Which encrypted messenger to choose
Signal, WhatsApp, Telegram: which one actually protects my conversations?
Nearly every mainstream messenger now advertises the word “encrypted”. That's true, and it tells you almost nothing. End-to-end encryption protects the CONTENT of your messages: neither the vendor, nor your carrier, nor someone on the same Wi-Fi can read the text. On that specific point, Signal, WhatsApp and iMessage do roughly the same thing: WhatsApp actually uses the protocol Signal developed.
What actually separates them is everything else: who you talk to, at what time, from which IP address, in which groups, with which address book. That's metadata, and it is not end-to-end encrypted: the vendor knows it, keeps it, and can be compelled to hand it over. In many situations, knowing that someone exchanged forty messages with a support hotline on a Tuesday evening is more revealing than the content itself.
The second thing that separates them is backups. A perfectly encrypted conversation that copies itself in the clear to a cloud every night is no longer encrypted: it's just encrypted somewhere other than where it gets read. In practice, this is what most often cancels out the whole benefit of encryption.
The four most used messengers
Criteria are ordered from most to least decisive, and phrased so that a “yes” is always the good news. The question mark opens the criterion's definition.
| Criterion | SignalSignal Foundation (United States), non-profit | WhatsAppMeta (United States) | TelegramTelegram FZ-LLC (Dubai) | iMessageApple (United States), between Apple devices only |
|---|---|---|---|---|
| End-to-end encrypted by default | Yes | Yes | NoOnly in “secret chats”, enabled manually, one-to-one. Never in groups or channels.Telegram FAQ (Secret Chats) | PartlyYes between Apple devices. To an Android phone the exchange goes over RCS, where Apple and Google began rolling out end-to-end encryption in May 2026, still in beta, on iOS 26.5 and recent versions of Google Messages, with carriers that follow. Until both ends are there, the conversation stays outside it.Apple, end-to-end encrypted RCS messaging (May 2026) |
| Metadata kept to a minimum | YesCut down to almost nothing, and Signal publishes it: the only thing it can produce in response to a legal request is the registration date and the last connection date.Signal, government requests | NoExtensive: contacts, groups, timestamps, IP addresses, address book. | NoExtensive, and group content sits on the server. | PartlyTimestamps and recipients known to Apple. |
| Encrypted backup | YesNo automatic cloud backup; local transfer with a key. | PartlyAvailable, but you must turn it on. WhatsApp states that backups to iCloud and Google Drive are not protected by its end-to-end encryption unless you switch it on.WhatsApp, about end-to-end encrypted backup | NoNon-secret chats are stored server-side by design. | PartlyApple states it plainly: under standard protection, if iCloud Backup is on, it contains a copy of the Messages encryption key. With Advanced Data Protection, which is opt-in, the backup and that key are end-to-end encrypted.Apple, iCloud data security overview |
| Usable without a phone number | NoNumber required at signup. A username lets people reach you without it, and two settings decide who can see it and who can find you by it. One limit to know: people who already have it in their contacts will keep seeing it.Signal, phone number privacy and usernames | No | No | PartlyAn Apple account with an email address is enough. |
| Auditable code | YesOpen client and server, audited protocol.Signal source code (AGPLv3) | NoClosed client; documented protocol. | PartlyOpen clients, closed server. | No |
Data verified on
The general public
Cut down ad tracking and passive exposure, without making daily life harder.
Signal
Failing that: WhatsApp
Signal if the people around you will follow you there: it's the only one that doesn't monetise what it knows about you. Otherwise WhatsApp remains defensible day to day (content is well protected), provided you go and switch on the encrypted backup, which is off by default. A messenger nobody around you uses protects nothing: the best tool is the one your conversations actually happen on.
Someone exposed
Journalist, activist, victim of harassment or abuse: making sure a motivated third party can't trace you.
Signal
Signal, without hesitation, and for a reason that isn't the encryption: it's the only one whose metadata is so thin that a legal order returns almost nothing. In your situation, the list of who you talk to is more dangerous than what you say. Turn on a username so your number isn't exposed, and check that disappearing messages are on for sensitive conversations.
A designated target
An adversary with legal or technical means: minimising metadata and what a third party can be compelled to hand over.
Signal
Signal is still the baseline, but the tool is no longer the issue: at this level what exposes you is the phone itself (a compromised device, backups, notification previews on the lock screen) and the fact that a number ties you to a subscriber contract. Treat the messenger choice as settled and put the effort into the device and into compartmentalising identities.
The three settings that matter, whichever app you use
- 01
Turn off or encrypt the cloud backup
This is the highest-return setting of the lot. Open your messenger's backup settings: either turn automatic backup off, or switch on its encrypted version. Without this, all your conversations are readable by the cloud host, whatever encryption the app applies.
- 02
Hide message previews on the lock screen
Encryption does nothing against someone reading your notifications over your shoulder, or holding your phone. This is the most common leak in situations of domestic abuse or control.
- 03
Turn on disappearing messages for sensitive conversations
What no longer exists on the device can't be read by someone who gets access to it later. It's the only effective protection against physical access, which is by far the most common scenario, well ahead of network interception.
Now practise
Knowing which tool to pick isn't enough: reflexes are built in context. The course covers the topic as exercises.
Where do you stand?
Good tools protect what comes next. What's already circulating about you (addresses, passwords, exposed accounts) needs a different answer.