Secure Messaging Apps: Which Ones Are Secure and Which Aren't

WhatsApp

With over two billion users, WhatsApp is far ahead of the competition. Recently, however, the app has come under fire due to privacy concerns stemming from its connection to Meta. The controversy began when the app announced plans to share more user data with its parent company.

It’s important to distinguish between what you say and who you’re talking to. The actual content of your messages is securely protected by end-to-end encryption. Neither Meta nor any third party can presumably read your texts or eavesdrop on your calls while they’re in transit. However, the situation is different when it comes to metadata—that is, the records of who you message, how often, and from where. This data is shared with Facebook. In the European Union, GDPR regulations provide a safety net that prevents this behavioral data from being used for targeted advertising. If you do not agree to the latest updates, you can continue to use the app without losing access.

Facebook Messenger

For those already firmly embedded in the Meta ecosystem, Facebook Messenger is the obvious choice. From a security standpoint, however, it doesn’t follow the same rules as WhatsApp.

Although end-to-end encryption is available, it isn’t enabled by default. You must actively set up this level of security yourself. There are other hurdles as well. You cannot sign up anonymously; a Facebook account is required. Since the source code is closed-source, there’s no way for independent auditors to verify exactly what happens to your data. The app offers useful tools like group polls, but these come at the expense of transparency.

Signal

Signal has become the top recommendation for privacy advocates. The app is free and based on an open-source protocol—one so effective that WhatsApp has even adopted it for its own encryption.

You need a phone number to sign up, which is a point of contention for some. There’s also some uncertainty regarding the U.S.-based jurisdiction; the terms of service are somewhat vague regarding specific data processing purposes. Technically speaking, Signal is quite capable. It allows file transfers of up to 100 MB and supports massive group chats with 1,000 participants. For those who want to cover their tracks, there’s a self-destruct timer that deletes messages after a set period of time.

Threema

If you’re willing to pay a little for privacy, Threema is the strongest contender. This Switzerland-based service avoids the pitfalls of free apps by charging a one-time fee. Since it doesn’t rely on advertising or data collection, there’s no incentive to track you.

Threema takes anonymity seriously. You can create an account without providing a phone number or email address. The source code is publicly available, and encryption is enabled by default for all communications. However, this strict approach also has its drawbacks. Groups are limited to 256 members, and file uploads can be no larger than 50 MB. Furthermore, you’ll hardly find any “fun” extras like photo filters here; it’s a tool designed for utility, not entertainment.

Telegram

Telegram markets itself as a secure alternative, but the reality is anything but secure. It offers an incredible range of features. Users can share files up to 2 GB in size and build communities with 200,000 members.

It even supports automated bots for various tasks. But several countries—including Russia—apparently have access to the messages.

The danger lies in the default settings. Standard chats are not end-to-end encrypted. They are stored on servers in Dubai, where they may be used for advertising purposes. To ensure true privacy, you must manually start a “Secret Chat.” Unless you do this, your messages are stored in plain text on the provider’s servers. Furthermore, the company lacks transparency regarding its business model and keeps its source code secret.

Other Communication Options

In addition to these giants, there are several other options. Apps like Wire or Element offer different approaches to decentralized or encrypted chat.

Some users simply stick to traditional methods. iPhone users have iMessage to send media and text over data networks. Android users rely on RCS (Rich Communication Services), which serves as a modern replacement for the old SMS standard. These are convenient, but often do not offer the strict privacy guarantees found in apps like Signal or Threema.