Secure Messaging Apps: Signal, WhatsApp, and iMessage

Not all messaging apps are equal in how they protect your conversations. SMS text messages travel through carrier networks without encryption and are stored on carrier servers. Standard social media messaging — Facebook Messenger, Instagram DMs — stores messages on company servers accessible to the platform, to advertisers, and to law enforcement requests. Secure messaging apps use end-to-end encryption: the message is encrypted on the sender’s device and only decryptable on the recipient’s device — the app provider never holds the decryption keys and cannot read messages even under a legal order. For the bigger picture, our Complete Guide to Online Security and Privacy pulls everything together.

But not all “secure” messaging apps are equal either. They vary significantly in encryption implementation, metadata handling, default settings, open-source status, and data retention policies. Choosing among them requires understanding these distinctions.

What end-to-end encryption actually means

The core promise: only the sender and recipient can read the message, and the app provider is mathematically excluded from the decryption chain. When a message is sent through a properly E2E-encrypted app, it’s encrypted on the sender’s device using the recipient’s public key before transmission. The only key that can decrypt it is the recipient’s private key, which never leaves the recipient’s device. The app server relays an encrypted payload it cannot read.

The Signal Protocol — developed by Open Whisper Systems and published as open-source — is the cryptographic standard underlying the most trusted secure messaging apps. It provides not only message encryption but forward secrecy: each message uses a new encryption key derived from previous session keys, meaning that even if an attacker eventually obtains one key, they cannot use it to decrypt previous messages. Signal itself, WhatsApp, and Google Messages (when both parties use Android) all use the Signal Protocol. A published, audited protocol is a meaningful credibility indicator — proprietary encryption systems in messaging apps are historically associated with security failures.

Metadata is the second dimension that separates secure messaging apps. Metadata — who communicated with whom, when, how frequently, and from which IP address — reveals relationship networks and behavioural patterns even when message content is unreadable. Signal’s privacy-first design minimises metadata retention: it cannot produce communication records because it doesn’t store them. WhatsApp, by contrast, collects significant metadata (contact lists, usage patterns, device identifiers) shared with Meta’s advertising infrastructure — even though message content is E2E encrypted. For most casual users, WhatsApp’s encryption is sufficient; for users with specific privacy concerns, Signal’s metadata minimisation makes it clearly superior.

Secure messaging apps — comparison table

Telegram requires specific attention. Telegram is widely described as a “secure messaging app” but this characterisation is misleading for most use cases. Telegram’s default group chats and channels are NOT end-to-end encrypted — they’re stored on Telegram’s servers in a form Telegram can access. Only explicitly-initiated “Secret Chats” are E2E encrypted, and these cannot be used in group chats. Users who believe Telegram provides secure messaging for their group discussions are typically wrong unless they’re using Secret Chats specifically.

Setting up and using secure messaging apps effectively

Signal setup:

1. Download Signal from the App Store or Google Play
2. Register with your phone number (required — Signal uses phone numbers as identifiers)
3. Enable a Signal PIN (Settings → Account → Signal PIN) — this protects account registration information in case of SIM swap or phone number compromise
4. Set disappearing messages as the default (Settings → Privacy → Default Timer) — this automatically deletes messages after a configured period on both devices
5. Enable “Note to Self” for securely storing notes and files across devices

WhatsApp — making it as secure as possible:

• Enable E2E encrypted backup: Settings → Chats → Chat Backup → End-to-end encrypted backup → Turn on. Store the encryption key in the password manager — losing it means losing access to restored backups.
• Restrict who can see your profile photo, About, and Last Seen: Settings → Privacy → set each to “My Contacts” or “Nobody”
• Disable read receipts if privacy matters: Settings → Privacy → Read Receipts → Off
• Review linked devices periodically: Settings → Linked Devices — remove any devices you don’t recognise

iMessage considerations: iMessage is only E2E encrypted between Apple devices — iPhone, iPad, Mac. When you send a message to an Android phone, it falls back to SMS (indicated by the green bubble instead of blue). For mixed iPhone/Android households or teams, use Signal or WhatsApp — both are cross-platform and maintain E2E encryption regardless of the recipient’s device type.

Backup security — the gap that undermines E2E encryption

If messages are backed up to iCloud or Google Drive without additional encryption, they exist on cloud servers in a form that can be accessed through legal process to the cloud provider — even if the messages were E2E encrypted in transit. This is the most common way that “secure” messaging turns out to be less secure than assumed.

• Signal: does not back up messages to cloud services by default. On Android, Signal offers a local encrypted backup option. On iOS, messages are on-device only unless explicitly backed up. The trade-off: if you lose or replace your phone without migrating the app, conversation history is lost.
• WhatsApp: backup to Google Drive (Android) and iCloud (iOS) is optionally E2E encrypted since 2021 — enable this option. Without it, backed-up messages are accessible to Google/Apple and through legal process to them.
• iMessage: iCloud backup includes message history by default. If iCloud backup is on, your iMessages are in iCloud and accessible through iCloud legal process. Advanced Data Protection (Settings → [Your Name] → iCloud → Advanced Data Protection) extends E2E encryption to iCloud backup, including iMessages.

Disappearing messages — underused but important

Disappearing messages automatically delete conversation history after a configured period — from one hour to one week — on both devices. They don’t prevent screenshots or other capture, but they significantly reduce the persistent record of a conversation if a device is later accessed without authorisation.

• Signal: Settings → Privacy → Default Timer — set this for all new conversations; can also be set per-conversation
• WhatsApp: the “disappearing messages” option in each conversation; can also be set as default in Settings → Privacy → Default Message Timer
• iMessage: Settings → Messages → Keep Messages → 30 Days or 1 Year (not as granular or automatic as Signal/WhatsApp, but limits message retention)

For sensitive discussions, disappearing messages in combination with E2EE provide the most complete protection that secure messaging apps can offer — content that is both encrypted in transit and not persisted beyond what’s needed.

Which secure messaging app to use — the practical answer

The primary friction point in secure messaging adoption is convincing contacts to download and use a different app. Starting with the most security-conscious contacts, demonstrating Signal’s usability through actual use, and migrating gradually is the most successful adoption pattern.

• Signal: for maximum privacy — journalists, activists, healthcare providers, lawyers, and anyone whose communication content warrants the strongest available protection
• WhatsApp: pragmatic choice for most users — E2E content encryption with mainstream adoption where most contacts already have the app installed
• iMessage: appropriate for all-Apple households and organisations, with Advanced Data Protection enabled for iCloud backup

The most important shift: moving away from unencrypted SMS and from non-E2E platforms (standard Telegram chats, Facebook Messenger without secret conversations) for any communication that warrants confidentiality. Our guide on securing your email covers the encrypted email options for file-based secure communication, and our guide on secure file sharing covers the tools for sending documents securely alongside secure messaging. For the technical specification of the Signal Protocol’s forward secrecy implementation, Signal’s Double Ratchet documentation explains the cryptographic mechanism in technical detail.

Secure messaging for groups and organisations

Group secure messaging introduces additional complexity. Signal supports E2E encrypted group chats with the same forward secrecy as individual chats. Group membership, message history, and the group’s existence are all protected by the same cryptographic model.

For small teams and households: Signal group chats or WhatsApp group chats (E2E encrypted) are appropriate for most sensitive group communications. Set disappearing messages on group chats as well as individual conversations.

For organisations requiring more sophisticated control: collaborative communication platforms with enterprise E2E encryption are increasingly available. Wire for Business provides E2E encrypted team communication with administrative controls. Element (based on the Matrix protocol) provides self-hosted or cloud-hosted E2E encrypted team messaging with integration options. Both are alternatives to platforms where server-side access to message content is a compliance or security concern.

One consideration for any group: the security of a group chat is limited by the security of every member’s device. A group with twelve members where one has an unpatched device with poor screen lock practices is less secure than the encryption itself might suggest. For genuinely sensitive group communications — legal, medical, security-sensitive business — limiting group size to the minimum necessary participants reduces this risk.

Verifying contacts’ identity — the safety numbers check

End-to-end encryption guarantees that only the person with the matching private key can decrypt your messages — but it doesn’t automatically confirm that the phone number or username belongs to who you think it does. A sophisticated attacker could theoretically intercept the key exchange if they controlled the communication infrastructure (a man-in-the-middle attack).

Signal provides a mechanism to verify this: Safety Numbers. In any Signal conversation: tap the contact’s name → View Safety Number. This generates a string of numbers (and a QR code) unique to the key exchange between you and that specific contact. If you verify these numbers with your contact in person (or through a separate trusted channel), you can confirm that no intermediary has intercepted the key exchange. Our guide on Secure Home Office Setup covers an adjacent issue.

This verification is optional and not necessary for everyday secure messaging. It becomes relevant for the most sensitive communications — journalists verifying source identities, lawyers confirming client communication, security researchers sharing sensitive findings. For most users, Signal’s default verification through the known phone number/contact is sufficient for the threat models they face. See also Secure File Deletion for a related case.

Secure messaging is one of the most accessible privacy improvements available — Signal downloads in under a minute, setup takes five minutes, and from that point every conversation with another Signal user is automatically protected with the strongest available encryption. The friction is social rather than technical: the limiting factor is whether contacts are willing to use the same app. Starting with the contacts whose communications most benefit from protection, and treating the mainstream adoption of WhatsApp as the fallback for contacts who won’t use Signal, provides a practical path to meaningfully more secure messaging without waiting for perfect coverage. You might also run into Secure Password Reset.