In an era where much of our personal, professional, and political lives unfold over digital channels, the apps we use to communicate matter more than ever. Yet, when choosing a messaging app, most people focus on convenience and features, overlooking a far more important distinction: security and privacy are not the same thing. Understanding this difference is key to explaining why apps like WhatsApp and Facebook Messenger are deeply problematic, and why alternatives like Signal, Session, and Threema are far better choices for those who value their digital autonomy.
Security vs. Privacy: What’s the Difference?#
When evaluating a messaging app, it’s crucial to understand that security and privacy are two distinct, yet equally important, concepts. While they’re often used interchangeably, conflating them can lead to a false sense of protection, especially when using apps that only address one of them.
Security is primarily concerned with protecting the content of your communications. Its goal is to ensure that your messages, calls, files, and reactions can only be accessed by the people you intend to see them. This means shielding them from eavesdroppers in transit, preventing unauthorized access while stored on devices or in backups, verifying the identity of the person you’re speaking to, and ensuring messages haven’t been tampered with along the way. End-to-end encryption (E2EE) is widely considered the gold standard for this, as it mathematically guarantees that only the sender and recipient can decrypt the content, rendering it unreadable to internet service providers, network attackers, or even the messaging service itself.
Privacy, on the other hand, goes beyond message content and focuses on controlling what others can learn about you and your communications as a whole. Even if an app can’t read a single word of your messages, it can still collect an immense amount of metadata about them. This can include who you message, when you message them, how often you do so, the length and frequency of your conversations, your IP address and approximate location, your device information, your phone number, your online status, read receipts, typing indicators, and even the full scope of your social graph. When aggregated over time, this seemingly innocuous data can reveal incredibly intimate details about your routines, relationships, political beliefs, profession, and day-to-day life. In many ways, metadata can be just as revealing as the content itself, and it’s often far easier to collect, correlate, and monetize at scale.
The key distinction lies in the question being asked. Security asks, “Can anyone read this message?”. Privacy asks, “Can anyone learn that this message was sent, by whom, to whom, when, and from where?”. These are two different threats, and protecting against one doesn’t inherently protect against the other.
This is precisely why an app can be considered secure while still being profoundly invasive to your privacy. For example, a platform could implement flawless E2EE to protect message content, but still require your real phone number, log every connection to its servers, track your IP address, and build detailed profiles of your behavior to fuel its business model. These are not theoretical concerns, but the reality for many of the world’s most popular messaging apps. True digital autonomy requires addressing both, not just one.
Why WhatsApp and Facebook Messenger Are a Security and Privacy Nightmare#
WhatsApp#
WhatsApp is often cited as “secure” because it uses the Signal Protocol for end-to-end encryption by default. While this does protect message contents from eavesdroppers, it does not protect your privacy from WhatsApp itself or its parent company, Meta. The encrypted messages are only one piece of the puzzle, and WhatsApp’s design and business incentives create numerous privacy and security vulnerabilities beyond content encryption.
One of the most significant concerns is its massive metadata collection. Even though WhatsApp cannot read the content of your messages, it still logs who you communicate with, when those conversations take place, how frequently you interact, for how long, and from what device and IP address. This metadata is collected at scale, stored by Meta, and can be used to build incredibly detailed behavioral profiles. Over time, patterns of communication can reveal your closest relationships, work habits, political affiliations, and daily routines—information that is often more revealing than the messages themselves.
Another fundamental issue is how tightly WhatsApp ties your account to your real identity. Registration requires a valid phone number, which immediately links your account to your SIM card, your real name (if tied to your carrier or contacts), and by extension, to Meta’s broader ecosystem. This eliminates any meaningful anonymity and makes it trivial to correlate your messaging activity with your offline identity, especially when paired with the address book uploads that occur during setup.
This identity linkage is compounded by Meta’s business model conflict. While WhatsApp has long claimed it doesn’t show advertisements directly in chats, its parent company, Meta, generates the vast majority of its revenue through targeted advertising. The metadata and behavioral signals collected by WhatsApp feed into Meta’s wider profiling apparatus, creating a powerful incentive to maximize data extraction wherever possible. This structural tension between user privacy and advertiser interests is one of the core reasons why WhatsApp’s privacy promises have eroded over time.
Beyond metadata and identity, WhatsApp also has glaring technical weak points that many users are unaware of. By default, chat histories are backed up to Google Drive (on Android) or iCloud (on iOS). These cloud backups are not end-to-end encrypted unless the user explicitly enables WhatsApp’s “end-to-end encrypted backup” feature. This means that if someone gains access to your cloud account, or if those providers are compelled to hand over data, years of your message history could be exposed. Many users never enable this setting, leaving a trove of sensitive data vulnerable.
Finally, trust in WhatsApp has been repeatedly undermined by ongoing policy shifts. Over the years, WhatsApp has pushed controversial changes to its terms of service and data-sharing practices, often with confusing opt-out mechanisms or short grace periods. These shifts have consistently prioritized data integration with Meta’s platforms over user control, eroding confidence in the app’s long-term commitment to privacy. Taken together, these issues make it clear that while WhatsApp may protect your message content from casual eavesdroppers, it falls far short of providing true privacy or robust long-term security for those with higher stakes.
Facebook Messenger#
Facebook Messenger is even more concerning than WhatsApp from a privacy standpoint, in large part because its default state provides far less protection for users. For the vast majority of chats, messages sent through Messenger are not end-to-end encrypted. Only a feature called “Secret Conversations” offers E2EE, and even then, it’s entirely opt-in, limited to one device at a time, and lacks many of the features users rely on for everyday communication, such as stickers, GIFs, or seamless multi-device access. This means that by default, the contents of your conversations can be accessible to Meta in a way that they are not on WhatsApp.
This lack of default encryption is only part of the problem. Messenger is deeply integrated into Meta’s sprawling surveillance ecosystem and is a key component of its ad targeting and behavioral profiling apparatus. Usage patterns, contact lists, message frequency, reaction data, and interactions with businesses all feed into Meta’s models to build hyper-detailed profiles of users. These profiles are then used to serve targeted advertisements, not just on Facebook, but across Meta’s family of services and its vast network of partners.
Beyond its integration with ad systems, Messenger engages in extensive tracking that extends far beyond your conversations. It collects device identifiers, IP addresses, operating system details, connection information, and location data if permissions are granted. Even when you’re not actively messaging, the app can gather telemetry that contributes to Meta’s cross-platform tracking. This level of surveillance is designed to follow you across services and devices, making it incredibly difficult to compartmentalize your activity.
Much like WhatsApp, Messenger also lacks meaningful anonymity. It is inextricably tied to your Facebook identity, your phone number, and your real-life social graph. Your contacts, friend lists, groups, and past interactions are all linked to a persistent, identifiable profile that spans years of activity. Finally, the boundaries between Meta’s platforms are notoriously opaque. Data is routinely shared across Facebook, Messenger, Instagram, WhatsApp, and other Meta services, making it nearly impossible for users to isolate Messenger activity from the company’s broader data harvesting practices. As a result, Facebook Messenger often provides neither strong security by default, nor meaningful privacy at all.
In Conclusion#
WhatsApp gives you encrypted messages, but not private ones. Facebook Messenger often gives you neither by default. For anyone concerned about surveillance, profiling, or data exploitation, both apps represent a privacy and security nightmare.
These two are far from the only offenders, however. WhatsApp and Facebook Messenger are simply the most ubiquitous examples of a much wider problem. Many other messaging and “communication-adjacent” apps follow a similar model: they may offer encryption in select contexts, but their business model relies on collecting as much behavioral data as possible. Apps like Instagram DMs (which share Meta’s infrastructure and profiling incentives), Telegram (which does not enable E2EE by default for most chats and collects extensive metadata), and countless other platforms that market themselves as “free” are often designed to monetize their users through targeted advertising, analytics, and data brokerage. Even some seemingly innocuous apps, such as SMS/MMS on many carriers, or certain enterprise chat tools, can expose metadata and lack strong privacy protections. The pattern is consistent: when a product is free and ad-supported, the user is often the product. Beyond business incentives, these apps often optimize for data collection, harvesting both content-related signals and extensive metadata. One of the most telling technical details is key custody—whether encryption keys are stored locally on your devices (giving you sole control), or whether they’re held by the provider or cloud service (creating a potential access point). Apps that can access your keys can, in certain circumstances, access your data. True zero-knowledge designs ensure the provider cannot decrypt your communications, even if compelled.
What to watch out for#
With so many options, it can be difficult to know what to look for. When evaluating any messaging app, consider the following criteria to cut through marketing claims: E2EE should be enabled by default for all conversations, not hidden behind an opt-in “secret” mode. Pay close attention to metadata minimization—does the app need your phone number, email, or address book to function, and does it log connection data like IP addresses, timestamps, or device identifiers? Consider the identity model: can you use it anonymously, or are you forced to link it to a persistent, real-world identity? Look into the business model—if it’s funded by ads or data sales, there’s an inherent conflict of interest. Transparency is also key: open-source code, independent security audits, and clear, readable privacy policies are strong indicators of trustworthiness. Finally, check the cloud backup behavior, multi-device design, where encryption keys are stored (ideally on your devices, not held by the provider), and whether the provider operates under strong jurisdictional protections. Applying these filters will help you identify truly private alternatives, rather than apps that merely pay lip service to security.
The Metadata Problem#
While much of the focus in messaging security is on encryption, metadata is often the largest and most overlooked threat to privacy. Metadata includes the “envelope” information about your communications: who you’re talking to, when messages are sent, how often, message lengths, IP addresses and approximate locations, device identifiers, online status, and your social graph. Unlike message content, this data doesn’t need to be decrypted to be incredibly revealing—it can expose your habits, relationships, and sensitive details all on its own.
Even the most secure E2EE apps can leak metadata if not designed to minimize it. For example, carriers see metadata for SMS/MMS, many cloud services log access times and IPs, and some messengers log contact discovery events. Apps that prioritize metadata minimization (like Signal with features like Sealed Sender, or Session with onion routing) go to great lengths to reduce this footprint. Others, especially those with ad-driven business models, actively collect and monetize it. As a rule of thumb: assume metadata exists unless an app explicitly proves otherwise, and prioritize services that minimize it as much as possible.
A Closer Look at Apple Messages#
Given how ubiquitous it is, Apple Messages deserves a closer analysis. For conversations between Apple devices (iMessage), Apple Messages provides robust end-to-end encryption by default, which is a major strength compared to many cross-platform competitors. Apple also has a long-standing stance of minimizing data collection for iMessage and has published technical details about its implementation.
However, that protection is heavily dependent on context. If you’re messaging someone with an Android device, messages fall back to SMS/MMS, which are unencrypted in transit and expose significant metadata to carriers. With the adoption of RCS on iOS, this is improving, but RCS encryption remains carrier-dependent and does not yet guarantee the same level of E2EE as iMessage in all cases.
Another critical factor is where encryption keys are stored. For iMessage, the cryptographic keys that protect message content are generated and stored locally on your devices as part of Apple’s device-to-device E2EE design. Apple does not hold the keys to decrypt your iMessage conversations. This is the ideal model for security: the keys stay in your control. However, backups complicate this. “Messages in iCloud” can back up your message history, but if you haven’t enabled Advanced Data Protection, those backups are encrypted with keys that Apple holds. That means Apple could technically access your backed-up messages in response to a valid legal order. With Advanced Data Protection enabled, your iCloud backups—including messages—are end-to-end encrypted, so only you can decrypt them, and Apple has no access to those keys. This distinction is crucial, as many users are unaware that their “secure” messages can become accessible via unprotected cloud backups.
Finally, while Apple doesn’t monetize iMessage with ads, it still requires an Apple ID and phone number, linking your identity to its ecosystem. It doesn’t offer meaningful anonymity, and some metadata (such as delivery receipts, routing information, and account activity) can still be generated and logged as part of normal operation. For most users in a closed Apple ecosystem, iMessage is a solid, privacy-respecting default, but it’s not a perfect solution for cross-platform communication, those seeking maximum anonymity, or users who want full control over their backup encryption without explicitly enabling Advanced Data Protection.
Better Alternatives: Proven, Privacy-Focused Messengers#
If you want real protection, you need apps that treat privacy as a design goal, not an afterthought. The following apps have a consistent, proven track record of putting user privacy and security first.
Signal – The Gold Standard for Everyday Use#
Signal is widely regarded as the most secure and privacy-respecting messenger available for general use. Its design is built around minimizing both content exposure and metadata collection.
Security Architecture
Signal’s security is built upon the Signal Protocol, which combines the X3DH (Extended Triple Diffie–Hellman) key agreement with the Double Ratchet algorithm. This provides forward secrecy and post-compromise security, meaning that even if a key is compromised at some point, past messages remain secure and future messages can regain security. The protocol has undergone extensive academic scrutiny, most notably in the formal security analysis by Cohn-Gordon et al.. Signal’s code is open-source and auditable, with repositories available on GitHub.
Key Custody
All cryptographic keys are generated and stored locally on your devices. Signal’s E2EE ensures that only the intended recipients can decrypt messages, and Signal itself has no access to the decryption keys for message content. This is a zero-knowledge approach for content, with key material never leaving the endpoints.
Metadata Handling
Signal is purpose-built to minimize metadata. According to its Privacy Policy and Security & Privacy Guide, the service does not store message contents, contact lists, group memberships, or conversation histories on its servers. The only information that is technically necessary to deliver messages is handled with extreme restraint. A key innovation is Sealed Sender, which hides the sender’s identity from Signal’s servers when delivering messages. Signal also employs private contact discovery to determine which of your contacts use Signal without uploading your entire address book in plaintext.
Further, Signal’s official transparency and government requests information demonstrates its minimal data retention. In practice, the server can only see that a message was sent to a specific account at a certain time for delivery purposes, and with Sealed Sender, even that sender information is obscured. Signal does not log who talks to whom in a retrievable profile, nor does it collect IP addresses for profiling purposes.
Additional Protections
Signal is a 501(c)(3) non-profit, funded entirely by donations (donor information), eliminating the ad-driven incentive to monetize data. It also offers features like disappearing messages, screen security, and is regularly audited.
Best for: Most people who want the strongest balance of security, privacy, usability, and metadata minimization without needing to sacrifice convenience.
Session – Maximum Anonymity with No Phone Number Required#
Session takes a different approach, prioritizing anonymity and metadata resistance above all else. It builds upon established cryptographic primitives, but layers on network-level protections to obscure who is communicating and from where.
Security Architecture
Session uses the Signal Protocol for end-to-end encryption of messages, calls, and attachments. This provides forward secrecy and cryptographic integrity for all communications. Session’s client and protocol are open-source and available on GitHub.
Key Custody
All encryption keys are generated and stored locally on the user’s device. Session is designed to be zero-knowledge with respect to message content—the network cannot decrypt messages. Account recovery is handled without requiring a central identity provider to hold recovery keys in a recoverable form for the user.
Metadata Handling & Anonymity
Session’s most notable differentiator is its focus on network metadata. Instead of relying on centralized servers that can observe IP addresses and connection patterns, Session routes all traffic through an onion-routing network. According to Session’s technical documentation, messages are routed through a decentralized network of service nodes (the Oxen Network), obscuring the sender’s IP address from the recipient and hiding both parties’ IPs from most network observers. This makes it significantly harder to correlate who is communicating with whom based on network metadata.
Crucially, Session does not require a phone number, email address, or any personally identifiable information to register. Instead, it generates a random Session ID (a 66-character public key-based identifier). This removes the primary link to real-world identity found in many other messengers. Session also minimizes data retention on its service nodes, and its design avoids creating a central database of social graphs or contact lists that could be harvested. You can learn more about its approach in the Session FAQ and Session blog posts on privacy.
Additional Protections
Session’s architecture is decentralized, reducing the risk of a single, centralized honeypot of user data. Features such as blinded routing, minimal account linking, and closed group designs further reduce exposure. While onion routing introduces some latency compared to direct connections, it provides a substantial metadata advantage for users with heightened anonymity needs.
Best for: Journalists, activists, or anyone who needs strong anonymity, wants to avoid phone-number-based contact discovery, or is operating in higher-risk environments where IP metadata is a concern.
Threema – Truly Private Communications for Maximum Assurance#
Threema is one of the most privacy-centric messengers available. Its design philosophy is “privacy by design”, with a strict zero-knowledge architecture and a business model that aligns with user interests.
Security Architecture
Threema employs end-to-end encryption for all messages, voice calls, group chats, files, and polls. Its cryptographic implementation is detailed in the Threema Cryptography Whitepaper. Threema uses established algorithms (e.g. Curve25519, XSalsa20, Poly1305) and generates a unique key pair on the device upon installation. The client code is open-source and has been published for audit, with independent security reviews also documented on their security page.
Key Custody
Threema is built around a zero-knowledge model. Private keys are generated and stored exclusively on the user’s device, and are never transmitted to Threema’s servers. The server has no way to access message content, group memberships, contact lists, or profile data. This means that even if Threema were compelled to provide data, there would be no usable content or decryption keys to hand over.
Metadata Handling
Threema is designed to collect as little metadata as possible. As outlined in the Threema Privacy Policy and FAQ on privacy, Threema does not require a phone number or email address to use the app. Instead, users are identified by a randomly generated Threema ID. Contact discovery is opt-in and privacy-preserving—Threema does not upload your entire address book in plaintext by default, and can match contacts without revealing them to the server in invasive ways.
Threema’s servers do not log who communicates with whom, when, or from which IP address in a form that is linked to identifiable communication profiles. While network-level metadata (like IP addresses) is inevitably visible to the servers that route traffic, Threema’s design minimizes the retention and linkability of this data. Furthermore, Threema is a paid app, meaning it has no incentive to collect, analyze, or monetize metadata for advertising purposes—a structural protection for privacy. Its Swiss jurisdiction (under the Federal Act on Data Protection) provides strong legal protections against overreach from foreign surveillance alliances.
Additional Protections
Threema offers features like verification via QR codes to prevent man-in-the-middle attacks, contact privacy controls, polling, distribution lists, and disappearing messages. Its business model (one-time purchase) directly aligns its incentives with its users, and its transparency through audits and open-source code reinforces its claims.
Best for: Users who want the highest level of privacy assurance with minimal data exposure. It’s an excellent choice for those willing to pay a small, one-time fee to avoid the “free” data-exploitation model entirely.
Operational Security (OPSEC) Beyond the Technology#
While choosing the right app is crucial, the technology alone isn’t enough to guarantee your privacy and security. Even the most secure messenger can be compromised by poor habits. Operational security, or OPSEC, is about minimizing your digital footprint and reducing risks in how you actually use these tools.
When it comes to messaging, there are several key practices to keep in mind. First, be cautious with what you share. No amount of encryption can protect sensitive information if you voluntarily send it to an untrusted party, or if the recipient’s device is compromised. Avoid sharing highly sensitive details (like passwords, two-factor backup codes, or private documents) over any messaging platform unless it’s absolutely necessary, and even then, verify the recipient’s identity through out-of-band methods.
Second, verify identities before discussing sensitive topics. Man-in-the-middle attacks are rare on modern E2EE apps, but impersonation isn’t. Use safety numbers, QR code verification, or fingerprint verification features (available in Signal, Session, and Threema) to confirm you’re talking to the intended person, especially if contact details have changed or you’re speaking with someone for the first time in a high-risk context.
Third, pay attention to your device security. Your messages are only as secure as the device they’re on. Keep your operating system and apps up to date, use strong device passcodes or biometrics, enable disk encryption, and be cautious about sideloading apps or granting excessive permissions. If your device is rooted, jailbroken, or infected with malware, E2EE offers little protection against local access.
Fourth, think twice about backups and screenshots. As discussed earlier, cloud backups can undermine E2EE if not properly protected. Disable automatic cloud backups of your messaging history unless you’re using a zero-knowledge backup solution, and always enable Advanced Data Protection where applicable. Similarly, screenshots can be shared without your knowledge, so avoid sending information you wouldn’t want permanently recorded. Consider disabling screenshot previews for sensitive conversations if your app supports it.
Fifth, be mindful of metadata and context clues. Even with the best apps, the context surrounding a conversation can leak information. Avoid revealing your location, schedule, or sensitive affiliations in messages, profile names, or photos. Be careful with group chats, as adding people expands your audience and can expose metadata to more parties. If anonymity is critical, avoid linking your Session ID or Threema ID to your real identity on other platforms.
Sixth, practice good account hygiene. Use unique, strong credentials for associated accounts (like your Apple ID or email), enable multi-factor authentication where possible, and be wary of phishing attempts. Scammers may impersonate support staff or contacts to trick you into revealing information. Remember, legitimate secure messaging providers will never ask you for your decryption keys, recovery phrases, or SMS codes.
Seventh, be aware of location tracking. Even if your messaging app doesn’t track your location, your smartphone itself is constantly generating location data. Cellular towers, Wi-Fi networks, GPS, and Bluetooth beacons can all be used to pinpoint your whereabouts, often with remarkable accuracy. Many apps request location permissions for features you may not need, and background location access can create a detailed timeline of your movements. To mitigate this, disable location services for apps that don’t require them, review your permission settings regularly, and consider using “approximate location” where available. Keep in mind, though, that your mobile carrier still knows your general location based on tower connections, regardless of app settings.
Finally, understand the limitations of your tools. No single app or setting will make you invulnerable. Tailor your OPSEC to your threat model. For most people, using Signal with good device hygiene is more than sufficient. For high-risk individuals, combining anonymity-focused apps like Session with disciplined habits around identity separation and network hygiene (like using a trusted VPN in appropriate contexts) may be necessary. It’s also important to recognize that you can never be truly “off-grid” while carrying a powered-on smartphone. The device itself emits signals (cellular, Wi-Fi, Bluetooth, NFC) that can be used for tracking and triangulation. If you need to be completely untrackable for a period of time, your only reliable option is to power the device off and place it in a properly sealed Faraday bag, or simply leave it behind. Anything less will still leave a digital trail.
Ultimately, technology and behavior must work together. By combining a privacy-respecting messenger with these OPSEC practices, you can drastically reduce your attack surface and reclaim control over both your messages and the story they tell about you.
Final Thoughts#
The choice of messaging app is ultimately a choice about trust. Security stops others from reading your messages. Privacy stops others from profiling your life. WhatsApp and Facebook Messenger may tick the “secure” box in a narrow technical sense, but they fail spectacularly on privacy due to their business models, identity requirements, and metadata collection.
By contrast, each of the alternatives has its own strengths depending on your priorities. Signal offers the best balance of security, privacy, and usability for most people, with industry-leading metadata minimization backed by its open protocol and non-profit model. Session is the strongest option when anonymity is paramount, utilizing onion routing to obscure network metadata in addition to strong E2EE. Threema is the gold standard when you want truly minimal data exposure, a strict zero-knowledge architecture, and no reliance on phone numbers or emails, all under a privacy-aligned, paid model.
For truly secure and private communications, moving away from Meta’s platforms to one of these alternatives isn’t just prudent—it’s one of the simplest and most impactful steps you can take to reclaim your digital privacy. While encryption protects your words, minimizing metadata, preserving key custody, practicing good OPSEC, and choosing a model that aligns with your interests are just as vital to protecting the story of your life as a whole.
References: Signal Protocol Documentation, Cohn-Gordon et al., EuroS&P 2017, Signal Privacy Policy, Signal Security & Privacy Guide, Sealed Sender, Session Documentation, Session GitHub, Threema Cryptography Whitepaper, Threema Privacy Policy, and Threema Open Source.
