How to Choose a Private Messenger

01 What the label doesn't tell you

"End-to-end encrypted" has become a marketing phrase as much as a technical one. WhatsApp has used it for years; so does iMessage. The phrase describes one specific thing — that the contents of your messages can't be read in transit by the service provider — and it says nothing at all about everything else. Who built the app, where it's incorporated, what it logs, and whether the code has been independently audited: none of that is covered by three words on the app store page.

So start with encryption, yes, but treat it as the floor, not the ceiling.

The Signal Protocol is the gold standard: open, audited, and now licensed inside apps far beyond Signal itself. If a messenger uses it — or an equally well-reviewed alternative — you can trust the math. If an app uses "military-grade" or a proprietary scheme it won't name, treat that as a red flag. Serious cryptographers publish their work for others to break.

02 Five questions worth asking

1. What metadata does it collect?

This is where most "private" messengers quietly fall short. Even if your message contents are sealed, the service may still know who you talk to, how often, at what times, and from which IP address. That pattern can be extraordinarily revealing — sometimes more so than the content itself. Signal collects almost none of it by design. Telegram collects significantly more than most people assume. Metadata is the thing that survives even good encryption, and it's worth reading the privacy policy with that specifically in mind.

2. Is the code open source — and has it been audited?

Open source means experts outside the company can inspect the code and verify that the encryption works the way the app claims. An audit goes further: an independent security firm actively looks for flaws and publishes findings. Signal is open source and regularly audited. iMessage is neither. "Trust us" is not a substitute for transparency, and a company that treats its security code as a trade secret is making a choice about what it prioritises.

3. Does it require a phone number?

A phone number is a real-world identity. If the service needs one to register, it has a way to connect your account to you, and — under a lawful order — to hand that connection to a third party. Some messengers are moving away from this: Signal now supports usernames that let you communicate without exposing your number to contacts. Telegram requires a phone number. Wire and Briar allow registration without one entirely.

4. Where is the company, and who owns it?

Jurisdiction matters. A messenger incorporated in the United States is subject to US law, including national security letters that can compel data disclosure without the company being permitted to tell you. Signal is run by a nonprofit foundation in the US, but its minimal-data architecture means there's very little to compel. Telegram is incorporated in the UAE with servers distributed across jurisdictions — an unusual structure that has raised its own questions. If a company has a well-funded parent with advertising interests, that is worth knowing.

5. What happens if your device is seized?

Encrypted transit means nothing if someone picks up your phone and opens the app. Disappearing messages — timed deletion on both ends — limit the historical record available. A strong app lock (PIN, biometric, with a short auto-lock timeout) matters too. Some messengers let you set a passphrase that means even the app vendor can't decrypt local storage. These are hygiene choices you control; the question is whether the app gives you the tools to make them.

Some messengers are moving away from this: Signal now supports usernames that let you communicate without exposing your number to contacts.

03 A practical shortlist

For most people serious about privacy, Signal remains the benchmark: open source, audited, minimal metadata, nonprofit-backed, with disappearing messages and screen-lock options built in. Matrix-based apps like Element offer decentralisation and self-hosting for those who need more control at the cost of some convenience. Wire suits professional use cases where a phone-number-free account matters.

No app is perfect. But a messenger that scores well across all five questions above is offering something meaningfully different from one that only scores on the first. "Encrypted" without "audited," "minimal metadata," and "transparent ownership" is a partial promise — and partial promises are exactly how privacy theatre works.

These notes are part of an ongoing field guide — corrections and additions are welcome at the desk.

◆ People & organisations