Threema

Is Threema safe?

Yes. Threema is one of the safest messengers you can use, and on one point it beats every other app we score: it does not need a phone number or an email address. You get a random eight-character Threema ID, all chats, groups and calls are end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary by default, and the company's own records show it can give police almost nothing. We score it 90/100, just behind Signal.

The trade-offs are practical. Threema costs $6.99 once on the US App Store, fewer of your friends will have it, and since January 2026 it has been owned by a private equity firm rather than its founders.

What Threema knows about you

Apple's privacy label for Threema is short: email address, phone number and user ID, all for app functionality, and crash data not linked to you. The email and phone number are only there if you choose to link them, which lets friends find you through their contacts. Skip that and Threema has no personal identifier for you at all.

Threema's transparency report shows what that means in practice. When a Swiss authority makes a valid request through the official procedure, Threema can provide the date an ID was created, the date of its last login, a hash of a linked phone number or email, and a push token if the user relies on Google or Apple push. Foreign police must go through Swiss mutual legal assistance. Requests have grown fast: 177 in 2023, 306 in 2024 and 423 in 2025, when Threema provided data on 1,505 IDs. The type of data has not changed.

The company is based in Switzerland, outside the EU and US. That is a real difference from WhatsApp, where the encryption is strong but the metadata goes to Meta.

How strong is the encryption?

Threema encrypts messages, files, group chats, voice and video calls end to end, with no option to turn it off. In 2022 it introduced Ibex, a new protocol that added forward secrecy, so a key stolen later cannot unlock past messages.

The apps are open source, and Threema lists outside audits: the Münster University of Applied Sciences in 2019, Cure53 in 2020 and on the desktop app in 2024, and a security analysis of Ibex by the University of Erlangen-Nuremberg in 2023. It also runs a bug bounty.

The most serious outside look came from ETH Zurich. In a paper presented at USENIX Security 2023, Kenneth Paterson, Matteo Scarlata and Kien Tuong Truong described seven attacks on Threema's protocol under three different threat models. They disclosed everything to Threema first, and all the issues were patched. Threema said the findings either no longer applied under Ibex or had already been fixed, and that none had real-world impact. The paper still matters. It showed that Threema's older custom design had weaknesses that well-studied protocols like Signal's avoid.

Outages and ownership

In August 2026 a series of large DDoS attacks took Threema offline for about four hours one evening and caused short interruptions the next morning. A DDoS attack floods servers with traffic. It affects availability, not encryption, and Threema says such attacks give no access to systems or data. It added upstream DDoS filtering on 14 August.

Ownership has changed twice. Afinum bought a majority in 2020. On 12 January 2026 Afinum announced it was selling Threema Holding AG to Comitis Capital, with the management team staying on. Nothing so far suggests a change in how Threema treats data, and the open-source apps make any change visible, but a business model based on paid apps depends on owners who keep it.

Who should use Threema

Threema suits people who want a messenger that is not tied to their phone number: journalists, activists, people leaving an abusive relationship, or anyone who simply does not want their number shared with every group they join. More than 15 governments use it, and many businesses use the Threema Work version.

It is less useful if your contacts are not on it. Threema has chosen not to connect with WhatsApp under the EU's Digital Markets Act, saying the link would weaken privacy. It has no parental controls, and a child with an anonymous ID can be contacted by anyone who has that ID.

Getting the most from Threema

1. Do not link your phone number or email unless you need contacts to find you.
2. Turn on Threema Safe, the encrypted backup, and store its password somewhere safe. Without it, losing your phone means losing your ID.
3. Verify important contacts by scanning their QR code in person. Threema marks verified contacts with three green dots.
4. Lock the app with a passcode or biometrics so someone holding your unlocked phone cannot read chats.
5. Buy Threema only from the official app stores or Threema's own shop.

How we scored it

Privacy (94) and regulatory record (97) are near the top of our scale: minimal data, no phone number required and no fines found. Security (86) is strong but below Signal's, because of the 2023 protocol flaws and the lack of post-quantum protection we could confirm. Compare Proton Mail, another Swiss service with a similar approach to data.