The top 5 most secure encrypted messaging apps

The role of end-to-end encryption

When people send messages to each other, they intend for them only to be read by those involved in the exchange. However, since those messages are sent through third-party applications and stored on third-party servers, it is possible that the content of any message is saved externally and is, therefore, accessible outside of the initial exchange. If those servers are breached, private information is at risk.

Some apps offer end-to-end encryption (E2EE) for text-based communications to address this. E2EE uses a cryptographic public key that is only available at the transmission's endpoints. The key encrypts the message before it's sent into an unreadable format; only the recipient's device shares the key and can decrypt it. The encrypted format cannot be accessed or edited en route to its destination or once received, so the contents will not be captured even if the message is saved on a third-party server.

End-to-end encryption offers a more private and secure communication method, excluding unwanted parties from viewing the information. However, it doesn't cover all the data shared during messaging; metadata can still reveal private information, such as when and where a message was sent. Moreover, the providers may not be transparent about when or how they apply encryption, such as whether it is turned on by default or whether they store unencrypted backups on their servers.

Other important security considerations for messaging apps

Encryption is a great start, but many security-minded messaging apps are introducing additional layers of protection for their customers. Messages are vulnerable to unauthorized exposure, so the safest apps will address those at the source. Here are the security considerations to keep in mind when selecting an app:

• Is personal information required to sign up to the app?
  To create an account on a messaging platform, some applications will request PPI such as a phone number or email address. This could identify the writer of any messages if an external party ever accesses those messages. The most secure apps will not require PII to register.
• Where does the third party store the data?
  Even if messages are encrypted, their data and other account information must be stored somewhere. Private company servers are vulnerable to cyberattacks since they hold so much PII in one place. It is more secure when an app stores data on decentralized servers without a single access point.
• Is the app's encryption code open source or a proprietary code?
  While proprietary code is not inherently bad, the nature of privately developed and owned code means that the encryption protocols are unavailable for audit by external players. Therefore, users must trust that the company is doing what it says. When a messaging app uses open source code, anyone can more confidently review and verify its encryption standards since it is publicly shared.
• Where is the company based geographically?
  Most apps are now available for global use, but the location of the company headquarters will determine which legal jurisdiction it falls under – and, therefore, which surveillance laws are applicable. Users will need to adhere to those surveillance laws, not the ones of their residence, so it's worth knowing in advance.

The top 5 secure messaging apps

Users might be okay with using the default program on their devices for day-to-day texting. However, anyone looking to upgrade the security of their communications should assess the applications according to the criteria listed above. Using those considerations as a metric, the following five applications offer more private messaging services than most competitors.

Briar

Android users have one of the most secure apps available exclusively: Briar. Users don't need to share private data to sign up and E2EE is turned on by default. Briar has also automatically disabled screenshots or screen recordings so users can be confident that their messages are not being captured or shared without permission. There is no central server as Briar uses a peer-to-peer connection system; users can connect using Bluetooth, Wi-Fi or Tor. The company says it was designed specifically for journalists, activists and anyone who needs "safe and robust" messaging; when messaging with geographically close peers, users don't need to be connected to the internet to do so. All software is also open source for encryption verification.

The main downside is that Briar is only available on Android devices. It also only supports text-based communication, not calls or file-sharing, so it is better used in high-stakes situations than casual communication.

Session

Session is a secure messaging service that requires no personally identifiable information when registering an account. It uses open source code and has end-to-end encryption as its default setting, so users can have peace of mind when sending private messages. All data storage is decentralized to reduce the vulnerability of a data breach. Session goes a bit further than some other secure apps by actively minimizing the metadata it collects and using an onion routing network to remove users' digital footprints; onion routing refers to using several layers of encryption for more privacy. It also supports file sharing and group conversations while disabling screenshots by default.

Session can be used on Android, iOS, Linux, macOS and Windows but does not support a browser interface. Critics have noted the sometimes-patchy calling signal and slower texting speeds, so it may not run as efficiently as other messaging services.

Signal

Perhaps the most well-known app on this list, Signal has become popular for its guarantee of E2EE and its comprehensive array of features. Users can text, call and video call in individual and group settings, making it an easy replacement for other messaging apps. It is also possible to use the self-destruct messaging feature which automatically removes texts after a set time, also known as ephemeral messaging. Notably, Signal is a non-profit company, and the company has also publicly committed to never sell, rent or monetize its user data or content in any way. All data is stored locally on user devices, and the code is open source and externally verified.

While there is no web interface, Signal can be downloaded and used on Android, iOS, Linux, macOS and Windows. The main downside is that Signal does require a phone number to register an account, so it is not entirely anonymous.

Threema

Favored by individuals and organizations, Threema is headquartered in Switzerland, a favorable jurisdiction for secure online messaging and services because of its strong privacy and data protection laws. It requires no PII for sign-up and uses open source code for its design. End-to-end encryption is turned on by default and minimal metadata is generated and collected due to its "privacy by design" architecture. All data is stored locally on user devices; Threema deletes every message from its server as soon as it arrives at its intended recipient. The app supports texting, audio calls, voice calls, groups and distribution lists. It also offers a dedicated Work product and several business solutions for comprehensive enterprise use.

Threema is available for download on Android, iOS, Linux, macOS and Windows and can be used through a web client. The main criticism is that it is not free and requires a fee for use.

Wire

Headquartered in Switzerland, Wire is another messaging app with E2EE as its default setting. In addition to E2EE, Wire deploys Secure Real-Time Transport Protocol (SRTP) with Datagram Transport Layer Security (DTLS) for end-to-end calling encryption. This tool is often used in more collaborative and corporate settings since it supports file sharing and group conversations in text, audio and video formats. Wire does not collect or store any unnecessary user data or sell any data to third parties. Current users include tens of thousands of German government employees. Wire's source code is all open source and available for public verification on GitHub.

Wire can be accessed on Android, iOS, Linux, macOS and Windows and through a browser setting. The main security critique is that Wire stores and logs more user metadata than other apps, which could be a vulnerability in a data breach. Signing up also requires an email account.

Madeleine Streets is a senior content manager for WhatIs. She has also been published in 'TIME,' 'WWD,' 'Self' and Observer.'