7.1 Messaging applications

Encryption is not invisibility

Messaging apps are full of promises: "end-to-end encryption", "private by design", "disappearing messages". Useful protections, but none of them is invisibility.

An encrypted message can still reveal who spoke to whom, when, on what device and for how long. That alone can build a detailed picture of your life while the actual words stay unreadable.

Knowing what encryption does and does not hide is the difference between reasonable confidence and false comfort.

End-to-end encryption, explained without mystique

End-to-end encryption (E2EE) means only the people in the conversation can read the contents. The app provider, the mobile network and anyone watching the connection should see only scrambled data.

How it usually works:

• each device creates long-term identity keys and short-lived session keys;
• your app encrypts the message with the session key;
• the recipient's app decrypts it with its matching key.

So even if a company is compelled to hand over stored messages, an E2EE service should only be able to hand over unreadable ciphertext.

In real life this shields ordinary conversations from routine collection or accidental exposure: a journalist arranging an interview, a doctor following up with a patient, a parent sharing sensitive details with a school. A genuine benefit.

Myth: E2EE hides everything. Reality: it is a strong lock on the message contents, not a cloak around the conversation's existence.

E2EE also depends on the endpoints. If one person's phone is compromised, the attacker reads messages after they are decrypted on the device. That is not a failure of the encryption; decryption has to happen somewhere. The fix is boring but effective:

• keep devices updated;
• use device passcodes;
• avoid sideloaded apps you do not trust;
• lock down backups.

Metadata exposure: the trail around the message

Metadata is information about the communication, not the content. It covers:

• who you messaged, when and how often;
• the size of messages;
• the device used;
• sometimes location indicators, such as IP addresses.

A service that cannot read your messages may still store metadata and share it under lawful requests or internal policy. In the UK, telecoms and service providers can be required to retain certain data under specific legal regimes. That does not mean access is constant or casual, but metadata can be a significant exposure.

Two examples:

• A worker in a small company messages a union representative in the evenings for a few weeks. Content encrypted; the pattern of contact is enough to infer the topic.
• A domestic abuse survivor moves house and uses a private chat app to arrange help. With no content at all, a consistent pattern can reveal ongoing contact with support services.

You can cut the trail, with trade-offs:

• some services minimise stored metadata by design, and some let you hide contact discovery or reduce logging;
• prefer apps with published, audited policies on metadata retention;
• every extra device on the same app leaves its own connection trail, so keep sensitive conversations on a single device;
• turn off optional extras such as location sharing and read receipts.

None of this makes you invisible. It just produces less information about you.

Group chat risks: the weakest link is real

Group chats are great for family updates, projects and community organising. They are also riskier than one-to-one chats, because every member is a potential point of failure. Anyone can copy text, forward screenshots or leave their phone unlocked. Once decrypted, a message is ordinary text on a device, and no technical control forces a human to keep it private.

Group membership is itself sensitive. Many apps record who belongs to a group and when they joined, which can be revealing for a professional group, a support group or a local campaign. As groups grow, accidental exposure gets likelier:

• a new member may not understand the context;
• someone may be on an old handset with poor security;
• at work, an employee's device management policy may archive messages or back them up to a company system.

The fixes are mostly social and procedural:

• keep groups small where sensitivity is high;
• agree clear boundaries on forwarding and screenshots;
• avoid posting details that would harm someone if shared;
• use "admins only" settings for membership changes to prevent surprise additions.

Got a sensitive file? Ask whether it should be sent at all, or whether a more controlled channel suits it better.

Disappearing messages and the lure of false safety

Disappearing messages limit what remains on a device if it is lost or accessed later. Handy. But they do not:

• stop a screenshot, a photo of the screen, or text copied elsewhere;
• necessarily erase server-side logs or backups;
• reach a recipient's phone backup, or a linked device that has not come online to receive the deletion command.

A message can vanish from the app and still exist somewhere else.

Treat them as a convenience feature, not a security guarantee. A landlord arranging access to a property might set a short timer so door codes do not sit in chat history for months. That cuts casual exposure if a phone is borrowed or sold. It does not stop intentional misuse: if the recipient wants to keep the code, they can.

Match the tool to the risk. Use disappearing messages to cut clutter and accidental retention, not to protect you from a determined recipient or a compromised device. If keeping a record at all would be unsafe, the safest option may be not to send it, or to use a channel with tighter operational control.

Choosing between the main apps

Principles are nice; most people want to know which app to actually use. The differences between the popular ones are real, not cosmetic. What matters most is not the slickest interface but how much each protects by default beyond the message contents, because metadata and defaults are where the real differences lie. An honest comparison beats a vague "use something encrypted".

Signal: the strongest mainstream choice.

• End-to-end encrypted by default.
• Run by a non-profit with no advertising business.
• Code open to inspection.
• Deliberately engineered to hold as little metadata as possible, so even when compelled it has very little to hand over.

If your threat model includes the metadata concerns above, Signal is the sensible default.

Signal added automatic key verification in August 2026: from a contact's View Safety Number screen, you can start a key-transparency check that complements manual safety-number comparison. A successful check helps detect an unexpected key substitution. It does not authenticate a contact's real-world identity or secure a compromised endpoint.

WhatsApp: good encryption, more metadata. It applies the same underlying encryption to message contents by default, a genuine strength given its enormous user base. But it is owned by Meta and collects considerably more metadata about who you talk to and how, exactly the category of data this page warns about. Reasonable for everyday conversations and far better than an unencrypted channel, but not equivalent to Signal on metadata.

iMessage: check the bubble, then check again.

• Blue (Apple to Apple): end-to-end encrypted.
• Green via SMS or MMS: not end-to-end encrypted.
• Green via RCS: RCS conversations can use beta end-to-end encryption on iOS 26.5 and later, when every participant and network provider supports it. Apple shows Encrypted and a lock icon when that protection is active.

So a green bubble alone proves neither encryption nor its absence. Messages stored through cloud backup have also faced the encryption pressures described in 17.5.

Telegram: handle with care. It is often assumed to be private. It is not, by default:

• ordinary chats are not end-to-end encrypted;
• only opt-in "secret chats" are;
• group chats never are.

Believing Telegram protects you the way Signal does is a costly error, exactly the kind this page exists to prevent.

The takeaway: prefer a service that is end-to-end encrypted by default and minimises metadata, check the protection actually shown for each conversation, and build good habits with a strong app now rather than later. The legal pressure on these services, set out in 17.5, is why it is worth doing now.

Putting the pieces together in daily life

For most people in the UK, the goal is not secrecy from everyone but a sensible reduction of risk. E2EE is a strong baseline that stops intermediaries mass-reading your messages. What is left sits in metadata, group dynamics, device security and human behaviour, all manageable once you acknowledge them.

A realistic setup:

• a reputable app with E2EE on by default;
• your phone kept updated;
• as few devices logged in as possible;
• caution about what goes into large groups;
• disappearing messages for chats that do not need archiving, accepting they are not magic.

If your context changes (a new job with stricter device monitoring, say, or someone else controlling your phone plan), reconsider how much exposure you can accept. Privacy in messaging is not a switch; it is a set of decisions made in context.