undercutting it.

What holds it back is maturity. The implementation lacked an independent audit at launch, the Bluesky integration still carries a beta label, the interface is the weak point, and the whole system lives on iPhone alone. Most of these are gaps of a young product; the interface is a design problem in its own right. We recommend Germ to Bluesky users who want encrypted DMs and understand they are early adopters. Anyone whose safety depends on their messenger should wait for audited code before switching.