Bluesky

Is Bluesky safe?

For most adults, yes, as long as you treat it as what it is: a public square. Bluesky does not show personalised ads and does not track you across other apps, and Apple's privacy label lists only contact details, user ID and your content, all for running the app. We score it 70/100, far ahead of X at 37 and Threads at 46.

The weak points are elsewhere. Your posts, likes, follows and even your blocks are public data on the AT Protocol, the open system Bluesky runs on. Direct messages are not end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary. And two-step login only offers a code by email.

What is public on Bluesky?

More than most people expect. The privacy policy says plainly that "most user activity is public by design", listing posts, profile, likes, following and blocks. Bluesky's own notes on its anti-toxicity tools add that removing yourself from someone's quote post, or hiding a reply, is also public data that developers can read through the API.

This is the price of an open network. Any app or service can read the public data, which is why you can switch to another client or move your account to another server and keep your followers. It also means a deleted post may already have been copied by a third-party feed, archive or researcher. Bluesky can delete it from its own servers, not from everyone else's.

There are no private accounts. If you need a locked profile, Bluesky does not offer one.

Are Bluesky DMs encrypted?

No. Bluesky launched direct messages in May 2024 without encryption and said it intended to add end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary later. The privacy policy, last updated in August 2025, still says DMs "are unencrypted and can be accessed for Trust & Safety purposes". When you report a message, moderators see it and the surrounding conversation, and in rare cases the team may open DMs to look into spam or coordinated harassment. We found no announcement that this has changed for DMs or group chats.

By default only people you follow can message you. You can change that to everyone or no one.

On account security, Bluesky added email codes as a second login step in May 2024. We found no option for an authenticator app or security key. No breach of user data has been reported. In April 2026 a DDoS attack caused intermittent outages of feeds, notifications and search, and Bluesky said it saw no evidence of access to private data.

How Bluesky handles harassment and child safety

Bluesky grew from 25 million to 41 million users in 2025, and moderation grew with it. Its 2025 transparency report lists 9.97 million user reports, 16.49 million labels applied and 2.45 million accounts or posts taken down, with moderation running around the clock. Most takedowns hit spam networks, impersonators and ban evaders.

On child safety, Bluesky uses hash matching (Thorn's Safer tool) to divert known abuse images before anyone sees them. In 2025 it sent 5,238 reports to the US National Center for Missing and Exploited Children and removed 6,502 posts for child safety violations.

Adult content is allowed if it carries a label that lets users hide it. Age checks depend on where you are. In the UK, since July 2025, users who do not verify that they are adults lose access to adult content and DMs. In August 2025 Bluesky blocked Mississippi entirely rather than check every user's age under that state's law, then restored access for verified adults in December. In other places a 13-year-old can sign up with no check at all.

Bluesky says that after it started down-ranking toxic replies in October 2025, daily reports of anti-social behaviour fell by about 79%. Harassment still happens, mostly as pile-ons in replies and quote posts.

How to use Bluesky more safely

1. Turn on two-step login with email codes in the account settings, and use a strong, unique password for that email account too.
2. Keep DMs limited to people you follow, and move sensitive conversations to Signal.
3. Assume likes, follows and blocks are visible to anyone with basic technical skills.
4. Use reply controls and quote-post detaching on posts likely to draw a crowd.
5. Find Friends, which matches phone contacts, is opt-in. Bluesky stores the numbers only as hashed pairs, but skip it if you want to keep your account separate from your phone number.

How we scored it

Privacy (75) and regulatory record (92) are Bluesky's strongest factors: no ad tracking, little data collected and no fines found. Security (60) is held back by unencrypted DMs and email-only two-step login rather than any breach. Scams and harmful content (55) reflects an open public network where moderation is active but age checks are patchy.