Nearly all messaging apps nowadays refer to themselves as secure. While some of them do mean it, others merely ensure that your messages are encrypted even though someone else still knows who you are talking to, when, how often, and from where. For anyone concerned about privacy, that distinction matters a great deal.
This guide looks at the encrypted messengers which are most frequently asked about: Signal, Session, Briar, SimpleX Chat, Threema and Element, and also gives a brief comparison of how WhatsApp and Telegram fare in relation to them. It is written for October 2026, and it has been a busy year: Signal has finally removed the requirement for new Android accounts to provide a phone number, Session has almost closed down, Briar has entered maintenance mode, and SimpleX has asked its users to become investors.
What actually matters when comparing messengers
It is helpful beforehand to know the criteria by which to judge the various apps. Relying solely on encryption is not sufficient, since almost all serious apps now encrypt the content of their messages. It is on the basis of these questions that the apps can be distinguished.
Is encryption on by default for all chats? If you have to remember to turn it on, the majority of people won’t.
What information does the app need from you? In most countries a phone number links your account to your actual identity, whereas an email address is somewhat better. Having no identifier at all is best.
How much metadata is left behind? Metadata is information about your messages rather than the messages themselves, such as who sent them, when they were sent, how often and from which IP address. It can show a surprising amount even if the content remains private.
Who is in charge of the servers? Is it one company, a network of volunteers, or nobody at all? Each of these options involves its own risks.
Is the code open and has it been audited? If the code is open source, people other than the developers can check that the app does what it says. Independent audits are even better.
Will it still be there next year? This was previously something of a side issue, but after 2026 it isn’t. Since privacy apps depend on donations and have small budgets, several of them nearly reached the limit this year.
Signal
Signal is the app that security experts most often recommend, and for good reasons: it is operated by a nonprofit organisation, its code is open source, and the Signal Protocol it uses is so highly regarded that WhatsApp, Google Messages and others have based their own encryption on it. All chats and all calls are end to end encrypted by default, and there is no option to disable this.
Signal also gathers only a small amount of information; it knows only the date on which you created your account and the date of your most recent connection, and no more. It does not store your contact list, your groups or your message history on its servers. The feature known as sealed sender hides from Signal itself who has sent a message, and the protocol already provides protection against future quantum computers.
The major development in 2026 is the option to sign up without a phone number. For a long time, one of the most frequent criticisms of Signal had been that a phone number was required in order to sign up. This changed at the end of September. On Android, it is now possible to set up an account without providing a phone number by paying a one time fee of $2.99, a charge that Signal states is intended to make it harder to create large numbers of spam accounts. Signing up using a phone number remains free, and you can hide that number from other users by using a username. However, there is still no confirmed date for iOS.
The backup facilities have also improved. With the release of Signal 8.30 on 30 September 2026, encrypted on device backups were introduced for the iPhone and for the desktop applications on Windows, Mac and Linux. Treat your recovery key as you would a password, since attackers have already begun targeting it.
Be careful about fake “Signal Support”. In February, Germany’s security services issued a warning about a phishing operation targeted at politicians, journalists and members of the military. The attackers pretended to be Signal Support or a “Signal Security ChatBot” and asked individuals to provide their PIN or verification code. In May, Signal responded by introducing additional warnings and confirmation steps for message requests. The rule is straightforward: Signal will never send you a message asking for your PIN, registration code or recovery key.
Good for: nearly everybody, since it provides the simplest means of using strong encryption with friends and family who aren’t experts in privacy.
Weak spots: it is centralised, with a single organisation managing all the servers, and your IP address will be visible to those servers unless you use either a VPN or Tor.
Session
Session was designed for individuals who don’t wish to associate their account with any personal details. You don’t provide it with either a phone number or an email address; instead, the app assigns you a random Account ID, and it’s this Account ID that people use to get in touch with you. The messages are sent via a decentralised network of nodes which are run by the community, employing onion routing, so no single server is able to see both the sender and the recipient of a message.
That design provides Session with excellent metadata protection, which is actually its main advantage. The consequence has been weaker security of a different type. Having moved away from the Signal Protocol many years ago, Session gave up perfect forward secrecy, which means that past messages could be exposed if a long term key was stolen. Security researchers have criticised that decision for a long time.
The solution is being developed. In December 2025 the team announced Session Protocol V2, a version which brings back forward secrecy and adds post quantum encryption based on the same NIST standard that is used by Signal and iMessage.
Then 2026 almost brought it to an end. In March, cofounder Chris McCabe issued a personal appeal asking for donations. In April, the Session Technology Foundation stated that it would close down after 8 July unless it raised at least one million dollars, and the staff departed while volunteers kept the lights on. At that time, Session had about 1.7 million users. The community reacted, and on 15 June the foundation announced that Session had a future once more, with development resuming. By September the paid Session Pro beta had been submitted to the app stores and an invite only alpha of Protocol V2 was being planned.
Good for: individuals who want to remain anonymous and do not wish to provide a phone number.
Weak spots: forward secrecy will not be available until Protocol V2 is actually released, there is a history of complaints regarding reliability, and the funding situation is better than it was but remains fragile.
Briar
Briar is in a special position in the most positive sense, since it has no central server at all. When you’re connected to the internet, messages are sent directly from one device to another via the Tor network; when you’re not connected, they travel over Bluetooth and local WiFi instead. It is therefore able to keep messages going between nearby phones if the internet fails during a protest, in the case of a disaster or when the government shuts down the internet.
The contacts and messages are kept only on your device. When you add someone you usually have to scan each other’s QR codes in person, a process which is slower than typing a username but much more difficult to fake. In addition to one to one conversations, Briar also provides private groups, forums and blogs.
The catch is convenience. Briar operates only on Android, and the developers have stated that an iPhone version is unlikely. Since there is no server storing your messages, both individuals usually have to be online at the same time for a message to be received. It also drains the battery more than a normal messenger.
The news about 2026 is more subdued but still significant. On 9 July the Briar Project announced that it was going into maintenance mode. The small volunteer team will continue to provide security updates and bug fixes, and version 1.5.21 was released on 30 September, but new features like file attachments and account backup are on hold due to a lack of funding.
Good for: activists, journalists and those who are preparing for internet blackouts.
Weak spots: it only works on Android, requires both sides to be online, and has no new features planned for the foreseeable future.
SimpleX Chat
SimpleX takes the idea of not identifying users further than any other app here. It uses no phone number, no username, and not even a random ID like Session’s. Instead, each conversation is given its own separate set of message queues on the relay servers. You connect with someone by sharing a one time invitation link or QR code, and the servers never receive any identifier that would link all of your contacts together.
A beneficial side effect is that spam is extremely difficult to send; unless you have given someone a link, they can’t message you. Furthermore, if you don’t want to depend on the standard relay servers you can set up your own, and the program is compatible with Android, iPhone, Windows, Mac and Linux.
The flip side is that this design takes some getting used to. Moving to a new phone, using several devices at once and finding people you already know are all less straightforward than on Signal.
In 2026, SimpleX went its own way on funding. Version 7.0 arrived in July, with point releases since, and the company launched an equity crowdfunding campaign that lets its users buy a stake in it. Its published roadmap focuses on scaling to large communities, with bigger channels expected to pay for their own servers. It’s a commercial company backed by investors, which some people see as more sustainable than donations and others see as a risk.
Good for: those who wish to have as little connection as possible between their identity and their contacts.
Weak spots: a steep learning curve, poorer support for multiple devices, and a smaller user base.
Threema
Threema is a messaging service from Switzerland which you pay for once instead of paying with your data. Similar to Session, it assigns you a random Threema ID, making a phone number or email address optional. Chats are end to end encrypted, the client applications have been open source since 2020, and the servers are located in Switzerland and are subject to Swiss privacy laws. Threema is also widely used by businesses and public organisations via Threema Work, including parts of the Swiss federal administration.
The ownership changed this year: in January, German private equity firm Comitis Capital agreed to take over Threema from its earlier investor, and the company was reorganised as Threema AG in July. Threema has stated that its team, mission and Swiss infrastructure will not be affected. In August the service was partly taken offline for several hours by major DDoS attacks, a reminder that a centralised service has a single point of failure.
Good for: individuals who are willing to pay a small fee in order to have a refined messenger that doesn’t need a phone number.
Weak spots: it isn’t free, it is centralised, and it is now owned by a private equity firm.
Element (Matrix)
Element is the best known application associated with Matrix, an open standard for decentralised chat. It functions in a manner similar to email: anybody is able to set up a server, known as a homeserver, and people using different servers can still communicate with one another. Private conversations are end to end encrypted by default, and users can register using a username instead of their phone number.
It is for this reason that governments like it. Sweden’s public sector began using Matrix federation in June, and Germany has included a Matrix based service in its national tech stack. However, individuals should note that your homeserver is able to collect a good deal of metadata, for example information about the rooms you are in and the people you talk to; if you use someone else’s server, you are placing your trust in them.
In 2026 Element was very busy. It is making device verification mandatory, so that only verified devices can send and receive encrypted messages, with enforcement pushed back to October 2026. Late in September, Element Call introduced initial support for encrypted group calls.
Good for: communities, teams and anyone who wishes to manage their own server.
Weak spots: more metadata is stored on the server, and the setup is more complicated than Signal’s.
WhatsApp and Telegram: how the mainstream apps compare
The majority of those reading this will already have WhatsApp or Telegram on their devices, so it’s important to state where they stand.
WhatsApp automatically encrypts messages and calls using the Signal Protocol, which means that the contents of your chats are well protected. The issue, however, lies in all the other information surrounding the content. WhatsApp is owned by Meta, requires your phone number, uploads your contacts, and gathers a large amount of metadata about whom you talk to and when those conversations take place. Cloud backups stored on Google Drive or iCloud are only protected by end to end encryption if you turn that feature on yourself. Although the service is still introducing new features, such as parental controls for teenage accounts at the end of September, none of these changes affect the amount of information Meta has about your habits.
Telegram is usually regarded as a secure messaging service, but ordinary chats as well as all group chats are not end to end encrypted, since they are stored on Telegram’s servers in a format that the company can access. End to end encryption is available only in Secret Chats, which function solely between two people and must be started manually. Furthermore, Telegram uses its own MTProto protocol, a system that has been criticised by cryptographers for many years. Since September 2024, the company has stated that it will provide authorities with IP addresses and phone numbers when it receives valid legal requests.
Telegram is excellent for channels and large communities, but it doesn’t function as a private messenger in the same way as Signal or SimpleX does.
Side by side comparison
| App | Sign up needs | Encrypted by default | Servers | Platforms | Cost | 2026 status |
|---|---|---|---|---|---|---|
| Signal | Phone number, or $2.99 fee on Android | Yes, everything | Central, run by a nonprofit | Android, iOS, desktop | Free | Active, number free accounts launched |
| Session | Nothing (random Account ID) | Yes | Decentralised node network | Android, iOS, desktop | Free, paid Pro tier | Rescued after funding crisis |
| Briar | Nothing (QR code in person) | Yes | None, peer to peer | Android only | Free | Maintenance mode |
| SimpleX Chat | Nothing at all | Yes | Relays, can self host | Android, iOS, desktop | Free | Active, crowdfunding |
| Threema | Nothing (random Threema ID) | Yes | Central, in Switzerland | Android, iOS, desktop | One time fee | Active, new owner |
| Element | Username and homeserver | Yes, for private chats | Federated, can self host | Android, iOS, desktop, web | Free | Active, encrypted calls arriving |
| Phone number | Yes, but backups optional | Central, run by Meta | Android, iOS, desktop, web | Free | Active | |
| Telegram | Phone number | No, only Secret Chats | Central | Android, iOS, desktop, web | Free | Active |
Which one should you choose?
There is no single ideal messenger; instead, there is the one that is most suitable for the thing you are trying to protect yourself from.
For everyday privacy with friends and family, Signal is the best choice, since it’s the easiest for getting people to use it, it’s free, and its encryption is as strong as you can get. The fact that accounts without a phone number are now available on Android means that one of Signal’s major disadvantages is disappearing.
For anonymity, you should consider SimpleX Chat or Session. SimpleX provides the least identifying information of all the apps mentioned here, while Session is easier to understand, although it is still awaiting forward secrecy, so keep an eye on the release of its Protocol V2.
For internet blackouts or high risk situations, keep Briar installed alongside your main app. Even in maintenance mode, none of the other apps here work without the internet.
If you prefer to pay rather than be the product, Threema is a good and well refined option.
For communities, teams, or running your own server, Element and Matrix are the best choices.
No matter which one you select, remember that strong encryption will not protect a phone that is under someone else’s control. In September, German reporters showed that police are able to read messages from Signal, WhatsApp and Telegram without breaking the encryption, simply by adding a linked device after obtaining access to the phone or the verification code. Check your list of linked devices from time to time, set a PIN, never give your verification code to anyone else, and make sure your apps are up to date.
The right messenger is the one that you actually end up using and the one that the people you care about will use with you; begin with this and then introduce the more specialised tools when you need them.