Signal vs WhatsApp: Same Protocol, Different Metadata
Published October 13, 2026· Updated October 13, 2026· By Juan Martinez
Both use the Signal Protocol and both need a phone number. The difference is what the servers see, whose code you can read, and who pays for the app.
Signal vs WhatsApp is a comparison where the usual question, whose encryption is stronger, has very little to argue about. Both apps encrypt personal chats, group chats and calls end to end by default, and both do it with the same messenger protocol: the Signal Protocol, which Signal develops and WhatsApp also uses. Both also require a phone number to sign up.
The differences sit around the encryption. They are in what the company’s servers learn about who you talk to, how the app finds which of your contacts use it, whether anyone outside the company can read the code, and who pays for the service. Signal is run by a nonprofit and paid for by donations and grants. WhatsApp is one of the Meta companies and shares information with them.
Signal is rated 8.2 and WhatsApp 6.3. Signal is ahead in four categories out of five, with the widest gaps in Funding & Sustainability (8.5 against 4.5), Metadata Privacy (6.5 against 3.5) and Transparency & Verifiability (8.5 against 5.5). WhatsApp is ahead in Usability & Reach, 9.0 against 8.0.
| Signal | ||
|---|---|---|
| Rating | 8.2 | 6.3 |
| Protocol | Signal protocol | Signal protocol |
| Sign-up Needs | Phone number | Phone number |
| Metadata Protection | Sealed sender | Standard |
| Client Source | Open | Closed |
| Server Source | Open | Closed |
| Backups | Encrypted cloud backup | Encrypted cloud backup |
| Multi-Device | Needs primary phone | Needs primary phone |
| Funding | Donations | Parent company |
| Platforms | Windows, macOS, Linux, Android, iOS | Windows, macOS, Web, Android, iOS |
Want to compare every field side by side? Open the full comparison table.
Signal vs WhatsApp encryption: one protocol, exceptions only on WhatsApp
In Signal, every chat and every call is end-to-end encrypted by default, and group chats are encrypted the same way. Signal has no unencrypted mode. The protocol provides forward secrecy and post-compromise security.
Signal has also added post-quantum protection on top of the shared protocol. Since September 2023 its key agreement, PQXDH, combines a classical algorithm with a post-quantum one, so an attacker has to break both. In October 2025 Signal announced a post-quantum ratchet added to the Double Ratchet, which Signal calls the Triple Ratchet, and states that it was formally verified.
In WhatsApp, messages, photos, videos, voice messages, documents, live location, status updates and calls between WhatsApp users are end-to-end encrypted by default, with no setting to turn on. Group chats use the Sender Keys part of the Signal Protocol, and WhatsApp’s technical white paper describes forward secrecy through short-lived keys. Each one-to-one chat has a security code, a QR code and a 60-digit number that two people can compare, and WhatsApp also checks keys automatically through key transparency.
WhatsApp lists its own exceptions. It does not consider chats with Meta services or with businesses that use Cloud API to be end-to-end encrypted. When a business lets Meta store its messages or answer them with AI from Meta, WhatsApp shows this in the chat and does not treat those messages as end-to-end encrypted. Payments and messages with third-party agents are not end-to-end encrypted either. Chats with businesses on the WhatsApp Business app are end-to-end encrypted, but once the business receives a message, the business’s own privacy practices apply.
For a chat between two people, then, the encryption is the same on both apps. Signal scores 9.5 on Cryptography & Protocol and WhatsApp 8.5. WhatsApp scores lower because of the exceptions above and because its encrypted backup is a setting you have to turn on (covered under daily use below).
What the servers see
Neither app lets you sign up without a phone number; in both, the number is the sign-up identifier. Both now offer usernames that hide the number from people who do not already have it saved. Signal added them in February 2024; on WhatsApp they are rolling out gradually and may not be available to you yet. Neither app has a searchable directory of usernames.
The two apps differ in contact discovery, the way an app works out which of your contacts use it. Signal’s privacy policy says the app may send contact information to the server in hashed form. The server still receives data derived from your address book. WhatsApp’s privacy policy says that you provide WhatsApp, where the law allows, with the phone numbers in your address book on a regular basis, including the numbers of people who do not use WhatsApp. WhatsApp states that it handles those non-users so that it cannot identify them.
During a conversation, Signal uses sealed sender, a form of metadata protection that, as Signal describes it, hides who is sending a message from Signal’s servers. Whether it is on by default today is not established. The servers still see who receives each message and the IP address of the connection, and Signal’s 2018 announcement of sealed sender described resistance to correlation by timing and IP address as ongoing work. This is why Metadata Privacy, at 6.5, is Signal’s lowest score. Signal’s privacy policy lists no telemetry or crash-log collection. In one of the seven government requests Signal publishes, a grand jury subpoena in October 2016, Signal provided only the date and time the account was registered and the last date it connected to the service.
WhatsApp states that it deletes messages from its servers once they are delivered. Connections between the app and WhatsApp’s servers run through a separate encrypted channel built on Noise Pipes, which hides metadata from outside observers on the network but not from WhatsApp itself. WhatsApp collects information about your activity, including diagnostic, crash and performance logs, plus device and connection information such as your IP address and mobile network. Its privacy policy describes no setting to turn this collection off. WhatsApp shares information with the other Meta companies and may share it in response to legal process or government requests. WhatsApp scores 3.5 on Metadata Privacy.
Open code against a published description
The full source code of the Signal apps and the Signal server is open source on GitHub, with the server under the GNU AGPLv3 license. The Android app supports reproducible builds since version 3.15.0: you can build the app from the public code and compare it with the copy installed on your phone, and a match shows the installed app came from the published code. Signal documents this for Android only.
The WhatsApp apps and servers are closed source. WhatsApp’s GitHub organization publishes developer tools and infrastructure code, but not the apps or the servers. What WhatsApp publishes instead is a technical white paper, version 9, dated 25 February 2026, which covers the Signal Protocol, group encryption, linked devices and the encrypted connection to the servers. Without the source code, nobody outside the company can check that the apps work as the paper describes.
For neither app does the published independent work cover the messaging code as a whole. For Signal, the independent work is a 2017 formal analysis of the protocol by five academic researchers, presented at the IEEE EuroS&P conference, which concluded “We have found no major flaws in the design”. It covers the protocol, not the Signal apps or server. For WhatsApp, Meta commissioned NCC Group to review two components. In 2023 NCC Group reviewed the library behind key transparency, the feature that checks keys automatically; the report came out on 14 November 2023, and a retest confirmed all findings were fixed. In May 2024 NCC Group assessed the protocol that stores in-app contacts on WhatsApp’s servers; the report page does not summarise the findings. Neither assessment covers the apps’ messaging code as a whole.
On Transparency & Verifiability, Signal scores 8.5 and WhatsApp 5.5. The difference is that Signal’s code can be read and its Android build checked by anyone, while WhatsApp’s design can be read only as WhatsApp describes it.
Who runs each app and who pays for it
Both services are based in the United States. Signal Messenger LLC, based in California, runs Signal, and the Signal Technology Foundation, a US 501(c)(3) nonprofit, holds the trademarks. WhatsApp LLC in Menlo Park, California, runs WhatsApp, and WhatsApp Ireland Limited serves users in the European Economic Area.
Signal’s funding model is grants and donations, and the service started with a loan from Brian Acton. Signal shows no ads and states that it cannot be acquired by a tech company. In November 2023 Signal estimated its running costs at about $50 million a year by 2025, about $14 million of it for infrastructure and about $19 million for staff. Donations and grants have to cover that amount every year.
Meta funds WhatsApp. Messaging is free, and ads appear only in Status and Channels, separate from personal chats and calls; they are rolling out gradually, and a person who uses WhatsApp only for personal messaging does not see them. WhatsApp also shares information with the other Meta companies.
Signal scores 8.5 on Funding & Sustainability and WhatsApp 4.5, the widest gap between the two.
Security incidents on record
Both apps have an incident counted in their data breach history.
In summer 2022 a phishing attack gave an attacker access to the customer support console of Twilio, the company that verifies phone numbers for Signal. For about 1,900 Signal users, the attacker could have re-registered their number on another device or learned that the number was registered with Signal. The attacker searched for three numbers specifically, and one of those three users reported that the account had been re-registered. Message history, contact lists and profile data were not accessed. Signal unregistered the affected accounts, notified the users by SMS and recommends turning on registration lock in the app settings.
In 2019 a buffer overflow in WhatsApp’s voice and video calling stack, CVE-2019-3568, allowed remote code execution through a specially crafted series of packets sent to a target phone number. According to Meta, NSO used it to install its Pegasus spyware on the phones of over a thousand WhatsApp users, including human rights activists, journalists and diplomats, and the spyware could collect information from any app on the device. WhatsApp engineers detected and stopped the attack and released a fix. WhatsApp worked with Citizen Lab to alert the people it believed were targeted. In May 2025 a jury ordered NSO to pay damages.
The two incidents went through different routes. Signal’s went through a third-party phone-verification provider and exposed account registrations, not messages. WhatsApp’s went through a flaw in the app itself and put spyware on the targeted phones.
Daily use: where WhatsApp is ahead
WhatsApp scores 9.0 on Usability & Reach and Signal 8.0. Signal’s downloads cover Android, iPhone and iPad, Windows, Mac and Linux. WhatsApp runs on Android and iPhone as the main phone, with apps for Windows and Mac and WhatsApp Web, which runs in a browser. Both have voice and video calls; WhatsApp’s desktop apps make calls with up to 32 people. Signal’s download page lists no web version. WhatsApp’s disappearing messages run on timers of 24 hours, 7 days or 90 days, set per chat or as the default for new chats.
Multi-device use works through a primary phone on both apps. WhatsApp links up to four devices, and each connects to WhatsApp on its own, so linked devices work while the phone is offline; they log out if the phone goes unused for over 14 days. Signal links up to five devices; the phone has to come online at least once every 30 days, or the linked devices are unlinked, and a linked device that stays inactive for 45 days is unlinked as well.
Both apps offer end-to-end encrypted backups, but with a different backup model. Signal Secure Backups are locked with a 64-character recovery key generated on your device and never shared with Signal’s servers. If you lose the key, the backup is lost, and Signal cannot recover it. The free tier keeps all text messages and the last 45 days of media, up to 100 MiB; for $1.99 a month the paid tier keeps older media, up to 100 GB.
WhatsApp backups go to your Google Account or iCloud. End-to-end encrypted backup adds a lock with a passkey, a 64-digit key or a password, but it stays off until you turn it on in Settings, under Chats and Chat Backup. WhatsApp cannot reset the key or restore the backup for you.
What we didn’t compare, and why
How many of your contacts use each app. The scores measure platforms, devices and everyday features, not the size of each network. Which app the people you write to already use is often the deciding factor, and only your own contact list answers it.
Meta AI inside WhatsApp. This article covers AI from Meta only where a business uses it to answer chats, which takes those chats out of end-to-end encryption. The assistant as a product is not scored, so it is not compared here.
Other messengers and blocking in specific countries. This article covers two apps that share a protocol and a phone-number requirement. Messengers that sign you up without a phone number are reviewed in the messengers section. If you are not comparing apps yet and only want to know whether WhatsApp is enough, Why Not Just Use WhatsApp? covers that. Whether either app works in countries that restrict messengers is not covered here.
Bottom line
Read the full Signal review if you want the service to learn as little as possible about you: sealed sender, as Signal describes it, hides who sends a message from its servers, contacts may be sent to its servers in hashed form, the code of the apps and the server is public, and a nonprofit runs it on donations. You still give Signal a phone number, its servers still see the recipient and your IP address, the independent analysis on record covers the protocol, not the apps or the server, and your linked computer is unlinked if the phone does not come online for 30 days.
Read the full WhatsApp review if the people you talk to are on WhatsApp and you need a web version or calls of up to 32 people from a desktop app. Your personal chats get the same protocol as Signal’s. Turn on encrypted backup, because it is off by default, and keep in mind what stays outside end-to-end encryption: chats with Meta services, some business chats and payments. WhatsApp also receives the numbers in your address book and shares information with the other Meta companies, and its privacy policy describes no setting to turn off the collection of usage and diagnostic data.