DresSecureComms is a free, open source, deGoogled secure communications app. It brings private messaging, calling, contacts, threat scanning, and location protection together in one place, with no Google services, no Firebase, no analytics, and no trackers. Messaging and calls work fully offline on your normal carrier line.
It is a core part of DresOS, the Android defensive security system. Within DresOS, DresSecureComms takes over much of the day to day protection of the device, replacing several separate tools with a single hardened app so that messaging, calling, contacts, and on device safety checks all run through one place you can trust.
- Messages. A private SMS client. Send and receive normal texts, or switch on encryption for a message. Encrypted messages are readable only by another person who runs this app and shares the same key, and keys are set per contact so every person can have their own code. Starting a new message suggests your contacts as you type. Set it as your default SMS app so texts arrive inside it, and delete whole conversations when you want them gone.
- Calls. Dial a number or call a saved contact over your carrier line. As your default phone app it shows its own in-call screen with mute, speaker, keypad, hold, add call, and hang up, and the screen turns off when you hold the phone to your ear. It keeps a searchable call history you can clear per call or all at once, and you can block or unblock any number straight from the log.
- Spam Shield. Set as your caller ID and spam app, it screens incoming calls before the phone rings. Premium rate numbers are rejected, short codes are silenced, and callers faking the first digits of your own number are flagged. You can also silence anyone not in your contacts, or reject withheld numbers. Saved contacts always ring through, and everything it blocks is listed in Settings so you can undo it. It runs entirely on the device, so no number is ever sent anywhere to be checked.
- Contacts. An encrypted on device contacts vault. Add and edit contacts with a name, number, and email, or import from the device. Nothing leaves the phone.
- Threat Scan. Check a link against VirusTotal and get a clear safe, suspicious, or dangerous verdict before you open it.
- File Scan. Check a single file, or every app on your device, against VirusTotal. The file never leaves the phone. Only its SHA-256 fingerprint is sent, and that comes back checked against seventy or more antivirus engines at once. A free API key allows four lookups a minute, so a full sweep of your apps paces itself and can be stopped at any point. Offline signature scanning is what the next version adds.
- Metadata Wipe. Strip GPS and other hidden EXIF data from a photo before you share it.
- Geo Spoofer. Set a mock GPS location, or have the app pick a random one, to keep your real location private from apps that read it.
- App Lock. Lock the app behind your fingerprint or device PIN.
- Block Screenshots. An optional setting that stops screenshots, screen recording, and recents previews everywhere in the app.
Message encryption is symmetric AES-256-GCM. The key is a passphrase you agree, by hand, with the person you are talking to, in person or over another channel. Never send a key by plain text. Keys are set per contact from the conversation menu, so each person can have their own code; the shared key in Settings still covers anyone you have not set one for, and messages encrypted with it still open. There is no account and no key server. Encrypted messages carry a short marker so the app knows to decode them; to anyone else, including your carrier, they are unreadable text. Calls over the carrier line are ordinary phone calls and are not end to end encrypted, and the app says so plainly.
Contacts and the sent message log are encrypted at rest using a key held in the Android Keystore, so they stay protected on the device.
Per contact keys landed in 1.8.0. The next step is widening encryption beyond messages and the contact vault to more of the app.
Because the app is installed outside the Play Store, Android first puts SMS and phone access behind Restricted settings. Allow it once:
- Open Settings, then Apps, then DresSecureComms.
- Tap the three dot menu in the top right.
- Tap Allow restricted settings.
Then, inside the app, open Settings and Default apps and choose to set it as your default SMS app, your default phone app, and your caller ID and spam app. Setting it as the default SMS app is what lets it receive, show, and delete your text messages.
For the geo spoofer, turn on Developer options, open Select mock location app, and pick DresSecureComms.
Also you may experience some issues with SMS and Calling due to the encryption and security unless you make it your default app
- RECEIVE_SMS, READ_SMS, SEND_SMS, RECEIVE_MMS, RECEIVE_WAP_PUSH — to act as the default SMS app: receive, read, send, and manage your texts.
- CALL_PHONE, READ_PHONE_STATE, MANAGE_OWN_CALLS, ANSWER_PHONE_CALLS — to place and handle calls as the default phone app.
- READ_CALL_LOG, WRITE_CALL_LOG — to show your call history and let you delete it.
- READ_CONTACTS — optional, only to import contacts into the encrypted vault.
- ACCESS_FINE_LOCATION, ACCESS_MOCK_LOCATION — for the geo spoofer. Mock location is a no-op permission that only makes the app selectable in Developer options.
- USE_BIOMETRIC — for the app lock.
- POST_NOTIFICATIONS — to show message and call notifications.
- INTERNET — used only by Threat Scan and File Scan to reach VirusTotal. Nothing else goes online, and File Scan sends a fingerprint, never a file.
No accounts. No analytics. No advertising. No Google or third-party services beyond the VirusTotal lookup you trigger yourself in Threat Scan. Your messages, contacts, and call history stay on your device.
Apache-2.0. Copyright © 2026 The DresOS Foundation.
DresSecureComms requires SMS, Phone, and Location permissions to act as your secure, offline default Dialer and SMS app. We do not collect data. Read our full Privacy Policy. All Virus Checks Passed
Help fund future development. DresOS is built by a small open source team in our spare time. If our guide, Magisk modules or app saved you a weekend of research, please tip the jar. Funds go to test devices, dev stations, and developer time on updates and future projects.
A huge thank you to Fossify. We used Fossify Messages, Fossify Phone and Fossify Contacts as references while building this app, and without them the MMS robustness and several other quality of life improvements would not have been possible.
A huge thank you must also go to Fake Traveler. Our mock location components are built on references from their application.
A huge thank you must also go to URL Check, As we used their scan part that connects to VirusTotal and built our URL scan engine up from that.
A huge thank you must also go to Hypatia. Hypatia is the on device scanner our File Scan is set to replace inside DresOS, and it set the bar for what a scanner on a de Googled phone should do. Version one of our engine checks fingerprints against VirusTotal; the offline signature scanning Hypatia does so well is what version two brings.