Skip to content
Gallery
Comparison of Messaging Apps from a Security/Privacy POV
Comparison
Charts
Share
Explore

Comparison

Messaging Apps from a Privacy Perspective

View App:
⁠
⁠
Messaging Apps
Name
Score
Company jurisdiction
Infrastructure jurisdiction
Divulged Data
Built-In Spyware
Transparency Report
General Stance
Funding
Company Collects Data
App Collects Data
Default Encryption?
Cryptographic primitives
Client Open Source?
Server Open Source?
Anonymous Signup
Anonymous Contact Adding (without Server)
Can you manually verify contact's fingerprints?
Directory service, could be modified to enable a MITM attack?
Do you get notified if a contact's fingerprint changes?
Is personal information (mobile number, contact list, etc.) hashed?
generate & keep a pkey on the device itself?
Can messages be read by the company?
Does the app enforce perfect forward secrecy?
Does the app encrypt metadata?
Does the app use TLS/Noise
Does the app use certificate pinning?
Does the app encrypt data on the device? (iOS and Android only)
Does the app allow a secondary factor of authentication?
Are messages encrypted when backed up to the cloud?
Does the company log timestamps/IP addresses?
Have there been a recent code audit and an independent security analysis?
Is the design well documented?
Does the app have self-destructing messages?
Allo
0
iMessage
-7
Messenger
-10
Riot/Matrix
12.5
Signal
7.550000000000001
9/30/2014
Skype
-12.5
Telegram
-12
10/31/2015
Threema
14
10/31/2015
Viber
1
Whatsapp
-9
Wickr
5
7/31/2014
Wire
15.600000000000001
2/28/2018
There are no rows in this table
⁠

Top 3:

⁠
⁠
@Wire
⁠
⁠
⁠
@Threema
⁠
⁠
⁠
@Riot/Matrix
⁠
⁠
⁠
⁠

Bottom 3:

⁠
⁠
@Skype
⁠
⁠
⁠
@Telegram
⁠
⁠
⁠
@Messenger
⁠
⁠
⁠
⁠

Some Notes:

⁠
@Signal
⁠
is open source nominally, but the only version that people can use is a binary, available on the app store and on a page on signal's website. There's no way of knowing the binary is the same version as the one who's source we have access to, or wasn't tampered with (maliciously, or due to simple negligence). There is also no way to host the server in a way that communicates with the main signal server, so for all practical purposes, Signal is closed source.
⁠
@Telegram
⁠
says they'll open the server, but they still, a few years later, have not. Telegram also gets a low rating above due to the fact that it doesn't do encryption by default, though it does have the option of secret chats.
The ranking is arbitrary. You can look below to see the score attributed to different vectors. For example, I attribute -5 to Facebook or Google, others might not think they're that evil.
⁠
@Whatsapp
⁠
says they encrypt data, which is probably true as of now, but bear in mind that
Whatsapp's founder left Facebook
⁠
over a feud about user privacy. Bear also in mind that Facebook routinely commits enormous fraudulent breaches of user privacy (they get fined for it, some insignificant millions of dollars every few months).
⁠
@Whatsapp
⁠
stores by default backups on Google's servers. Said backups are not encrypted and are as such readily available for Google to plunder. Even if you turn backups off, it's useless if your correspondent hasn't turned them off too.
⁠
Funding
Funding
Score
Google
-5
Apple
0
Facebook
-5
New Vector Limited
1
Freedom of the Press Foundation
1
the Knight Foundation
1
the Shuttleworth Foundation
1
Open Technology Fund
0
Signal Foundation (Brian Acton)
0
Microsoft
-1
Pavel Durov
0
Crowdfunding
1
Rakuten
0
friends and family of Talmon Marco
0
Gilman Louie
0
Juniper Networks
0
Breyer Capital
0
CME Group
0
Wargaming
0
Janus Friis
0
Iconical
0
Zeta Holdings Luxembourg
0
There are no rows in this table
⁠
General Stance
Stance
Score
✖️ Poor
-1
✔️ Good
1
There are no rows in this table
⁠
Positive Answer Preferred
Answer
Score
✖️ No
-1
✖️ Minimal
-0.5
❓ Somewhat
0
❓ Unknown
0
✔️ Mostly
0.05
✔️ Yes
1
There are no rows in this table
⁠
Negative Answer Preferred
Answer
Score
✔️ No
1
✔️ Minimal
0.5
❓ Somewhat
0
❓ Unknown
0
✖️ Mostly
-0.5
✖️ Yes
-1
There are no rows in this table
⁠
Juridictions
Juridictions
Score
USA
-2
Belgium
0
Finland
0
Ireland
1
the Netherlands
0
Chile
0
Taiwan
0
Singapore
0
AWS
-1
Google Cloud
-1
Denmark
0
Sweden
0
UK
0
Australia
0
Brazil
0
China
0
Hong Kong
-1
Japan
1
Germany
1
Belize
0
Switzerland
1
Luxembourg
1
There are no rows in this table
⁠
Encryption Algorithms
Algo
Score
AES 128
1
AES 256
1
ChaCha20
1
Curve25519
1
Curve25519 256
1
ECDH512
1
ECDSA 256
1
HMAC-SHA256
1
Poly1305-AES 128
1
RSA 1280
1
RSA 2048
1
RSA-1536
1
Salsa20 128
1
SHA-1
1
SHA-256
1
XSalsa20 256
1
There are no rows in this table
⁠
source:
https://www.securemessagingapps.com
⁠
⁠
Want to print your doc?
This is not the way.
Try clicking the ⋯ next to your doc name or using a keyboard shortcut (
CtrlP
) instead.