Signal vs WhatsApp vs iMessage: which messaging app is most private?

End-to-end encryption means a message is scrambled on your phone and only unscrambled on the recipient's. The company running the service cannot read it in transit or on its servers. Signal and WhatsApp both use the Signal Protocol, developed by the team behind Signal. Apple's iMessage uses its own protocol, and Apple has added protections designed to hold up against future quantum computers.

So for the content of a chat with someone using the same app, all three are strong. The differences are in everything around the message.

Encryption hides what you said. Metadata is who you talked to, when, how often and from where, and it can reveal a lot on its own.

Signal is designed to keep almost none. When served with a grand jury subpoena, Signal says, "the only information we can produce in response to a request like this is the date and time a user registered with Signal," plus the date the account last connected (Signal's published subpoena responses). It also offers usernames so you can chat without sharing your phone number.

WhatsApp's privacy policy describes collecting usage and log information, device and connection information and, depending on settings, location information, and sharing some information with other Meta companies. Apple's iMessage collects less than WhatsApp but Apple does keep some service data; its privacy policy sets out what.

A message that is end-to-end encrypted in transit can sit unencrypted, or encrypted with a key the cloud company holds, in your phone's backup. This is the single most important setting on this page.

WhatsApp

Chat backups go to iCloud (iPhone) or Google Drive (Android). WhatsApp offers end-to-end encrypted backup, but it is not on by default. Turn it on in Settings, Chats, Chat backup, End-to-end encrypted backup, and protect it with a password or a 64-digit key you store safely; if you lose both, the backup cannot be recovered.

iMessage

Under Apple's standard protection, iCloud Backup is encrypted but Apple holds the keys. Messages in iCloud is end-to-end encrypted, but, as Apple explains, when iCloud Backup is on, "your backup includes a copy of the Messages in iCloud encryption key." Turning on Advanced Data Protection makes iCloud Backup end-to-end encrypted, including that key. You set up a recovery contact or recovery key first, and Apple cannot help you recover data if you lose access. It is not offered in every country.

Signal

Signal does not drop your chats into an ordinary cloud backup. Its own backup and transfer options are encrypted, and you choose whether to use them.

iMessage only works between Apple devices. A message from an iPhone to an Android phone goes as SMS, which is not encrypted at all, or as RCS. In May 2026 Apple and Google began rolling out end-to-end encrypted RCS between iPhone and Android, starting in beta and with supported carriers, so it has not reached everyone. An encrypted conversation shows a lock or an Encrypted label. If you do not see one, treat the chat as readable by your carrier.

Text-message codes for logins travel the same unprotected way, one reason to move important accounts to an authenticator app or passkey (see two-factor authentication).

• For sensitive conversations: Signal. It is free, keeps almost no metadata and has disappearing messages.
• For everyday chat with friends abroad: WhatsApp is fine for content, with encrypted backup switched on.
• Within an all-Apple family: iMessage, ideally with Advanced Data Protection.

The strongest encryption does not help if someone has your unlocked phone. Set a strong passcode and check the guides for iPhone and Android. If you think someone is reading your messages through your phone itself, see how to check for stalkerware. For more, see the privacy hub.