Messenger Guide
Morana Messenger is an end-to-end encrypted messenger that runs over an encrypted relay swarm. This guide takes you from install to your first message.
Public
tmortestnet, invited / controlled access. This is foundation-operated and not yet an open,audited, anonymous network — do not rely on it for high-risk communication yet.
Two identities
Morana does not put you in one account with privacy switches. It gives you two independent identities, and you switch between them with the profile chip in the top bar:
- Morana — your full identity. Messages, contacts, groups, calls, channels, wallet, MORID, relay and staking. It can route either normally or onion-only, as you choose.
- Shadow — a deliberately narrow identity for when nothing should point back at you. It does messages, contacts and groups and nothing else.
Shadow is a separate identity, not a mode. It has its own independent 24-word recovery phrase, generated in its own ceremony and unrelated to your Morana phrase. You can create a Shadow without ever creating a Morana identity.
What Shadow deliberately does not do:
| Capability | Morana | Shadow |
|---|---|---|
| Messages, contacts, groups | yes | yes |
| Calls | yes | no — a direct WebRTC call would expose its IP |
| Channels | yes | no |
| Wallet, MORID name, relay, staking | yes | no — it holds no wallet key, so there is nothing to pay from, register with, or stake |
| Routing | standard or onion-only | onion-only, always |
Shadow still has an address, and you can write to it. This row said "local-only, messaging-only" until 2026-08-09, which read as nobody can reach a Shadow — the opposite of the point. Both identities carry a mori1… contact address; the suite byte is what differs (0x01 Morana, 0x02 Shadow), and the same three prefixes serve both — mori, tmori, rmori. So you reach either one the same way: paste the address. What a Shadow has no key for is the wallet, and the code refuses rather than improvises — asking for a payment address or a wallet binding on a Shadow suite returns GhostHasNoWallet instead of quietly minting one. "No MORID" in the table means no registered name; it never meant no address.
A registered name is perpetual. There is no renewal, no rent, no lease and no expiry — the renew action was removed from consensus outright rather than left switched off, and registration is the only identity action the parser now accepts. A name can also be handed over or sold: transfer and sale are the same state change to the chain, and the price, if any, is paid between the two of you, not enforced by the network. And because messages are addressed by that mori1… string, a name is a convenience on top of it, never the thing that makes you reachable.
Shadow is fail-closed: it never falls back to a direct route. If no onion route is available, the message is not sent rather than leaked. That is intended behaviour, not a fault.