MegaGlass

Open-source MEGA cloud client for Android.
End-to-end encrypted, fast and private. No ads, no third-party trackers, no Google Play Services.

About

MegaGlass is an unofficial client for MEGA cloud storage on Android 15 and later. It uses the official MEGA SDK (C++, BSD-2) for encryption and transfers, and Jetpack Compose with Material 3 Expressive for the interface. Chat and calls are not included.

Features

• Cloud drive: browse, search, sort, label, move, copy and rename files and folders.
• Fast transfers: 8 parallel connections in each direction and larger requests on devices with more RAM.
• Photos: timeline, albums and camera uploads.
• Sync and offline: two-way folder sync, and files that stay available without a network.
• Sharing: shared folders, public links and contacts. Open MEGA links in the app.
• Viewers: images, video, audio and text, with a text editor.
• App lock: passcode lock and screenshot blocking.
• Themes: light, dark, pure black and dynamic colour.

Security

• All-files access is optional. MegaGlass asks for it before a download to Download/MegaGlass, a folder upload or a two-way sync, because the MEGA SDK uses real file paths for these. With this access, the app and its native SDK can read and change all files in shared storage, not only the folders that you select. Without it, downloads go to the app's own folder, and folder upload and sync are not available. Single files upload without it. The app does not sync through the Android folder picker (SAF): that path is not tested, and a two-way sync deletes a file that it does not see from the cloud.
• Storage servers: no certificate check. This is MEGA SDK design. The SDK pins the keys of the MEGA API servers, but it does not check the TLS certificate of the storage and thumbnail servers, because the files are encrypted end to end. An attacker on your network (for example a hostile Wi-Fi) cannot read your files, but can change data on the way. A full download checks the file MAC and fails. Streamed video and audio, thumbnails and previews have no MAC check. A changed upload can give a cloud file that fails its check at a later download. MegaGlass accepts this risk. Use a network that you trust for important uploads.
• Local stream server. Video and audio play through an HTTP server of the MEGA SDK on 127.0.0.1, on a random port, while a file is open in the player (also when paused). It serves only the files that the app opens. It sends no CORS header, so a web page cannot read a stream. The stream path has no secret: another app on the phone that finds the port and knows the node handle can read the file that is open. MegaGlass accepts this risk.

Privacy

• No ads, no third-party analytics, no Google Play Services. The app connects only to MEGA.
• At each login, the MEGA SDK sends a device ID. By default, this is a hash of the Android ID, which stays the same after a reinstall. MegaGlass gives the SDK a random ID in its place. The ID stays until you log out, and the next login gets a new ID, so Device Centre shows each login as a new device. After an update from 0.2.3 or earlier, the current session also gets a new ID once: its syncs and camera uploads can show under a new device.
• No diagnostic events or error reports go to MEGA. By default, the MEGA SDK sends them, with no setting to turn them off, and some contain file fingerprints and MACs. A local patch stops them. The SDK also does not keep the journey ID that the server can send, so the API requests do not include it. New files and folders go without the analytics tag that tells MEGA how the operation started (upload, import or copy).
• The user agent is MegaGlass/<version> (Android) (Android) MegaClient/<SDK version>/64, the same on every device. It has no device model, OS version, kernel release or CPU architecture.
• Files are encrypted on the device before upload.
• The session is encrypted with a key in the Android Keystore and is not included in backups.
• Thumbnails, previews and offline files stay in app-private storage.
• Copies of files that you open with other apps stay in the app cache, up to a size limit, until you use Clear cache or log out.
• The app passcode is stored only as a salted PBKDF2 hash.
• The app lock is a screen lock. It does not encrypt the session or local files.

Download

Get the APK from Releases. MegaGlass is alpha software. Keep a copy of important files.

Before you install, check the signing certificate. Its SHA-256 fingerprint is:

84c7ed6935e18d6e6aebc6e3c490e3aa5468974ee856baf1df979bda3c7b5241

Compare it with the output of apksigner verify --print-certs <file>.apk, or use AppVerifier. Do not install an APK with a different certificate.

Build

Requirements: Android SDK with platform 37 and NDK 28, JDK 21, Homebrew packages cmake ninja swig autoconf automake autoconf-archive libtool pkg-config.

scripts/bootstrap-sdk.sh      # fetches MEGA SDK v10.21.0 and vcpkg, applies patches/
scripts/build-sdk.sh          # builds libmega.so (arm64-v8a) and the Java bindings into :sdk
./gradlew :app:assembleDebug  # or assembleRelease after scripts/make-release-key.sh

The first SDK build compiles all native dependencies with vcpkg and takes a while. Later builds use them again. build-sdk.sh resets Vendor/mega-sdk to the pinned commit and applies patches/ again, so it removes all other changes there: put SDK changes in a patch. It stops if Vendor/vcpkg has local changes.

The release APK is about 32 MB (estimate); libmega.so is about 25 MB of it.

A release build stops if the git tree has changes that are not committed, because the APK records the commit that it was built from. Commit (and tag) the version change first.

Native SDK changes

• patches/mega-sdk-android-request-size.patch: the SDK limits each transfer request to 2 MB on Android. The patch scales the limit with device RAM (up to 16 MB, the desktop value). This decreases the overhead of each request on fast connections.
• patches/mega-sdk-device-id.patch: adds MegaApi::setStatsId, so that the app can give the SDK a random device ID. The SDK does not read the Android ID.
• patches/mega-sdk-java-factory-ownership.patch: marks allocating JNI factories and album getters as owners of their native results, so that Java can release them safely.
• patches/mega-sdk-no-events.patch: the SDK does not send its diagnostic events and reports to MEGA, it does not keep the journey ID, and it does not tag new nodes for analytics.
• patches/mega-sdk-stream-no-cors.patch: the local stream server does not send Access-Control-Allow-Origin: *, so a web page cannot read the decrypted stream.
• patches/mega-sdk-user-agent.patch: the SDK puts only "Android" in the user agent, and not the kernel release and the CPU architecture.
• libmega.so exports only its JNI functions (scripts/libmega.map), and its relative relocations are packed (RELR). The linker can then remove unused code: the library is about 25 MB and not 33 MB (estimate).
• scripts/ports/: pinned native dependency updates, with upstream provenance and licenses. The native build records versions and a binary digest. Gradle rejects artifacts that do not match.
• The app sets 8 parallel connections in each direction (SDK mobile default: 4 down, 3 up). This is the "Fast transfers" setting.
• Crypto++ and OpenSSL are built with the ARMv8 AES, PMULL and SHA instructions. The libraries select them at run time.
• All native code is built with BTI and PAC branch protection. libmega.so has the BTI note, so Android enforces BTI for it on devices that support it. The link stops if an object has no BTI note.

Project layout

• sdk/: SDK bindings (src/main/java is generated, src/main/glue is hand-written).
• app/src/main/kotlin/app/megaglass/android/core: SDK wrapper, session, transfers, storage.
• app/src/main/kotlin/app/megaglass/android/ui: theme, shared components, navigation.
• app/src/main/kotlin/app/megaglass/android/feature: one package for each feature.
• scripts/fetch-icons.py: makes the Material Symbols drawables again.

Validation

After you build the native SDK, run the JVM regression tests, lint and the two application builds:

./gradlew :app:testDebugUnitTest :app:lintDebug :sdk:lintDebug \
  :app:assembleDebug :app:assembleRelease

With an Android 15 or later arm64 emulator connected, run ./gradlew :app:connectedDebugAndroidTest. These tests use isolated fixture data and do not need a MEGA account. Workflows that need a login still need a dedicated test account.

The alpha audit lists the fixes and the remaining test gaps. The validation record is a snapshot of the 2026-10-15 run. Each native build records its versions and digests in sdk/src/main/assets/mega-build.properties.

License

MegaGlass is free software under the GNU General Public License v3.0. The app includes the MEGA SDK (BSD 2-Clause) and other open-source libraries. Their licences are in app/src/main/assets/third_party_notices.txt, which the app shows in Settings > About.

---

_{MegaGlass is an independent project. It is not affiliated with or endorsed by MEGA.}