Overview
MrSMS is a virtual number provider targeting privacy-conscious users who need disposable phone numbers for online account verifications. The platform advertises coverage across 190+ countries and emphasizes instant SMS delivery for one-time passcodes. Users can access the service without submitting government ID or real names, positioning MrSMS as a no-KYC alternative to traditional telecom verification. The project maintains an open-source codebase and operates a Tor-accessible mirror, signaling alignment with cypherpunk values. However, multiple third-party trust evaluators flag serious concerns: Scam Detector assigns a 14.7/100 trust score with elevated phishing and malware risk indicators, while Gridinsoft's automated analysis lands at 57/100 and explicitly warns of limited independent reputation data combined with a recently registered domain.
The service launched its domain in July 2025, making it roughly ten months old as of mid-2026. Ownership records are fully redacted through an Icelandic privacy shield, which is standard for anonymity-preserving operators but complicates accountability. The platform has surfaced in niche communities including BlackHatWorld, where the operator actively solicits inclusion in SMS verification provider lists, suggesting grassroots rather than organic growth.
Privacy & KYC
MrSMS technically qualifies as L1, Anonymous under standard KYC tiering. No email address, legal name, or identity document is mandatory at signup. This pseudonymous access model appeals to users creating secondary accounts, managing pseudonymous identities, or simply avoiding phone-number linkage across services.
Despite the low KYC barrier, the privacy picture deteriorates sharply on closer inspection:
- IP logging status is unconfirmed, the operator does not publish a clear policy on whether visitor IPs are retained, correlated with payments, or shared with infrastructure providers.
- Zero privacy score in our methodology reflects this opacity plus the absence of published data-retention or deletion policies.
- Data collection forms on the site may request personal identifiers including names and email addresses according to automated content scans, creating potential contradictions with the anonymous marketing narrative.
- Domain blacklisting appears on multiple security engines, though the specific nature of these listings remains undisclosed in public scans.
The open-source claim offers some mitigation, auditable code reduces the risk of hidden telemetry, but without verified reproducible builds or third-party security audits, users must trust that the deployed instance matches the published source.
Supported assets & payments
MrSMS accepts a notably broad payment spectrum for its category. Cryptocurrency options include Monero (XMR), Bitcoin (BTC), and Lightning Network transactions, covering both maximal privacy and low-fee use cases. The inclusion of Monero is particularly significant for no-KYC users, as XMR's default privacy protections break on-chain payment tracing. Fiat and cash payments are also listed, though the mechanism for anonymous cash settlement is unspecified and likely involves intermediary friction.
This multi-asset flexibility distinguishes MrSMS from competitors that restrict payments to traceable cryptocurrencies or conventional card processors. For users holding privacy coins, the Monero integration represents a genuine usability advantage.
Security & custody
MrSMS operates as a custodial service by necessity, users do not control the underlying phone numbers or message infrastructure. The platform hosts virtual numbers on its own systems, meaning message content and metadata pass through MrSMS servers before user retrieval. This centralization creates a honeypot risk: a compromised or compelled operator could theoretically access verification codes, link them to payment timestamps, and de-anonymize accounts created elsewhere.
Security positives include valid HTTPS through Google Trust Services with certificate expiry in June 2026, and the Tor gateway providing an additional access layer for users requiring location anonymity. However, the trust score of 4/100 reflects severe external skepticism. Scam Detector's algorithm flagged a 70/100 phishing score and 48/100 malware score, automated readings that may reflect neighboring infrastructure or embedded third-party content rather than direct malicious intent, but which demand user caution regardless.
No multi-sig, no end-to-end encryption for message delivery, and no published incident response plan are observable gaps. Users treating MrSMS as a critical security component should compartmentalize, isolate payments, access only via Tor, and never reuse numbers across sensitive accounts.
Who it's for, verdict
MrSMS occupies a precarious position in the no-KYC ecosystem. The 6/10 overall score reflects genuine utility for low-stakes, disposable verifications balanced against substantial trust deficits. It suits researchers, developers, and privacy hobbyists who need occasional SMS reception without identity exposure, can tolerate service instability, and practice strict operational security.
It does not suit high-assurance threat models. The combination of redacted ownership, recent domain registration, blacklist appearances, and zero verifiable privacy commitments makes MrSMS unsuitable for journalists, activists, or anyone whose safety depends on provider integrity. The open-source offering and Tor availability are meaningful differentiators, but without community audit or longevity, they remain promises rather than guarantees.
Prospective users should fund minimally, verify number functionality on a test account before critical use, and maintain alternative verification channels. MrSMS demonstrates what a privacy-native SMS service could look like; whether it becomes what such a service should be depends on sustained transparent operation and independent validation that has not yet materialized.
