The most secure messaging app for most people, and when it isn't

Signal vs Session vs SimpleX, and the rest of the short list

Signal is also the messaging pick among the privacy tools. The rows that matter most are the ones where its phone number or its desktop app is the part that fails, and the apps people recommend out of habit.

Does Session have forward secrecy now?

No. Not in the app you can install today.

On 13 October 2026 Session published where Protocol v2 actually stands. Perfect forward secrecy and the post-quantum half, for one-to-one messages, are implemented in libsession, the shared cryptography library, as of April 2026. Device linking with on-screen verification is in that same library. What shipped in the apps, in October 2026, is forward compatibility: iOS 2.15.5, Android 1.33.6 and Desktop 1.18.2 can recognise a v2 message and hold it, instead of dropping it, and they show a note telling you to update. Recognising a format is not encrypting with it.

The same post says the remaining work is integrating v2 into the apps, finishing device groups, and designing the migration. An account can switch only once every linked device supports v2. A grace period of at least six months is planned so older clients still work. An invite-only alpha is being considered, and in that alpha forward secrecy would apply only when both people are on it. Until that ships, a stored history plus a compromised device is still the problem Session's own FAQ names. The FAQ, which is still the page a user hits, asks "Why doesn't Session have PFS?" and answers that it will be re-implemented in v2, "which is currently under development." The October post is more precise than the FAQ. It does not contradict the FAQ's conclusion about the app in your hand.

Forward secrecy, when it arrives, is Session's answer to a real property of the current design: "an attacker who stored encrypted messages and later compromised a device could potentially decrypt that history." Keys in v2 are meant to rotate about every 12 hours and be forgotten after 16 days, which covers the 14 days a swarm holds a message. That is a design, dated October 2026, not a feature of the messages you send this week.

A secure messenger for a PC, and whether the desktop app is as safe as the phone

They are not the same object. On Signal the phone is the account, and the computer is a window onto it. On Session the computer can be the account. On Threema it depends which desktop app you installed, and one of them is still a beta.

Signal's support page: you link a desktop, an iPad or a second phone to the primary device, up to five linked devices. Chats, and the last 45 days of media, can be copied across at linking. After that, the phone has to come online at least once every 30 days or the linked devices unlink. A linked device also unlinks after 45 days of its own inactivity, and you can only relink it from the primary phone. Signal says communication on a linked device "is private, just like your smartphone." The desktop stops being a Signal device if the phone stays offline for a month. A seized phone is still the root of the account. A seized computer is a copy of the chats that were synced, for as long as the link lasts.

On disk, Signal Desktop has encrypted its database key with the operating system's keystore since July 2024, according to Signal's own staff. How much that protects depends on the system. On Linux, a locked or missing keyring means a password prompt or, if you start Signal with --password-store="basic", a key stored in plaintext. SandboxAQ's analysis says the macOS keychain restricts access per application, while on Windows and Linux malware running as your user can still reach the key. A Signal desktop on a laptop that malware has reached is not a locked box.

Session's desktop client can create or restore an Account ID on its own. There is no phone in that loop. The local database can be encrypted with a PIN or a password, and Session says that with the feature turned on, the messages cannot be read without it. "Turned on" is the whole caveat. It is a setting, not the condition the app arrives in. A desktop Session that nobody configured is a database sitting on the disk. Restore brings back messages from the last 14 days, which is how long a swarm keeps them, and contacts only if a device has been online in the last 30 days.

Threema's ordinary desktop app and Threema Web both need the mobile app, and the phone has to be on the internet. The beta of Threema 2.0 for desktop does not: once the phone app is linked, the two can be used independently, including while the phone is offline. One Threema ID still cannot sit on two phones at once. The stable desktop is a remote control for the phone. The beta is a second device, and it is a beta. SimpleX publishes Windows, macOS and Linux builds, and there is no phone account to tether them to. Briar's downloads on that page are Android, Windows and Linux.

Molly is the Android exception worth knowing about, and it is not a desktop app. It is another client for the Signal network. It can encrypt the local database with a passphrase, route over Tor, and use the phone as a linked device rather than the primary. You are then trusting the Molly team as well as Signal, and Molly's updates can lag Signal's by a short interval, except for security fixes, which Privacy Guides says are patched as soon as possible. Use it when the threat is someone holding your unlocked Android phone. Don't use it because a blog called it a hardened Signal.

What the server can still see

End-to-end encryption answers "can the company read this sentence?" Metadata is everything else: who you are, who you wrote to, and when. The apps split there, and the split is the reason SimpleX and Session exist.

On Signal, contact lists are encrypted with your PIN and the server does not have them. Profiles are encrypted and shared with the people you actually chat with. Private groups are built so the server has no record of the membership, the title or the avatar. With sealed sender on, which is the default for people in your contacts, the sender's address is encrypted with the message and the server sees the recipient. You can extend sealed sender to everyone, and Privacy Guides notes the cost: more spam. The server still knows a phone number registered. That is the identifier. A username stops your contacts seeing the number. Privacy Guides' steps are: set a username, then set "Who can see my number" to Nobody. It does not delete the number from Signal's registration.

Session's claim is stronger, and narrower than the marketing. Onion requests mean no single server knows both the origin and the destination of a message. Session says it does not know when you send, or to whom, because there is no central server routing person to person. Creating an account needs no phone number and no email. Two holes are in the same FAQ, in Session's own words. Calls are peer-to-peer, not onion-routed, so your IP is shared with the other person and with a Session Technology Foundation STUN/TURN server. Session's advice, if that matters, is not to turn calls on. Fast-mode push notifications hand your device IP to Google or Apple, and hand your Account ID and push token to a Session push server. Session says the Account ID is not tied to the IP, because that registration itself goes over onion requests. Standard mode avoids the push servers. The call hole does not have a "standard mode."

SimpleX's metadata answer is the queue. Messages move through one-way queues, there is no username to look up, and there is no central server holding a backup of your account. Moving to a new device is an export you do yourself. SimpleX's own line is sharper: "Not even servers" can see who you talk to, because the messages "look like random noise," and every contact stays on the device rather than in a server's database. The cost is the intro: you cannot be found. Someone has to give you a link, or you scan their code. That is the property, not a missing feature.

Element is a client. The account lives on a homeserver, and Element says each homeserver's privacy practices are outside Element's control. Encryption is a room setting. "Messages are only encrypted in rooms with encryption enabled." A homeserver operator, on a room where that switch is off, is in a different position from Signal's servers. Turning encryption on in a room does not rewrite the rooms where it was never on.

Is WhatsApp or Telegram secure enough?

WhatsApp is secure enough for the contents of a personal chat, against WhatsApp. It is a poor choice if the thing you are hiding is the fact of the conversation, or if the chat is with a business that handed the thread to Meta.

Personal messages, calls, photos and voice notes are end-to-end encrypted by default, with the Signal protocol, and WhatsApp says it has no ability to see that content. Keys change with every message. That is forward secrecy, described in plain language. The exception is on the page, and it is easy to miss: chats with businesses that use certain optional Meta services are not considered end-to-end encrypted. WhatsApp says it marks those chats. A personal chat with a friend is not that. A chat that started from an ad, or a business that stores messages at Meta, is. The account is still a phone number, so the social graph is the phone's address book. The encryption page settles the contents of a personal chat. It is not a list of what the account record still holds.

Telegram is the one to stop recommending for anything sensitive, unless the person has actually opened a Secret Chat and understands that it will not appear on their other devices.

Telegram's own FAQ splits the product in two. Cloud chats, which are the normal private chats and groups, use "server-client encryption." Secret Chats use "client-client encryption." Cloud chats are kept so you can open them on any device. Telegram says it keeps the information it needs for that, including those chats and your contacts. The keys for data that is not end-to-end encrypted are split across data centres, and Telegram says several court orders would be needed to compel disclosure. That is a claim about how hard it is to force the company, not a claim that the company cannot read the chat. Secret Chats "leave no trace on our servers," cannot be forwarded, and "can only be accessed on their devices of origin." Telegram's own advice, if you are worried about your safety, is to use only Secret Chats. The default chat is the other one. A desktop Telegram that synced when you logged in with your phone number is the cloud, and the cloud is the copy Telegram holds.

Threema, Element and XMPP

These three get recommended as the grown-up alternatives. One of them earns it for a specific person. The other two are infrastructure, and infrastructure is only as private as the way you turn it on.

Threema's identity is a random eight-character ID, not a phone number, and the FAQ says you are not forced to give a number or an email. It also says all communication is end-to-end encrypted, and that it supports perfect forward secrecy on both the transport layer and the end-to-end layer. The server still has to know who is sending a message to whom in order to route it. Threema says it does not log that, cannot decrypt the content, and deletes the message from the server once it is delivered. The apps are open source. Cure53 audited the new desktop app in 2024, researchers at the University of Erlangen-Nuremberg analysed the Ibex protocol in 2023, Cure53 audited Threema in 2020, and Münster University of Applied Sciences audited it in 2019. Pick it when you want an ID you can hand someone without a QR code in the room, and you can live with a server that sees the pairing long enough to deliver. SimpleX's claim is that the server never sees the pairing. Those are different promises, and Threema's is the one it wrote down.

Element on Matrix is the opposite shape. There is no phone number, registration by phone having ended, and an email address is optional unless that particular homeserver demands one. The privacy of the account is the homeserver's privacy, and Element says so. Encryption is excellent in a room where it is enabled, and absent in a room where nobody enabled it. Element's help page is explicit: messages are only encrypted in rooms where encryption has been turned on. Key storage is on by default: the device keeps an encrypted copy of the message keys on the account provider's server, and Element says the provider cannot read them. A workplace that runs its own homeserver and turns encryption on in the rooms that matter has a good tool. A person who joined a public room and assumed the lock was already there does not.

XMPP's own overview describes a federated protocol, like email, with TLS and SASL built into the core. End-to-end encryption, on that page, is something "the XMPP developer community is actively working on," not a property of every conversation. Clients can add it, and whether you have it depends on the client you pick. Running your own server means you are the server. That is a good property if you wanted control. It is a bad property if you wanted the server to be unable to see who talks to whom, and you never added encryption on top.

Can police read a Signal message, and who has been audited?

Police can read a Signal message that is on a phone they have unlocked. They cannot read it out of Signal's servers, because those servers do not have it. The record of what a legal order actually produced is short, and it has stayed short.

In the first half of 2016, a grand jury subpoena from the Eastern District of Virginia demanded information on two users. Signal says the only things it could produce were the date and time an account registered, and the last date that account connected. It also says it does not store contacts, group membership, or any record of who a user has been communicating with. On 6 March 2026 a District of Columbia grand jury asked for the account-creation time and the last connection time for 37 phone numbers. Seven of those accounts did not exist. For 24, Signal had nothing responsive in the period the subpoena covered. For the other six, it provided those dates. The same letter says Signal does not have messages, calls, profiles, groups, contacts, stories or call logs. That is the answer to "can police read my Signal messages?" from the company side. It is not an answer about a seized phone, a backup you uploaded somewhere else, or the person you were writing to. Their copy of the chat is theirs.

Audits worth citing are the ones with a year and a firm, not a badge on a homepage.

• The Signal protocol was independently audited in 2016. Privacy Guides points at the specification rather than a fresh 2026 report.
• SimpleX was audited in October 2022 and again in July 2024.
• Briar's client has been audited, and it rides on Tor, which has been audited separately.
• Session says Quarkslab audited the desktop, Android and iOS clients. That audit is of the clients as they were, which is the version without forward secrecy in the message protocol.
• Threema lists Cure53 on the new desktop app in 2024, and an analysis of its Ibex protocol by the University of Erlangen-Nuremberg in 2023.

The best encrypted messaging app for most people is Signal: forward secrecy on by default, and a 2026 subpoena that still could not produce the messages. "Best" here is that pair of facts, not a longer feature list. How a pick gets made is on the methodology page.

Which messenger to pick, by situation

You can use a phone number, and the people you write to will install something

Signal. Set a username and hide the number. The desktop is fine for daily use and is not a second copy of the account's security.

You cannot use a phone number, and you can exchange a link or a QR code

SimpleX. It is the one Privacy Guides recommends that has no identifier and does have forward secrecy.

You want a desktop that does not need a phone, and you have read the forward-secrecy paragraph

Session, with the local database PIN turned on, and calls left off if your IP matters. Revisit it when Protocol v2 is actually what the app encrypts with, not when a blog says the library is ready.

The conversation is already on WhatsApp

The contents of a personal chat are end-to-end encrypted. Moving the sensitive thread to Signal is still the better idea, and a Telegram cloud chat is not a substitute for either.