WeChat

Is WeChat safe?

For ordinary chat, payments and staying in touch with people in China, WeChat works and is widely used. For anything private, it is one of the weakest messaging choices we cover. Messages are not end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, the encryption it does use is a home-made design that researchers found below modern standards, and accounts outside China have been scanned to feed China's censorship system. We score it 36/100, in the same range as X and Facebook and far below WhatsApp (67) and Signal (92).

The real question for most readers is not whether to use WeChat, since many people have little choice, but what to keep out of it.

Is WeChat monitored?

The best evidence comes from the University of Toronto's Citizen Lab. In its 2020 report "We Chat, They Watch", researchers sent documents and images between accounts registered outside China and showed that they were still subjected to content surveillance. Files flagged as politically sensitive were added to a list used to censor the same files for China-registered accounts. In other words, international users were unknowingly helping to train the censorship system.

Citizen Lab also found that WeChat's privacy policy gave no clear explanation of this surveillance, so users could not know it was happening without running experiments themselves.

Censorship itself mostly applies to accounts registered with a mainland Chinese phone number. Those face blocked keywords, removed posts and, in some cases, suspended accounts. Users abroad who chat with people inside China are affected too, since the same filters apply to what those contacts can receive.

How strong is WeChat's encryption?

There is no end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary for chats, groups, calls or files. Tencent can decrypt content on its servers.

In October 2024 Citizen Lab published the first public analysis of MMTLS, WeChat's own network encryption protocol, used by an app with over one billion users. It is modelled on TLS 1.3 but is closed-source, and the researchers found it uses deterministic initialisation vectors and lacks forward secrecy. They could not build an attack that fully defeated it, but said the design was "inconsistent with the level of cryptography you would expect" at that scale.

The same report found that the Weixin version downloaded from WeChat's website differs from the Google Play version and contains a library that can load new code dynamically. Weixin features such as Search, Channels and Mini Programs also do more tracking than core chat.

What WeChat collects

Apple's privacy label for WeChat has no "Used to Track You" section, but it lists purchase history, coarse location, device ID and advertising data as used for third-party advertising, and credit information and advertising data for analytics. For app features it collects health and fitness data, payment and financial information, precise location, contacts and photos.

The international privacy policy names WeChat International Pte. Ltd. in Singapore as the data controller for most users outside China and the EEA, and says data is stored in Singapore and Malaysia. It says chat messages are deleted from servers shortly after delivery and always within 72 hours. Some data does go to Tencent in mainland China for technical support and for interoperability with Weixin users.

In China, the industry ministry named WeChat in 2021 among 43 apps that had illegally transferred user data and ordered them to fix it.

Who should be careful

• Journalists, activists, researchers and people critical of the Chinese government. Do not discuss sensitive topics on WeChat, even from abroad.
• Business travellers. Keep contracts, pricing and technical files off WeChat. Use a separate phone for China trips if your employer allows it.
• Diaspora families. Scammers impersonating relatives, Chinese police or officials use WeChat to demand payments.

How to use WeChat more safely

1. Install it only from the App Store or Google Play, not from an APK on a website.
2. In privacy settings, require verification before people can add you and limit who can find you by phone number or WeChat ID.
3. Do not save sensitive chats to Favorites, which keeps them on Tencent's servers.
4. Confirm any WeChat Pay request by voice call or in person.
5. Use Signal or WhatsApp for private conversations with anyone who can reach them.

How we scored it

Privacy (25) is the weakest factor: wide data collection, advertising use and documented content surveillance of international accounts. Security (35) reflects the absence of end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary and Citizen Lab's findings on MMTLS. Content safety (50) is the strongest, because WeChat's contact model limits stranger contact, though scams and censorship remain.