Signal vs WhatsApp vs Telegram: Which Is Most Private?

Signal is the most private of the three by default: every chat, call and group is end-to-end encrypted automatically, the company says it collects close to no metadata, and it's run by a nonprofit with no ad business to feed. WhatsApp is close behind on encryption — it uses the same underlying protocol as Signal — but it logs far more metadata and shares it across Meta's other apps. Telegram is the outlier: its default "Cloud Chats" are not end-to-end encrypted at all, and only the opt-in Secret Chat mode gets Signal-grade protection. If privacy is the deciding factor, Signal wins; if you're choosing based on who's actually in your contacts, the honest answer is that WhatsApp is "private enough" for most people, and Telegram needs to be used deliberately to be private at all.

How each app encrypts your messages by default

All three apps say they use encryption, but "encrypted" does a lot of quiet work in each company's marketing. The question that actually matters is whether messages are end-to-end encrypted (meaning only the sender and recipient can read them) by default, with no setting to toggle.

Signal end-to-end encrypts every conversation automatically — one-on-one chats, group chats, voice calls and video calls — using the Signal Protocol, which combines the Double Ratchet algorithm with X3DH (and, more recently, a post-quantum key agreement called PQXDH) to give every message forward secrecy. There's no setting to turn this off, because there's no unencrypted mode to fall back to.

WhatsApp licenses that same Signal Protocol and applies it by default to personal messages, group chats and calls, a design it documents in its own security materials. In practice this means a WhatsApp chat between two people gets essentially the same cryptographic protection as a Signal chat the moment it's sent.

Telegram is different, and this is the single most misunderstood fact in any Signal-vs-WhatsApp-vs-Telegram comparison. Telegram's default chats — called "Cloud Chats," which is everything you use day to day, including every group and channel — are protected only by client-server encryption (Telegram's MTProto protocol) between your device and Telegram's servers. Telegram itself can technically decrypt that content; it protects it instead by splitting cloud chat data and decryption keys across data centers in different legal jurisdictions, so (per its own FAQ) a single court order isn't enough to compel disclosure. True end-to-end encryption on Telegram only happens in optional "Secret Chats," which are one-on-one only, tied to a single device, never synced to Telegram's cloud, and not available for groups or the desktop/web apps in the same way as on mobile.

Telegram's cloud chats vs. Secret Chats, explained

Because this trips up so many people, it's worth separating the two Telegram experiences clearly:

• Cloud Chats (the default): synced across every device, searchable, backed up automatically on Telegram's servers, and protected by server-side encryption rather than end-to-end encryption. Telegram's own technical documentation on its encryption model confirms this trade-off was a deliberate choice to keep chat history available on every device without the complexity of multi-device end-to-end key management.
• Secret Chats (opt-in): genuinely end-to-end encrypted, with "no trace on our servers," according to Telegram. They support self-destruct timers on every message type, but they're device-specific — start one on your phone and it won't appear on your desktop app — and they only work one-on-one, never in groups.

The practical takeaway: if you've never manually started a "Secret Chat" inside Telegram, nothing you've ever sent on the app has been end-to-end encrypted.

What metadata each company actually collects

Encrypting message content is only half the privacy picture. Metadata — who you talk to, how often, when, and from where — can reveal almost as much as the messages themselves, and it sits outside the scope of end-to-end encryption on all three services to varying degrees.

Signal has designed its service specifically to minimize this. According to Signal's own transparency page, it does not retain message content, call records, contact lists, group membership, group names, group avatars, profile information or a record of who's talking to whom — the company says its goal is "to have access to as close to no data as possible." A feature called sealed sender goes a step further by stripping the "from" information off the outside of a message envelope so that even Signal's own servers can't see who sent a given message, only where it's being delivered.

WhatsApp collects considerably more. Per its own privacy policy, it logs your phone number, profile name and photo, device information (hardware model, operating system, battery level, signal strength), IP address, "service-related, diagnostic and performance information," and — if you opt in — your uploaded contacts. WhatsApp also explicitly shares information with other Meta companies to improve its products, personalize experiences and support business integrations, though it notes this policy does not extend to the EU because of GDPR.

Telegram's metadata footprint sits in between the two, and it's shaped by its distributed-server design rather than a minimization philosophy. It stores cloud chat content, contacts and security metadata like IP addresses and device identifiers for up to 12 months for anti-abuse purposes, as described in its privacy policy. Accounts that go 18 months without activity are deleted by default, along with their data.

Who actually owns Signal, WhatsApp and Telegram

Corporate structure shapes incentives, and the three companies could not be more different.

Signal is built by Signal Messenger LLC, which is wholly owned by the nonprofit Signal Technology Foundation, a 501(c)(3) established in 2018 by Moxie Marlinspike and WhatsApp co-founder Brian Acton, according to Wikipedia's summary of the company's history. Acton left Facebook after it acquired WhatsApp and personally loaned the new foundation $50 million to get it running. Signal carries no advertising and has no shareholders to satisfy with user data, which is why its privacy stance is structural rather than just a policy promise.

WhatsApp has been owned by Meta Platforms (formerly Facebook) since Facebook's $19.3 billion acquisition closed in February 2014 — still, by most accounts, the largest acquisition in the company's history, per Wikipedia. Meta monetizes WhatsApp primarily through business messaging and advertising tied to the broader Meta ecosystem, which is the commercial logic behind sharing WhatsApp account data across its other apps.

Telegram is run by Telegram FZ-LLC, a private company registered in the British Virgin Islands with operational headquarters in Dubai, founded in 2013 by brothers Pavel and Nikolai Durov. It is not a nonprofit; Telegram has funded itself through a roughly $1 billion-plus bond sale to investors and, more recently, through sponsored messages and Telegram Premium subscriptions, according to Wikipedia's entry on the company. Pavel Durov was arrested and briefly detained in France in August 2024 in connection with alleged failures to moderate criminal content on the platform, a development that preceded Telegram's policy shift on law-enforcement cooperation described below.

Signal vs. WhatsApp vs. Telegram: the privacy comparison at a glance

Disappearing and self-destructing messages

All three apps offer some form of self-erasing messages, but the defaults and scope differ meaningfully. Signal lets you set a disappearing-message timer from 30 seconds up to four weeks on any chat, and you can configure a default timer that automatically applies to every new conversation you start — though it's off by default until you turn it on. WhatsApp offers 24-hour, 7-day and 90-day options and, since 2021, lets you switch on disappearing messages by default for all new chats you initiate. Telegram's self-destruct timer is most powerful inside Secret Chats, where it applies to every message type and triggers the moment a message is read on the recipient's device; in ordinary Cloud Chats, the timer only applies to media, not text.

Backups: where your chat history actually lives

Backups are where a lot of "end-to-end encrypted" claims quietly fall apart, because a backup stored in a cloud service is only as private as its own encryption. Signal's backups are encrypted independently of the cloud they might pass through: on-device backups are protected by a 30-digit passphrase you generate yourself, and Signal's newer cross-device Secure Backups feature uses a 64-character recovery key that Signal says it never receives or stores — losing it means losing the backup, because there's no recovery path through the company.

WhatsApp's backups historically were not end-to-end encrypted at all; chat history stored in iCloud or Google Drive was protected only by whatever encryption Apple or Google applies to their own cloud storage, which those companies — not WhatsApp — can typically access. WhatsApp rolled out optional end-to-end encrypted backups, secured by a password or a 64-digit key, starting in 2021, but it remains something you have to turn on rather than a guaranteed default for every account.

Telegram's Cloud Chats are backed up automatically and continuously to Telegram's own servers by design — that's the entire point of the cloud-chat model, and it's why your history shows up instantly on a new device after you log in. Secret Chats sit outside that system entirely: Telegram says it keeps no server-side copy and no logs of secret-chat messages, which also means they can't be recovered if you lose the device they were created on.

What each company can hand over to law enforcement

Because Signal says it doesn't collect most data in the first place, its own published record of government requests shows it has repeatedly been able to hand over only two data points in response to a subpoena: the date an account was created and the date it last connected to Signal's servers. Message content, contacts and group data simply aren't there to produce.

WhatsApp's message content is protected by the same end-to-end encryption whether or not a legal request arrives, but the metadata it does collect — account details, some device and usage information — can be disclosed under valid legal process, the same way most large platforms respond to court orders and subpoenas.

Telegram's position changed materially in September 2024. For years, the company publicly stated it had "disclosed 0 bytes of user messages to third parties, including governments." Following Pavel Durov's arrest in France, Telegram updated its privacy policy to state that if it receives a valid order from relevant judicial authorities confirming a user is a suspect in a case involving activity that violates Telegram's Terms of Service, it will disclose that user's IP address and phone number to the authorities, and will publish the number of such disclosures in a quarterly transparency report. Message content inside Cloud Chats could, in principle, still be reached by a sufficiently coordinated set of legal orders across the jurisdictions where Telegram splits its data, since — unlike Signal and WhatsApp content — it isn't end-to-end encrypted in the first place.

Bottom line: which should you actually use?

If privacy against both the company itself and against legal demands is your top priority, Signal is the clear choice: encryption by default everywhere, a nonprofit structure with no advertising incentive, and a data-retention policy that leaves almost nothing to disclose even when compelled. For most everyday use with friends and family who are already on it, WhatsApp is a reasonable middle ground — your message content gets the same strong encryption as Signal, even if the surrounding metadata feeds into Meta's broader ad ecosystem. Telegram is the one to use deliberately rather than by default: treat Cloud Chats as you would an ordinary messaging app with server-side storage, and reserve Secret Chats for anything you specifically want end-to-end protected, remembering they only work one device and one conversation at a time.

In practice, many people end up using more than one of these apps — Telegram for large public channels and group discovery, WhatsApp because that's where their contacts already are, and Signal for anything genuinely sensitive. Whichever you choose, locking down the account itself matters just as much as the app's encryption model: enable two-step/two-factor verification where each app offers it, and consider stronger account security such as setting up passkeys on your phone wherever that's supported, since every one of these apps ties your identity to a phone number that's a common target for SIM swap attacks. It's also worth periodically checking whether your phone number or email has shown up in a breach tied to any linked account, using a free tool like Have I Been Pwned.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage