Sunbird iMessage for Android Is Back on the Play Store: Should You Trust It?

What Is Sunbird, and Why Did It Shut Down in 2023?

Sunbird is an Android messaging app that routes iMessage conversations through a connection to Apple’s servers, making your Android device appear to Apple’s network as a registered Mac or authorized hardware node. The app allows Android users to send “blue bubble” messages to iPhone users instead of the standard green bubbles, and it incorporates iMessage, RCS, and SMS/MMS messages in one app.

Sunbird shut down completely in November 2023 after security researchers discovered the app was sending Apple ID credentials over unencrypted HTTP and storing message contents, attachments, and contact data in plaintext, despite marketing that promised full end-to-end encryption. The exposure was substantial: researchers found that Nothing’s “Nothing Chats,” which was powered by Sunbird, was leaking data as messages tunneled back and forth, with over 630,000 files accessible through the vulnerability. This matters because a compromised Apple ID credential gives an attacker access not only to your iMessages but potentially to iCloud, App Store purchases, and Apple Pay, depending on what two-factor authentication protections are in place.

The issue proved particularly damaging for smartphone maker Nothing, which had built its “Nothing Chats” feature on Sunbird’s underlying technology and faced its own backlash over the flaw. The Nothing Chats app launched to Google Play in beta and was so insecure that it was pulled within 24 hours by Nothing, only to never be mentioned again. Sunbird returned in an invite-only private beta in April 2024 but remained unavailable to the general public until the August 2026 relaunch.

What Changed in the Rebuilt App’s Security Architecture?

Sunbird’s core security claims for the 2026 version represent a meaningful shift in architecture from what existed in 2023. Messages are encrypted on the phone before they leave it, in transit over certificate-pinned connections, and at rest on the device with AES-256. Media gets a hard expiration: automatically deleted, typically within 48 hours and never longer than 72 hours. On the final leg to an iPhone, the message is protected by Apple’s own iMessage end-to-end encryption, which Sunbird says it never modifies, intercepts, or weakens.

The Apple ID credential question, which was the direct cause of the 2023 breach, is also addressed differently in the rebuilt app. When a user connects iMessage, the Apple ID password is used once to set up the session and then destroyed. Sunbird states it does not store the password and does not keep an authentication token that would allow it to sign in as the user later. The ongoing session is instead managed by Apple’s own Messages software, in the same way it works on a personal Mac.

That said, an important limitation applies here. The company relaunched in beta in April 2024, this time describing a setup where messages are encrypted at the application layer with AES and a key that only lives on the client side. That is a real architectural change from what existed in 2023, but it is also the kind of claim that deserves scrutiny rather than a straight repeat of the company’s own language, especially from a company that insisted its 2023 setup was already secure right up until it was not.

Has an Independent Security Audit Actually Been Published?

An independent security firm audited the rebuilt app, according to Sunbird’s CEO, but the full audit report has not been made publicly available as of August 7, 2026. CEO Danny Mizrahi says an independent security audit found no critical vulnerabilities in the rebuilt app, and Apple ID passwords are now destroyed immediately after session setup. Specifically, Mizrahi told Android Authority that an independent security auditing firm tested its rebuilt Sunbird app in a bid to replicate findings from the 2023 security report.

The practical significance of this gap is meaningful. A company claiming a clean audit result is different from a company publishing the audit report, naming the auditing firm, and allowing independent researchers to verify the methodology. Whether Sunbird has fixed the issues that got it shut down before is something only time, and probably another security audit from outside the company, will really confirm. Users who are considering the app today are being asked to rely on Sunbird’s self-reported security claims, which is the same position users were in during the 2023 launch that ended in a breach.

The practical response, for most readers, is to monitor whether independent security researchers publish their own assessments of the 2026 version before connecting a primary Apple ID to the service. Attention going forward is likely to center on whether independent security researchers verify Sunbird’s renewed data-handling claims, given the app’s history, and on how Apple responds to the app’s relaunch given its ongoing antitrust exposure around iMessage.

Does Sunbird Still Make Sense Now That Apple Supports RCS?

The most substantive change in the landscape since Sunbird’s 2023 shutdown is Apple’s adoption of the RCS (Rich Communications Service) protocol in 2024. While Apple adopted the RCS protocol in 2024, bringing typing indicators, read receipts, and high-resolution media sharing between iPhone and Android devices, the text bubbles for Android users still show up as green on iPhones. That distinction defines Sunbird’s remaining value proposition: the app turns those green bubbles blue, which provides full iMessage group-chat features including reactions and replies that still do not function seamlessly in standard RCS.

When Sunbird originally launched, it promised features Android users did not have, like typing indicators, read receipts, and higher-quality media. Those features are now available for Android-to-iPhone chats because Apple adopted RCS, so Sunbird is mostly offering a different bubble color. There is one additional functional distinction worth noting: iMessage through Sunbird does not register a phone number, and users will appear to their contacts by email address. This is a meaningful usability trade-off for anyone whose contacts expect to reach them by phone number.

Sunbird’s CEO framed the use case around group chat functionality rather than bubble color alone. CEO Danny Mizrahi framed the relaunch around the group-chat problem: “Blue bubbles are just the surface. The real problem is that an Android user in a group chat still breaks it for everyone: reactions, replies, high quality video, and group management often just do not work.” Whether that gap is large enough to justify a paid subscription and the security risk of handing over Apple ID credentials is a judgment each user should make based on how much of their communication runs through Apple group chats.

What Are Sunbird’s Features and Pricing Right Now?

Sunbird plans to roll out “Sunbird Intelligence” AI features in Q3 2026, including a “Catch Me Up” tool that summarizes missed messages across conversations, and WhatsApp and Facebook Messenger integration is also planned for the same quarter. Sunbird says these AI features process entirely on your device rather than sending anything to a server, though that claim, like the broader security architecture, has not been independently verified as of this writing. Confirm current pricing at the Sunbird official website before subscribing, as plan terms may change.

What Is the Concrete Security Risk of Using Sunbird Today?

The primary risk of using Sunbird is that the app requires you to connect your Apple ID to a third-party service that does not yet have a published independent security audit. The mechanism that creates this risk is structural: Sunbird must authenticate with Apple’s servers on your behalf, which inherently requires access to your Apple credentials at some point in the session setup process. This is done by connecting an Android device to a remote server that registers it with an Apple ID, and Apple’s network typically authenticates the ID as a Mac or authorized hardware node.

The severity of this risk depends on what your Apple ID is connected to. For most US users, an Apple ID is linked to iCloud storage, iCloud Photos, iMessage history, FaceTime, App Store purchase history, and in many cases Apple Pay. If Sunbird’s backend were ever compromised in the way its 2023 architecture was, an attacker with session access could potentially interact with all of those services. The original app was sending a user’s Apple ID credentials to a Sunbird server to function, with the information sent unencrypted over HTTP. An attacker could intercept all Sunbird messages and media attachments, and Sunbird employees had access to a platform that stored all message content. Sunbird’s 2026 architecture is described as fundamentally different, but independent confirmation remains outstanding.

For users who want to reduce risk while the audit situation is unresolved, the most sensible approach is to use a secondary Apple ID account, if you have one, rather than your primary account. Stop and do not proceed with setup if you use your primary Apple ID for sensitive communications, iCloud financial documents, or healthcare data. Users with significant concern about the underlying trust model should wait until independent security researchers publish a technical review of the 2026 version before installing.

How Do You Install and Set Up Sunbird on Android?

Before beginning setup, read the full security context above. Handing any third-party app your Apple ID credentials carries real risk, and you should make an informed decision before proceeding. If you choose to continue, follow these steps:

1. Open the Google Play Store on your Android device and search for “Sunbird Messaging,” or go directly to the app’s Google Play listing.
2. Tap Install and wait for the download to complete.
3. Open Sunbird and tap Get Started. The app will prompt you to create a Sunbird account with an email address.
4. Enter your Apple ID email address and password when prompted. Per Sunbird’s stated architecture, the password is used once to establish the session and is then destroyed by Sunbird’s servers.
5. Complete any two-factor authentication challenge that Apple sends to your trusted device. This step is standard for any new device registration with Apple.
6. Allow the 14-day free trial to begin. A payment method is required upfront. Set a calendar reminder before the trial ends if you want to evaluate before being charged $2.99 for the first month.
7. Configure the Priority Inbox tabs to separate your primary conversations from automated messages and unknown senders.

Stop here and contact Apple Support immediately if you notice unfamiliar Apple ID sign-in alerts after setup, unexpected iCloud activity, or purchases you did not make. These could indicate that your credential session has been accessed beyond what the app is supposed to use.

Who Is This App Actually For in 2026?

Sunbird’s practical audience in 2026 is narrower than it was in 2022, because Apple’s adoption of RCS resolved the most functional Android-to-iPhone messaging gaps. Interoperability was a huge problem in 2023, before Apple adopted the RCS protocol in 2024. Nowadays, Apple users texting with an Android user will see typing indicators, read receipts, and high-resolution media. The users most likely to find Sunbird worthwhile are those embedded in iMessage group chats where full iMessage feature parity, including reactions synchronized across participants and seamless group management, still does not work correctly over RCS.

For early adopters comfortable with the current audit gap, the 14-day free trial is a low-cost way to evaluate whether the group-chat experience actually improves in their specific contact network. For users who are security-conscious or who use their Apple ID for sensitive personal data, the practical recommendation is to wait for an independently published security assessment of the rebuilt app before installing.

The broader AI landscape is also relevant context here. As AI-driven messaging tools expand across platforms, the question of which third-party services you trust with credential access will become increasingly important. For more on how AI is being integrated into communication and productivity tools, see our coverage of ChatGPT’s bank account connections and Google’s Gemini expansion into K-12 education, both of which raise similar questions about data trust and third-party access. You may also want to review Android’s evolving sideloading and developer verification rules and our guide on spotting fake or scam apps on the Play Store before downloading any new messaging service. For context on how Android security patches are evolving in parallel, see our breakdown of the August 2026 Android Security Update.

FAQ

Is Sunbird safe to use in 2026?

Sunbird’s 2026 architecture is a genuine improvement over the version that failed in 2023, with AES-256 on-device encryption and a claimed one-time-use Apple ID password policy. That said, the company’s self-reported claims about its rebuilt security architecture have not been independently confirmed by a published audit as of August 7, 2026, which means users are still being asked to extend trust based on the company’s own statements. The most cautious approach is to wait for independent researchers to assess the rebuilt app before connecting a primary Apple ID.

Does Sunbird work now that Apple supports RCS?

Sunbird still functions as an iMessage client for Android, and its core differentiation from standard RCS is that messages appear to iPhone recipients as blue bubbles, with full iMessage features including reactions, replies, and group chat management. Those features are now available for Android-to-iPhone chats because Apple has adopted RCS, so Sunbird is mostly offering a different bubble color for one-to-one conversations, though the full group-chat parity argument remains more substantive.

How much does Sunbird cost?

Android users can try the app free for 14 days, and a subscription is priced at $2.99 per month or $24.99 per year. A payment method is required to start the free trial. Confirm current pricing on the Sunbird pricing page, as subscription terms may change after the public launch period.

What happened to Nothing Chats, and is it related to Sunbird?

Sunbird partnered with Nothing back in 2023 to bring iMessage to Android through an app called Nothing Chats. The app launched to Google Play in beta and was so insecure that it was pulled within 24 hours by Nothing, only to never be mentioned again. Nothing Chats was built directly on Sunbird’s backend, so the security failures were the same. Sunbird is now relaunching independently, without a Nothing partnership.

Will Sunbird appear to my contacts as my phone number or my email address?

iMessage through Sunbird does not register a phone number, and users will appear to their contacts by email address. This means that if your iPhone contacts have saved you by phone number, they may see messages from your Sunbird account arriving from an unfamiliar email address rather than your existing contact card, which can cause confusion in existing conversations.