Signal vs Telegram: What "Encrypted" Covers by Default
Published October 13, 2026· By Juan Martinez
Signal encrypts every chat end to end. Telegram does it only in secret chats and calls. How that changes what the servers hold, what you can sync and who pays.
Signal vs Telegram is asked as “which one is more private”, and both apps encrypt your chats. The word covers different things in each. In Signal, every chat, group chat and call is end-to-end encrypted by default. In Telegram, ordinary chats and group chats are encrypted between your app and Telegram’s servers, and Telegram keeps the keys; end-to-end encryption covers only secret chats, which you start by hand, and calls.
That one difference shapes most of the others. It decides whether the company’s servers hold the keys to your history and whether that history follows you to every device.
Signal is rated 8.2 and Telegram 5.2. Signal is ahead in four categories out of five, with the widest gaps in Cryptography & Protocol (9.5 against 4.0) and Metadata Privacy (6.5 against 3.0). Telegram is ahead in Usability & Reach, 9.0 against 8.0.
| Signal | Telegram | |
|---|---|---|
| Rating | 8.2 | 5.2 |
| E2EE by Default | All chats | Only if switched on |
| Group Chat E2EE | All groups | No |
| Protocol | Signal protocol | MTProto |
| Sign-up Needs | Phone number | Phone number |
| Metadata Protection | Sealed sender | Standard |
| Client Source | Open | Open |
| Server Source | Open | Closed |
| Backups | Encrypted cloud backup | Cloud storage, provider holds keys |
| Multi-Device | Needs primary phone | Independent devices |
| Jurisdiction | United States | British Virgin Islands |
| Funding | Donations | Mixed |
| Platforms | Windows, macOS, Linux, Android, iOS | Windows, macOS, Linux, Web, Android, iOS |
Want to compare every field side by side? Open the full comparison table.
Signal vs Telegram encryption: what is covered by default
Signal encrypts chats with its own messenger protocol, the Signal Protocol. Every chat and every call is end-to-end encrypted by default, and group chats are encrypted the same way. Signal has no unencrypted mode, and its privacy policy states that Signal cannot decrypt or access the content of messages or calls. The protocol provides forward secrecy and post-compromise security, and since September 2023 its key agreement combines a classical algorithm with a post-quantum one, so an attacker has to break both.
Telegram uses its own protocol, MTProto 2.0. Ordinary one-to-one chats and group chats, which Telegram calls cloud chats, are encrypted between the app and Telegram’s servers with AES-256 and SHA-256. The messages are then stored encrypted in Telegram’s cloud, and the decryption keys stay with Telegram. Telegram states that this data sits in data centers controlled by different legal entities in different jurisdictions, with the keys split into parts, so that several court orders from different jurisdictions would be needed to force it to hand the data over.
End-to-end encryption in Telegram is opt-in. A secret chat has to be started by hand, and only you and the other person can read its messages. Secret chats exist only between two people, so group chats are never end-to-end encrypted. A secret chat is tied to the device where it was started, its messages cannot be forwarded, and logging out deletes it. Official apps replace a secret chat’s key after 100 messages or a week of use and discard the old one, which gives secret chats forward secrecy. Voice and video calls in Telegram are end-to-end encrypted, as they are in Signal.
The practical result is a trade. Telegram’s default chats can follow you to any number of devices because Telegram’s servers hold the history and the keys. Signal’s servers cannot read its chats, and its linked devices depend on your phone, as covered under daily use below. Signal scores 9.5 on Cryptography & Protocol and Telegram 4.0.
What the servers see
Both apps require a phone number to sign up; in both, the number is the sign-up identifier. Both offer usernames that let people message you without knowing your number. In Signal, the number has not been visible to everyone by default since February 2024, though people who already have it saved still see it, and Signal has no searchable directory of usernames.
The phone-number requirement is also where Signal’s security incident happened. In summer 2022 a phishing attack gave an attacker access to the customer support console of Twilio, the company that verifies phone numbers for Signal. For about 1,900 Signal users, the attacker could have re-registered their number on another device or learned that the number was registered with Signal; one of three users the attacker searched for reported that the account had been re-registered. Message history, contact lists and profile data were not accessed. This is the incident in Signal’s data breach history. Signal recommends turning on registration lock in the app settings.
Both apps also pass your contacts to their servers in some form to find which of them use the app, a process called contact discovery. Signal’s privacy policy says the app may send contact information to the server in hashed form, so the server still receives data derived from your address book. Telegram stores your up-to-date contacts on its servers so it can notify you when one of them signs up.
During a conversation, Signal uses sealed sender, a form of metadata protection that, as Signal describes it, hides who is sending a message from Signal’s servers. The servers still see who receives each message and the IP address of the connection. Signal’s privacy policy lists no telemetry or crash-log collection. Signal publishes seven government requests; for the October 2016 grand jury subpoena, it provided only the date and time the account was registered and the last date it connected to the service. Metadata Privacy, at 6.5, is still Signal’s lowest score.
Telegram’s privacy policy states that it may keep your IP address, devices, the Telegram apps you used and your username history for up to 12 months, and may disclose the IP address and phone number to authorities in response to a legal request, after a legal analysis of that request. Automated algorithms may analyze messages in cloud chats to stop spam and phishing, and moderators may check messages reported to them. Telegram’s FAQ states that it has “disclosed 0 bytes of user messages to third parties, including governments.” Telegram scores 3.0 on Metadata Privacy.
Open code and who has checked it
The full source code of the Signal apps and the Signal server is open source on GitHub, with the server under the GNU AGPLv3 license. All official Telegram apps are open source too, under the GNU GPL, but the server code is not published. Telegram’s FAQ argues that publishing it would give no security guarantees, because users cannot verify that the same code runs on the servers.
Both apps support reproducible builds, which let you build the app from the public code and compare it with the copy on your phone. Signal documents this for Android only, since version 3.15.0. Telegram has supported it since version 5.13 and calls the process experimental; on iPhone the check needs a jailbroken device, about 90 GB of free space and a macOS virtual machine with Xcode.
The independent work on record for both apps is academic research on the protocol, not an audit commissioned by either company. For Signal, five researchers published a formal analysis of the protocol at the IEEE EuroS&P conference in 2017 and concluded “We have found no major flaws in the design”. For Telegram, four researchers presented an analysis of MTProto 2.0 at the IEEE Symposium on Security and Privacy in 2022. They described four attacks: two on the protocol specification, a timing side channel in three official apps, and an attack on the server’s key exchange that breaks its authentication and allows a man-in-the-middle attack. The same paper proves a modified variant of the protocol secure.
Signal scores 8.5 on Transparency & Verifiability and Telegram 6.5.
Who runs each app and who pays for it
Signal Messenger LLC, based in California, runs Signal, and the Signal Technology Foundation, a US 501(c)(3) nonprofit, holds the trademarks. Telegram Messenger Inc. provides Telegram, and its parent, Telegram Group Inc, is located in the British Virgin Islands.
Signal’s funding model is grants and donations, and the service started with a loan from Brian Acton. Signal shows no ads and states that it cannot be acquired by a tech company. In November 2023 Signal estimated its running costs at about $50 million a year by 2025, which donations and grants have to cover.
According to Telegram’s FAQ, founder and CEO Pavel Durov financed Telegram through most of its history. Since 2021 Telegram has shown Sponsored Messages in public channels, and since 2022 it has sold a Premium subscription. Ads are chosen by the language of the content and a location approximated from your phone number or IP address. Telegram states that it does not use the contents of private chats or contact lists for ad targeting, and that private messaging will stay free, with no ads and no subscription fees.
Signal scores 8.5 on Funding & Sustainability and Telegram 6.0.
Daily use: where Telegram is ahead
Telegram scores 9.0 on Usability & Reach and Signal 8.0. Both have apps for Android, iPhone, iPad, Windows, Mac and Linux, and both have voice and video calls. Telegram adds two web versions that run in a browser.
The bigger difference is multi-device use. In Telegram you can sign in on as many devices as you like at the same time, and each one works on its own, with the cloud chat history synced to all of them. In Signal, a desktop app or an iPad links to your phone, up to five linked devices; the phone has to come online at least once every 30 days, or the linked devices are unlinked, and a linked device that stays inactive for 45 days is unlinked as well. Telegram’s sync covers cloud chats only: a secret chat stays on the device where it was started, so choosing end-to-end encryption in Telegram means giving up that convenience for the chat.
The two apps also keep your history with a different backup model. Telegram stores cloud chat history in its cloud, encrypted with keys that stay with Telegram, so a new device gets the full history after sign-in. Signal Secure Backups are locked with a 64-character recovery key generated on your device and never shared with Signal’s servers. If you lose the key, the backup is lost, and Signal cannot recover it. The free tier keeps all text messages and the last 45 days of media, up to 100 MiB; for $1.99 a month the paid tier keeps older media, up to 100 GB.
What we didn’t compare, and why
How many of your contacts use each app. The scores measure platforms, devices and everyday features, not the size of each network. Which app the people you write to already use is often the deciding factor, and only your own contact list answers it.
Telegram channels, bots and public communities. Telegram is also a platform for public channels and groups. This article covers private messaging, where the encryption question applies; channels appear here only as the place where Telegram shows Sponsored Messages.
Blocking in specific countries. Neither review covers whether the app works in countries that restrict messengers, so it is not compared here. Messengers that sign you up without a phone number are reviewed in the messengers section.
Bottom line
Read the full Signal review if you want every chat, including group chats, to be unreadable by the company that runs the service, without having to switch anything on. The code of the apps and the server is public, and a nonprofit runs it on donations. You still give Signal a phone number, its servers still see the recipient of each message and your IP address, the independent analysis on record covers the protocol, not the apps or the server, and your linked computer is unlinked if the phone does not come online for 30 days.
Read the full Telegram review if you want your full chat history on any number of phones, tablets, computers and browsers at once, and you accept that Telegram’s servers hold that history and the keys to it. Start a secret chat for anything that should stay between two people, and keep in mind that it stays on one device, is lost when you log out, and does not exist for groups. Telegram also stores your contacts, may keep your IP address and devices for up to 12 months and may disclose your IP address and phone number to authorities on a legal request.