Most Private Messenger: Signal vs Session vs SimpleX vs Matrix Compared

Every app on this list says it is private, and most of them encrypt message content well. What separates them is everything around the content: the identifier you sign up with, what the server learns about who talks to whom, whether a stolen key unlocks your past messages, and who can be compelled to hand data over. This page compares seven messengers on those points. Facts were checked on 10 November 2026.

For how keys, ratchets and end-to-end encryption work in general, read end-to-end encryption explained. For the settings on the phone itself, see phone privacy hardening.

The comparison table

The table rewards three things above content encryption: an identifier that does not lead back to you, a server that learns little, and forward secrecy so a seized device does not open the archive.

Signal

Mechanism. Signal encrypts every chat, call and group with the Signal Protocol. In September 2023 it added PQXDH, which combines X25519 with CRYSTALS-Kyber at the start of a conversation, so an attacker must break both to learn the shared secret. A formal analysis by Cryspen, Inria and Signal (USENIX Security 2024) found specification flaws that the deployed app was not vulnerable to, and the spec was revised. In October 2025 Signal added the Sparse Post Quantum Ratchet (SPQR) using ML-KEM-768. Its output is mixed with the existing Double Ratchet into what Signal calls the Triple Ratchet, so the ongoing conversation, and the handshake, both resist harvest-now-decrypt-later. Rollout is gradual; Signal says it will enforce SPQR once all clients support it.

On the server side, sealed sender (2018) hides the sender of most messages from Signal's server, and contact discovery runs inside a hardware enclave so the server does not learn your address book. Signal's published subpoena responses show what is left to give: the date an account registered and the date it last connected.

Trade-off. You need a phone number to register. Since February 2024 you can set a username and set "Who can find me by my number" to Nobody, so contacts never see the number and strangers cannot confirm you are on Signal. Signal itself still holds the number, and in many countries a SIM is tied to an ID document.

SimpleX Chat

Mechanism. SimpleX has no account identifier at all, not even a random number. Each contact gets its own pair of one-way message queues on relay servers, and you can use different relays for different contacts. A relay sees a queue address and when messages arrive, with nothing that links your queues together into one person. Messages use a double ratchet, and since v5.7 (April 2024) direct chats add Streamlined NTRU Prime for post-quantum key agreement by default when both clients support it.

Trail of Bits audited the implementation in October 2022 (two medium and two low findings, mostly fixed in v4.2) and reviewed the protocol design in July 2024, which SimpleX reported as having no critical issues.

Trade-off. No identifier means no directory: you add people by sharing a one-time link or QR code. Moving to a new phone means migrating the database yourself. Groups are built from pairwise connections, which gets heavy in large groups. The user base is small, so you will mostly use it with people you deliberately bring over.

Session

Mechanism. Session registers you with a random keypair; your Session ID is the public key. Messages are stored in swarms of community-run nodes (1,181 on Session's staking page on 10 November 2026, each staked with 25,000 SESH) and routed through onion paths, so the nodes holding your messages do not see your IP. In October 2024 stewardship moved from the Australian OPTF to the Session Technology Foundation in Switzerland, after Australian federal police visited an employee at home, as Session's president told 404 Media.

Trade-off. Session launched on the Signal Protocol and later dropped it, citing multi-device sync problems. The current V1 protocol encrypts to a long-term key, so there is no forward secrecy: whoever obtains that key can decrypt any recorded traffic sent to it. A January 2025 critique also pointed out that Session derives Ed25519 keys from 128 bits of seed entropy, a choice Session says Quarkslab's 2021 audit flagged and rated low, and which Session defends as sufficient.

Session Protocol V2, announced December 2025, adds account and device keys that rotate roughly every 12 hours for forward secrecy, and an ML-KEM-768 plus X25519 hybrid following the X-Wing construction. Session's 13 October 2026 update says the spec is public and that one-to-one encryption with forward secrecy and post-quantum keys has been implemented in libsession since April 2026. The released apps carry only forward-compatibility groundwork, an invite-only alpha is being explored, and V1 compatibility will last at least six months after the switch. Until V2 is live in the apps, judge Session on V1. Session Communities (large public groups) are not end-to-end encrypted at all.

Matrix and Element

Mechanism. Matrix is a federated protocol: you pick a homeserver (or run one), and homeservers sync rooms between them. Element and other clients encrypt direct messages and private rooms by default, as of May 2020, using Olm for device-to-device keys and Megolm for room messages. MLS (RFC 9420) is the planned replacement for group encryption, but the decentralised variant Matrix needs is still in development, and the project's MLS tracker (last updated June 2025) still says "Not Yet", with full client support not started.

Trade-off. The homeserver is a large metadata store. It knows which accounts are in which room, when each event was sent, and the room's state (name, topic, membership changes) in the clear. Federation copies that metadata to every server that participates in a room. In September 2022 researchers from Royal Holloway and others disclosed client bugs, two rated critical, that let a malicious homeserver attack users; they were patched in matrix-js-sdk 19.7.0. Matrix is the right tool when an organisation must own its server and federate with partners. Between two people, Signal exposes less.

Threema

Mechanism. Threema assigns a random eight-character ID and needs no phone number or email. Linking your number for contact discovery is optional. Its protocol is built on NaCl, and in late 2022 Threema added the Ibex protocol, which brings ephemeral keys and forward secrecy to messages, including group messages. Ibex does not yet cover Threema's multi-device mode. The apps have been open source since 2020; the server is closed.

Trade-off. In January 2023 ETH Zurich researchers published seven weaknesses in Threema's earlier protocol, some serious; Threema said they affected a protocol it had replaced and had no real-world impact. Threema's audit page lists a 2023 analysis of Ibex by the University of Erlangen-Nuremberg and a 2024 Cure53 audit of the desktop app. It costs a one-time fee, which funds the service without ads. Ownership has changed twice: Afinum bought it in 2020, and German private equity firm Comitis Capital agreed to acquire it in January 2026. Threema says management and policies are unchanged; a closed server means you rely on that.

WhatsApp

Mechanism. WhatsApp uses the Signal Protocol for all chats and groups, so content is end-to-end encrypted by default. Since 2021 you can also end-to-end encrypt chat backups, either with a 64-digit key you keep or with a password that unlocks a key stored in WhatsApp's HSM-based vault. NCC Group assessed the design that year.

Trade-off. The content is protected and nearly everything around it is available to Meta. WhatsApp's law enforcement page lists name, service start date, last seen, IP address and email on a subpoena, and other non-content records on a court order. A phone number is required. Username reservations opened in late June 2026 and the feature is rolling out by country, hiding your number from people who reach you that way; registration still needs the number. Encrypted backups are opt-in, so the default backup on iCloud or Google Drive holds your history outside the end-to-end protection.

Telegram

Mechanism. Normal chats and every group are server-client encrypted "cloud chats" that Telegram can read. End-to-end encryption covers only Secret Chats (one-to-one, device-specific, started by hand) and calls, including group calls of up to 200 people since April 2025.

Trade-off. In September 2024, weeks after Pavel Durov's arrest in France, Telegram updated its privacy policy: on a valid order from judicial authorities naming a user as a suspect in a criminal case, it may disclose that user's IP address and phone number, and report it in a transparency report. Before the change the policy allowed disclosure only on a court order naming a terror suspect. For privacy, Telegram belongs in the same bucket as any cloud service. Use it for public channels and nothing you would mind Telegram reading.

Where messengers actually leak

These are the places messengers leak in practice.

The device itself sits under all of this: a compromised phone reads messages after decryption. That is covered in phone privacy hardening, and a hardened OS such as GrapheneOS narrows it further. For how the messenger fits with the rest of your setup, see privacy tools.

Verdict by threat model

If your messages must stay secret for a decade or more, add one more filter: post-quantum protection. As of this check, Signal (handshake and ratchet) and SimpleX (direct chats) have it in production, and Session has it specified. For what "harvest now, decrypt later" means and why ML-KEM was chosen, see post-quantum cryptography explained.

Related guides

• End-to-end encryption explained
• Phone privacy hardening
• Post-quantum cryptography explained
• How Tor works
• Best secure email