Sunbird has relaunched its iMessage app for Android users nearly three years after security issues forced the company to pause the service in 2023.
The app is now available on the Google Play Store and allows Android users to access iMessage conversations, including blue-bubble messages and group chats with iPhone users. Sunbird has also combined iMessage with Google Messages, RCS and SMS/MMS in the same application.
The company says the new version has been rebuilt with changes to how messages, Apple ID credentials and media are handled. Sunbird claims messages are encrypted on the Android device before they leave it, protected while travelling through its infrastructure and encrypted at rest using AES-256. It also says Apple ID passwords are used once to establish an iMessage session and then deleted.
The relaunch comes after researchers identified serious security problems in Sunbird's earlier implementation, including the transmission of Apple ID credentials over an unencrypted HTTP connection and access to messages and media stored through Firebase. Those findings led to the removal of Nothing Chats, an iMessage app developed by Nothing using Sunbird's technology, and Sunbird subsequently paused its own service.
Sunbird returns to the Google Play Store
Sunbird Messaging announced on August 5 that its Android application was open to all users through Google Play following an early-access period. The company said more than 181,000 people had signed up before the public launch.
The application is designed to allow Android users to participate in iMessage conversations without owning an iPhone, Mac or another Apple device. Sunbird says users can appear in blue-bubble conversations on iPhones and participate in iMessage group chats through the Android application.
The new app also acts as a unified messaging platform. Instead of limiting the application to iMessage, Sunbird has brought iMessage, Google Messages through RCS and SMS/MMS into one inbox.
The application now includes a Primary and Secondary inbox. Sunbird says the Primary section is intended for important conversations, while less important messages can be placed in Secondary. Users can control how their conversations are organised.
The company has also said it plans to add WhatsApp and Facebook Messenger support later in 2026.
The service is available with a 14-day free trial, after which Sunbird charges $2.99 per month or $24.99 annually.
What happened to Sunbird in 2023
Sunbird's return follows a security incident that brought its earlier service offline in November 2023.
The issue became widely known after Nothing announced Nothing Chats, an Android application that used Sunbird's technology to provide iMessage functionality on the Nothing Phone (2). Users were required to provide their Apple ID credentials to connect the service to iMessage.
Security researchers then examined the application and identified several problems with how the service handled authentication and user data.
One of the issues involved Apple ID credentials being transmitted to Sunbird's servers over HTTP. Because HTTP does not encrypt the connection, the credentials could potentially be intercepted while being transmitted.
Researchers also found that messages and other user data were being sent to and stored through Firebase without encryption. An investigation by 9to5Google found that researchers could use insecurely transmitted JSON Web Tokens to access Sunbird's Firebase database and view messages and files belonging to users.
The exposed information was not limited to text messages.
Researchers reported that the database contained media files including images, videos, PDFs and audio files. More than 630,000 media files were reportedly stored through Sunbird's Firebase infrastructure at the time. Researchers also found vCards containing information such as names, phone numbers and email addresses.
The problem also involved Sentry, an error-monitoring service. Researchers reported that messages and attachments were being sent to Sentry in plaintext, meaning information intended to be part of private conversations could appear in an error-reporting system.
These findings conflicted with Sunbird and Nothing's earlier statements about encryption. The companies had presented the service as providing end-to-end encryption, but researchers found that data could be accessed through the systems supporting the application.
Nothing removed Nothing Chats from the Google Play Store less than 24 hours after its launch. The company said it was delaying the application while working with Sunbird to address the security problems. Sunbird also paused its own service shortly afterward.
Sunbird says the new architecture handles data differently
For the relaunched application, Sunbird says it has changed how messages and authentication information are processed.
According to the company's security documentation, messages are encrypted on the user's phone before they leave the device. The data is then encrypted while travelling through Sunbird's infrastructure and remains encrypted on the user's device using AES-256. Sunbird also says its connections use certificate pinning.
The company says it does not retain copies of users' conversations on its own servers. Instead, message history remains on the sender's and recipient's devices.
Sunbird says messages passing through its infrastructure are released after delivery. It also says photos and videos sent through the service are automatically deleted from its systems, normally within 48 hours and no later than 72 hours.
The handling of Apple ID credentials has also been changed.
Users still need an Apple ID to connect Sunbird to iMessage. However, Sunbird says the Apple ID password is used only once to establish the session and is then destroyed. The company says it does not retain the password or an authentication token that could later be used to sign into the account.
Sunbird also says each user's iMessage connection operates inside its own private environment. According to the company, that environment is destroyed when the user disconnects or deletes their account.
For messages travelling to an iPhone, Sunbird says Apple's existing iMessage end-to-end encryption protects the final part of the communication. The company says it does not modify or weaken Apple's encryption.
These changes address several of the areas that created problems in the previous version. However, they remain claims made by the company and need to be considered separately from what independent researchers have been able to verify.
Company says independent testing found no critical vulnerabilities
Sunbird CEO Danny Mizrahi has said that an independent security firm tested the rebuilt application and found no critical vulnerabilities. The company is using this assessment as part of its security case for the relaunched service.
The distinction between an independent assessment being conducted and its findings being publicly available is important here.
A publicly available audit would allow security researchers and other experts to examine what was tested, which parts of the application were included, what methodology was used and what limitations applied to the assessment.
For now, Sunbird's public security information provides details about the architecture and the company's data-handling practices, but users should still distinguish between those statements and independent verification of the complete system.
That is particularly relevant because Sunbird's previous service also made strong security claims before researchers found problems with the implementation.
The current application may have been rebuilt to address those problems, but continued independent testing would provide a stronger way to determine whether the new security controls work as intended.
Sunbird adds an AI assistant
Security is not the only area Sunbird is changing with the relaunch.
The company is preparing an AI assistant called Sunbird Intelligence, which is expected to arrive later in 2026. Sunbird says the AI will run directly on the user's phone rather than sending conversations to a remote service for processing.
One planned feature, called "Catch Me Up," is designed to summarise conversations that users have missed. The company also plans features that can draft replies and suggest actions based on conversations.
Sunbird says its AI system will eventually be able to perform tasks such as moving conversations between inbox categories, archiving chats and drafting or sending replies.
The planned AI features introduce another privacy consideration because the assistant would need to process the content of users' conversations to provide summaries and generate replies.
Sunbird's decision to run the AI on the device is therefore relevant to its privacy claims. However, the actual privacy protections will depend on how the system is implemented, what information it can access and whether any conversation data leaves the device when the feature is used.
RCS has also changed the reason for using Sunbird
The messaging market has changed since Sunbird's first attempt to bring iMessage to Android.
Apple introduced support for RCS with iOS 18, giving Android-to-iPhone conversations access to features such as higher-quality media, read receipts and typing indicators when RCS is supported.
This reduces some of the practical differences that previously existed between Android and iPhone messaging.
Sunbird is therefore returning to a market where Android users already have a better cross-platform messaging experience than they did in 2023. The main distinction Sunbird offers is continued access to Apple's iMessage system and the blue-bubble experience.
There are also technical differences. Sunbird's iMessage service does not register a user's Android phone number with iMessage. According to MacRumors, users appear to iPhone contacts through their email address when using Sunbird.
This means the company's proposition has changed from simply providing Android users with features that were missing from SMS-based conversations. It is now combining iMessage access with a broader messaging application that brings several services together.
Sunbird now has to prove its security claims
Sunbird's new application contains several changes compared with the service that was paused in 2023.
The company says messages are encrypted on the device and during transmission, Apple ID passwords are used once and destroyed, media is automatically deleted from its infrastructure, and conversations are not permanently stored on its servers.
These changes address some of the security problems researchers identified in the previous implementation.
However, the history of the service makes independent verification particularly important. In 2023, researchers were able to demonstrate that sensitive information could be accessed through Sunbird's infrastructure despite the company's previous claims about encryption.
Sunbird now has another opportunity to establish whether its redesigned architecture can provide the privacy and security protections it promises.
More than 181,000 people signed up during the early-access period, showing that there is still interest in using iMessage from Android. But with RCS now supported on both major mobile platforms and with the security problems of the previous Sunbird implementation still part of the company's history, the new application's long-term success will depend heavily on whether its security controls withstand continued independent testing.
For Sunbird, bringing back the blue bubble is only one part of the challenge. The larger test is whether users can trust the infrastructure carrying their messages this time.
