The debate is old and, over the years, WhatsApp, Telegram and Signal have gained new features, and changed their rules of use and privacy policies several times. Far from being the only option for sending secure messages, the trio are easily among the most popular mobile messaging apps. Check out the comparison between the three main messengers on the market below and choose the most secure one.
WhatsApp was launched in February 2009 in California (USA) by two former Yahoo! employees, Jan Koum and Brian Acton. Created at the time to work “only with plain text”, it was sold for almost US$ 20 billion to Facebook in 2014 — and has incorporated many new features since then.
Telegram came a few years after the launch of WhatsApp, in 2013. It was founded by brothers Nikolai and Pavel Durov, also founders of VKontakte, the largest social network in Russia and a competitor to Facebook — popularly known as VK, the Russian Orkut.
Signal, endorsed by names such as Edward Snowden and Jack Dorsey (CEO of Twitter), is the result of the work of an independent group of software developers called Open Whisper Systems, led by Moxie Marlinspike. The relationship with Brian Acton, co-founder of WhatsApp, in addition to his dissatisfaction with the messenger, is more financial. He invested US$50 million of his own money to kickstart the Signal Technology Foundation, a completely non-profit organization. Today he is the interim CEO of the messaging platform.
Differences between WhatsApp, Telegram and Signal
Each of the messengers brings different aspects and positions on various subjects that can be seen more easily in the table below:
| Telegram | Signal | ||
| Funding / Supporter | Goal | Pavel Durov | Signal Foundation and donors |
| Collects user data | ✔️ | ✔️ | ❌ |
| Types of data collected from users | Purchases / Financial Information / Location / Contact Information / Contacts / User Content / Identifiers / Usage Data / Diagnostic Data | Contact Information / Contacts / Identifiers | Contact information |
| Encrypts metadata as well | ❌ | ❌ | ✔️ |
| End-to-end encryption enabled by default | ✔️ | ❌ | ✔️ |
| Messages can be read by the app company | ❌ | ✔️ | ❌ |
| Creating an account in the application anonymously | ❌ | ❌ | ❌ |
| Allows you to use a secondary authentication factor | ✔️ | ✔️ | ❌ |
| There are messages that can self-destruct | ✔️ | ✔️ | ✔️ |
| Independent code audit and security analysis | ❌ | ✔️ | ✔️ |
Popularity
WhatsApp is in the eye of a hurricane of criticism over its use of data for advertising purposes after announcing a change in its privacy policies. The app already shares a lot of data with its parent company. In addition, there is no shortage of cases of instability in the messenger.
Meanwhile, Signal and Telegram are seeing record spikes in new users, significantly increasing the costs of operations for both.
But not everyone is there yet, after all, you can’t choose your own messenger. There’s no point in liking app “A” if all your contacts and friends are on app “B”, right? For it to work, everyone needs to be on the same platform. That’s the basics.
The revolt also affects small businesses that saw WhatsApp as a channel to sell their products/services and feared a stampede.
Features offered
On WhatsApp you can do practically everything: send messages, photos, videos, documents, contacts, location, make payments, create groups, make video or voice calls, and send audio messages.
But it doesn’t stop there. The messenger also includes the following features:
- reactions with emojis to messages (a feature that was already featured on Telegram);
- migration of conversations between Android and Apple devices;
- sending self-destructing messages;
- WhatsApp Premium for Business;
- voice call with up to 32 people;
- video calls with up to eight people;
- in-app chat support;
- WhatsApp Web;
- among other resources.
Now let’s move on to Telegram. There you can also create chat groups, send messages, audio messages, send photos, videos and other files, make voice and video calls, and create secret chats. In addition, the messenger has:
- auto-delete feature so that messages are deleted after a time period defined by you;
- creation of Bots;
- hide the last seen;
- edit messages;
- multiple account management;
- transmission channels;
- between others.
Finally, we have Signal. It also allows you to share texts, voice messages, photos, videos, GIFs and files for free, hold group conversations with threads, and make video calls with up to 16 people.
In Signal you can also change the wallpaper and use animated stickers and, just like in Telegram and WhatsApp, you can also send self-destructing messages.
Business model
Much of the discussion about the use (or not) of messaging apps is about the business model. It’s not that WhatsApp was born with a completely different mindset from Telegram and Signal, but the intentions have clearly adapted.
In 2019, Mark Zuckerberg, CEO of Facebook, wrote an article distributed to several media outlets such as the Wall Street Journal, Le Monde and Folha de S.Paulo.
According to Facebook, In Mark Zuckerberg’s view, for Facebook to remain free, it is necessary to work with advertisers and this is only possible because of the investment they make.
“People always tell us that if they’re going to see ads, they want them to be relevant to them. That means we need to understand what they’re interested in,” he said.
The interesting thing about this excerpt is that understanding what people want is about collecting, processing and using user data to fine-tune the delivery of relevant ads.
The 2016 terms of use already provided for the use of WhatsApp data on Facebook — and, in 2021, with a wider scope. The more data the social network is able to collect and process, the more accurate the ads it displays on the apps are, generating more sales for advertisers and a greater financial return for the advertising division.
And it’s because of this change (and a bit of misinformation) that there has been a lot of outrage among users, with people wanting to leave the app.
Meanwhile, Signal and Telegram offer open-source applications and are institutions maintained by donations from the founders themselves and groups interested in maintaining them without aggressive monetization.
Signal makes it clear that it operates “without ads or trackers .” From the beginning, the group promised not to monetize user data or display ads. But Brian Acton’s investment helped Signal get started, and the foundation now also relies on donations to fund itself.
Telegram has a very similar approach, supported by Pavel Durov’s harsh public criticism of big tech companies like Google and Facebook. Durov has mentioned that he plans to make it sustainable — not the same as profitable.
“For most of Telegram’s history, I have paid for the company’s expenses out of my personal savings. However, as Telegram continues to grow, it is on track to reach billions of users and will require adequate funding,” he explained.
As a way to make money, Telegram now works with premium features and an advertising platform for public channels, without interfering in private conversations.
Security (encryption)
Let’s be fair, all WhatsApp chats have end-to-end encryption (as do Signal’s), unlike Telegram which only offers it in secret chats.
But if we delve a little deeper into the discussion, to understand the encryption processes for each — including backup encryption — we can shed more light.
WhatsApp’s end-to-end encryption works like this: messages exchanged between sender and recipient are encrypted in such a way that they become unreadable to everyone except the two parties involved in the conversation.
This lock is there to ensure that no one is able to spy on the content of your conversations. The update, however, affects communications between individuals and companies.
Here is a point of interest:
“WhatsApp considers end-to-end encryption to be used for conversations with businesses that use the WhatsApp Business app or that independently manage and store customer conversations. Once received, messages will be subject to the company’s privacy practices, which may require certain employees or service providers to process and respond to those messages.
Some businesses will be able to choose Facebook, WhatsApp’s parent company, to securely store and respond to customer messages. Meta will not automatically use your messages to deliver targeted ads, but businesses will be able to use conversations with you for marketing purposes, including ads…”
As long as you’re chatting with friends, nothing changes. But when the conversation involves businesses using WhatsApp Business, the decision is no longer yours.
In its privacy policies, WhatsApp also states that it may collect, use, retain and share data when it believes it is legally necessary, including investigations into possible violations. And what data would that be? Message metadata, which is not encrypted (data about who you spoke to and when, the message header), and is used to prevent spam and misuse.
Telegram
Telegram works with two layers of encryption :
- regular chats (private or group) go through the cloud and offer what we call “server-to-client” encryption;
- Secret chats use what we call “client-to-client” (end-to-end) encryption.
They have their own protocol: MTProto. But if all of the chats are stored in the cloud, how does Telegram guarantee that they are still secure?
According to the FAQ, secret chats do not contain any data that could be leaked or shared with governments or anyone else because they do not exist. And to protect data that is not covered by end-to-end encryption, Telegram uses what it calls a “distributed infrastructure.”
“Cloud chat data is stored in multiple data centers around the world, controlled by different legal entities spread across different jurisdictions. The relevant decryption keys are split into pieces and are never kept in the same place as the data they protect. As a result, multiple court orders from different jurisdictions are required to compel us to give up any data,” they detail.
It is thanks to this structure that Telegram guarantees, among other terms, that no government or bloc of countries with similar ideals can have access to the messages.
“Telegram can only be forced to hand over data if an issue is serious and pervasive enough to pass scrutiny under multiple different legal systems around the world. To date, we have disclosed 0 bytes of user data to third parties, including governments,” they explain.
Telegram is also challenging anyone — curious, hacker or nonconformist — who claims that messages in the app’s cloud (common chats) can be deciphered or intercepted to prove it in a real challenge in which they can win US$300,000.
Signal
Signal uses end-to-end encryption on everything, starting with its own Signal protocol. WhatsApp also uses the same protocol in its code, but it didn’t create it.
The messenger guarantees that it was developed to never collect or store “any type of sensitive information”, including your contact list, which is not read by the app.
“The only Signal user data we have, and the only data the US government obtained as a result [of a 2016 Virginia lawsuit], is the account creation date and the last use date — not user messages, groups, contacts, profile information, or anything else),” he says.
Signal explains the process in detail in a post about privacy. The fact that Signal keeps little (or almost nothing) about what passes through its network represents a fundamental difference in how the institution thinks about concepts like privacy.
“We believe that security and privacy are not about responsibly managing the data under our control, but rather about keeping your data out of the hands of others – including ours,” they preach.
Please note that text messages, images, files, and any other content exchanged via Signal are stored locally on your device; there is no cloud. The security is there: if I don’t save this data, it can’t be compromised.
Backup of messages and information
Everyone who has ever needed to recover WhatsApp messages knows that there is a cloud backup. This is great news if you need to change your phone (including changing your cell phone number). For this to happen, this recovery file needs to be stored somewhere. In this case, it is in iCloud (iPhone) and Google Drive (Android).
This is where end-to-end encryption goes down the drain. The cloud itself is responsible for protecting these files and they can be read by those who manage it (Apple and Google). Regarding this, WhatsApp has made available the feature of protecting conversation backups with a password, which is especially important in the case of a cloned WhatsApp.
Telegram, on the other hand, sends everything to its own cloud. This allows you, for example, to start writing a message on one device and finish it on another. But this only works in regular chats. In secret chats, messages are stored locally and can self-destruct if requested.
Telegram is responsible for protecting what goes into the cloud, and users need to trust the Durov brothers in the same way they trust WhatsApp, Google, and Apple. However, Telegram does not have a history as troubled as Facebook.
What’s left is Signal, which doesn’t leave much to be desired. The messenger doesn’t have cloud backup, and that’s it. Everything is stored locally on your phone. When you reinstall the app, it even tries to recover messages that are already on the device.
When this is not possible, the user starts from scratch. If you have your old phone, you can still transfer the messages locally, as a package. Account transfer does not happen if: you do not have your old phone; you have wiped your phone, your phone has been lost or stolen and/or your number has changed.
Why is encryption important in messengers?
Encryption is a protection that goes beyond the password, that is, it provides more secure communication, as only those who have it with the algorithm will be able to access the content, which makes it effective and necessary for protecting messages from the eyes of third parties.
It is a system that brings more confidentiality and integrity to applications and services.
What do the experts say?
Fabio Assolini, senior security analyst at Kaspersky, makes some important considerations when choosing a messenger that is “as secure as possible” when necessary.
The first is the use of the mobile number as an ID. The information is practically public nowadays, as it is available to all members of WhatsApp groups, social networks, business cards and in the address books of several people. It is very easy to find the user.
Another observation is to understand the authentication method on new devices. In the case of WhatsApp, it is via SMS. This allows account theft through social engineering or SIM Swap (when there is no double authentication, a bad habit that is still very common).
“A security-first app needs authentication via a unique ID — not based on a phone number —, a password, implementation of a second authentication factor, end-to-end encryption, and verification of the authenticity of contacts. A good comparison site for choosing a secure messaging app is the Secure Messaging Apps Comparison website. In this sense, we can say that apps like Signal and Threema offer more security features than WhatsApp itself,” summarizes Assolini.
WhatsApp, Telegram or Signal: which is better?
You can always rethink the use of these apps. And maybe you will choose (when analyzing the features) a specific app that is not the most popular. I understand that it is natural for users to rethink the use of certain platforms, especially when it comes to security and not just features.
WhatsApp offers end-to-end encryption for the content of conversations but has questionable aspects regarding backup and metadata encryption. With the new privacy policy, the app will collect a lot of information and share it with Facebook, which has a history full of controversies.
Telegram doesn’t use data for advertising purposes and has many of the features you’d expect from WhatsApp, but it doesn’t have end-to-end encryption by default for all conversations, and you’ll need to remember to always enable it using the secret chat.
Signal is the safest alternative, as it combines end-to-end encryption on all chats with no data usage for advertising, but you may miss out on fun features or not find many of your friends on the app.
No one is getting rid of WhatsApp any time soon…
I think it’s hard to be 100% WhatsApp-free. At some point, a store, a service provider, or even a friend or family member will only have WhatsApp, the most popular app, installed on their phone, and it might be useful to keep it on your smartphone. What you can do, as a suggestion, is to start using Telegram or Signal for sensitive topics.
It is worth remembering, however, that no application is entirely free from cybercrime or snooping by those who have physical access to the smartphone. The greater number of scams involving WhatsApp is directly linked to its popularity; opportunity makes the thief. It is not (and will not be) surprising that, with a possible migration of users to other messaging applications, scams will also begin to appear there.
Do all three messengers have a web version?
Yes. All three messengers have a web version if you want to use them on your computer. WhatsApp has a web and desktop version, as does Telegram. Signal only has a desktop version.
Do all of them have paid templates?
Only WhatsApp and Telegram have paid plans, both with extra features. WhatsApp’s plan is aimed at businesses, while Telegram Premium is aimed at all users of the platform, whether they have a business account or not.
Can I delete my account? What happens?
Yes, you can delete your account on WhatsApp, Telegram and Signal.
When you delete your account on WhatsApp, for example, you will not be able to regain access to it. In addition, your data shared with Facebook will also be deleted. However, the information and data that other users have about you, such as the messages and photos you have sent, will not be affected.
On Telegram, all your data will also be deleted, but groups created by you can still be used by other members, and your contacts will still have a copy of the messages you have sent.
On Signal, when you delete your account, you are no longer recognized as a user. The messenger warns that simply deleting messages does not remove your account, just as deleting conversations and alerts does not make you leave the groups.
Can I transfer messages from one to the other?
Yes, you can. We have tutorials explaining how to transfer conversations from WhatsApp to Telegram; Telegram to WhatsApp; Telegram to Signal; and WhatsApp to Signal.
