Signal

Is Signal safe?

Yes, and it is the safest messenger on our list. Signal encrypts every chat, group and call end to end by default, it shows no ads and runs no trackers, and its App Store privacy label lists a single item: your phone number, not linked to your identity. We score it 92/100.

The weak point is not the code. It is people. In 2025 and 2026, phishing campaigns tricked officials and journalists into handing over their accounts, and Signal's encryption cannot help if you give someone the key.

What Signal knows about you

Very little, and this is testable. Signal publishes the court orders it receives. In a 2016 grand jury subpoena from the Eastern District of Virginia, the only data it could produce was the date and time the account registered and the last date it connected. Later subpoenas and warrants in California (2021 and 2024), an order from Luxembourg (2021) and a 2026 grand jury subpoena in Washington DC got the same answer. Signal says it has no access to messages, calls, profile information, group information, contacts, stories or call logs.

Compare that with WhatsApp, which uses the same encryption for message content but whose label lists contacts, identifiers, usage data and diagnostics linked to you. Encryption hides what you say. Signal also avoids collecting who you talk to and when.

Signal is run by the Signal Technology Foundation, a US non-profit funded by donations. It has no advertising business to feed, which is the main reason it has no reason to collect data.

How strong is the encryption?

The Signal Protocol is the industry reference. WhatsApp, Google Messages and others license it. Signal added post-quantum protection to its key exchange in 2023, so messages captured today should stay unreadable even if quantum computers later break older cryptography.

Its record is not perfect. In August 2022 attackers breached Twilio, the company Signal used to send SMS verification codes, and could have re-registered about 1,900 phone numbers on new devices. Message history was not exposed, because it never sits on Signal's servers. Signal has had no breach of message content.

The real risk: phishing

On 9 March 2026, the Dutch intelligence services AIVD and MIVD warned that a campaign was taking over Signal and WhatsApp accounts of government staff, soldiers and journalists. It used two tricks:

• A fake "Signal Security Support Chatbot" messaged people and asked for their SMS verification code and Signal PIN. With both, the attacker registered the account on their own phone.
• A QR code or link that looked like a group invite but actually linked the attacker's computer to the victim's account, so they could read new messages quietly.

Signal said its "encryption and infrastructure have not been compromised" and that the takeovers came from phishing. For ordinary users the lesson is simple. Signal staff will never message you inside the app asking for a code or PIN.

Who should be careful

Signal's privacy cuts both ways for parents. There is no algorithmic feed and no stranger discovery, so children are unlikely to meet random adults there, but there are no parental controls either and nobody, including Signal, can see chats. If your teenager uses Signal, the conversation matters more than any setting.

People who rely on Signal for sensitive work should know the limits. If someone has your unlocked phone, encryption does not help. And as the March 2025 "Signalgate" episode showed, when a US official added a journalist to a group about military strikes, the app cannot stop you inviting the wrong person.

How to lock down Signal

1. Turn on Registration Lock in Settings > Account. It means nobody can register your number on a new phone without your PIN, even if they get the SMS code.
2. In Settings > Privacy > Phone Number, set "Who can see my number" to Nobody and "Who can find me by number" to Nobody if you only want contact via username.
3. Check Settings > Linked devices every few weeks. Remove any computer or tablet you do not recognise at once.
4. Set a default timer for disappearing messages in Settings > Privacy if you do not need a permanent record.
5. Never scan a Signal QR code that someone sends you in a chat. Real group invites open as links that show the group name before you join.

How we scored it

Signal scores near the top on privacy (96), security (93) and regulatory record (97), with no fines found anywhere. Its lowest factor is scams and harmful content (82), because account-takeover phishing is real and growing. It is the benchmark the other messengers, such as Telegram, are measured against.