Why Not Just Use WhatsApp?

For a lot of people WhatsApp is not a choice so much as the place where everyone already is: family, friends, colleagues, the group chat for the building. Asking all of them to install something else is a hard sell, and the usual argument for doing it, encryption, does not land, because WhatsApp already encrypts personal chats end to end.

So the useful question is narrower than “is WhatsApp secure”. The encryption covers what you write to people. Three things sit outside it: what WhatsApp learns about you and the people in your address book, the chats and backups the encryption does not reach, and the fact that nobody outside the company can read the code that does all of this.

What WhatsApp actually does well

Personal chats, group chats and calls are end-to-end encrypted by default, with no setting to find. That covers messages, photos, videos, voice messages, documents, live location and status updates. WhatsApp states that no one outside the chat, WhatsApp included, can read, listen to or share them. The messenger protocol underneath is the Signal Protocol, and group chats use its Sender Keys component.

The keys are short-lived, which gives WhatsApp forward secrecy: according to WhatsApp’s technical white paper, keys taken from a phone today cannot decrypt messages sent earlier. Every one-to-one chat has a security code, a QR code and a 60-digit number that two people can compare in person, and WhatsApp also checks keys automatically through key transparency.

The app is also easy to live with. Up to four linked devices, such as a computer, a tablet or a second phone, work without the phone online. WhatsApp Web runs in a browser, and the desktop apps make voice and video calls with up to 32 people. Messaging is free, and ads appear only in Status and Channels, never in personal chats or calls.

Gap 1: WhatsApp knows your number, your contacts and your device

WhatsApp’s privacy policy says that, where the law allows, you provide WhatsApp with the phone numbers in your address book on a regular basis, including the numbers of people who do not use WhatsApp. This is how the app’s contact discovery works. WhatsApp states that it handles contacts who are not users so that it cannot identify them, but the numbers still leave your phone.

Your own number is the sign-up identifier: the privacy policy says you must provide a mobile phone number to create an account. Usernames are rolling out gradually and may not be available to you yet. A username hides your number from people who do not have it saved, but WhatsApp still requires the number, and anyone who has it can still contact you by it.

Then there is how you use the app. WhatsApp collects information about your activity, including diagnostic, crash and performance logs and reports, plus device and connection information such as your IP address and mobile network. The privacy policy describes no setting to turn this telemetry off. WhatsApp receives information from, and shares information with, the other Meta companies, and may share information in response to legal process or government requests.

What WhatsApp does not keep is the messages themselves. According to the privacy policy, messages are stored on your device, and once delivered they are deleted from WhatsApp’s servers. So the content of a personal conversation stays between the people in it, while your number, the numbers in your phone and the record of how you use the app go to WhatsApp.

SimpleX Chat removes the identifier altogether: no phone number, no username, not even a random ID. Each conversation runs through its own pair of random addresses on the servers, the servers keep no profiles or contacts, and nobody can look you up, so contacts are added by invitation link or QR code. Threema takes a smaller step: each account gets a randomly generated Threema ID, and linking a phone number or email is optional. Its address-book matching is optional as well, and the hashes it uploads are discarded once the matching IDs come back. Neither app’s privacy policy describes analytics in the app.

The money behind each app differs too. WhatsApp’s funding model is its parent company, Meta. Threema charges CHF 6 once and says the price covers development and server costs, so it has no need to make money from user data. Signal is paid for by grants and donations, with a US nonprofit foundation behind it.

Gap 2: end-to-end encryption has an edge, and WhatsApp draws it

WhatsApp lists the exceptions itself. It does not consider communications with Meta services, or with businesses that use Cloud API, to be end-to-end encrypted. Some businesses let Meta store their messages or answer them with AI from Meta; WhatsApp shows this in the chat and does not consider those messages end-to-end encrypted. Payments are not end-to-end encrypted, and neither are messages with third-party agents.

Chats with businesses that use the WhatsApp Business app are end-to-end encrypted on the way. Once the business receives a message, the business’s own privacy practices apply to it.

In practice the line runs between chats with people and chats with companies. A message to a friend is covered; a message to a company may or may not be, depending on how that company has set up its WhatsApp account.

Backups have an edge of their own. WhatsApp can back up chats to a Google Account or iCloud, and end-to-end encrypted backup adds a lock to that copy with a passkey, a 64-digit encryption key or a password. It stays off until you turn it on in Settings → Chats → Chat Backup. Once it is on, WhatsApp cannot reset the key or restore the backup for you.

Signal uses the same protocol without an exceptions list: every chat, group and call is end-to-end encrypted, and there is no unencrypted mode. Its backups are locked with a 64-character recovery key generated on your device and never shared with Signal’s servers. If you lose the key, the backup is gone, because Signal cannot recover it.

Gap 3: the code is closed, so nobody outside can check it

The WhatsApp apps and servers are not open source. WhatsApp’s GitHub organization publishes developer tools and infrastructure code, such as a proxy implementation and Erlang libraries, but no source code for the apps or the servers.

What WhatsApp publishes instead is a description: a technical white paper, version 9, dated 25 February 2026, covering the Signal Protocol, group encryption, linked devices and the encrypted connection to the servers. The paper is detailed, but without the source code nobody outside the company can check that the apps work the way it describes.

Outside review covers two parts. Meta commissioned NCC Group to review the Auditable Key Directory library behind key transparency, with a report published on 14 November 2023, and to assess the protocol that stores in-app contacts on WhatsApp’s servers, in May 2024. Neither review covers the apps’ messaging code as a whole.

Open code does not make an app free of flaws, and nothing here says it would have prevented this one. But the apps’ code has been the route for an attack: in 2019 a buffer overflow in WhatsApp’s calling stack, CVE-2019-3568, allowed remote code execution on a target phone, and according to Meta, NSO used it to install its Pegasus spyware on the phones of over a thousand WhatsApp users; WhatsApp engineers detected and stopped the attack.

Signal publishes the complete source code of its apps and its server, and the Android app supports reproducible builds: you can build it from the public code and compare the result with the app on your phone. Threema publishes its apps under the AGPL-3.0 license, with reproducible builds on Android, and Cure53 audited the mobile apps’ source code in 2020 and the beta of the desktop app in 2024; its chat servers are not published. SimpleX Chat publishes both its apps and its servers, and Trail of Bits reviewed its cryptography library in 2022 and its protocol design in 2024.

The things it simply doesn’t have

Beyond the three gaps, some things are not available in WhatsApp at all:

• Sign-up without a phone number. Usernames hide the number from other people; they do not replace it.
• Public source code for the apps or the servers. The GitHub organization holds developer tools, not the messenger.
• A public independent review of the app as a whole. The two published reports cover a key-directory library and a contact-storage protocol.
• A way to switch off usage and diagnostic collection. The privacy policy describes no such setting.

When WhatsApp is genuinely fine

WhatsApp is a reasonable answer, not a mistake, when:

• The people you write to are on WhatsApp and moving them is not realistic. That is the main reason to stay, and no privacy feature in another app helps if nobody you know is there.
• Your concern is the content of personal chats. Those are encrypted by default with the Signal Protocol and forward secrecy, and you can compare security codes with the people who matter most.
• You have turned on encrypted backup, so the copy in Google or iCloud is locked with a key WhatsApp does not hold.
• You rely on everyday features: WhatsApp Web, four linked devices that work with the phone off, calls with up to 32 people from the desktop app, all free.

For that kind of use, “just use WhatsApp” holds up. If you are weighing it directly against the app that shares its protocol, the Signal vs WhatsApp comparison goes through both side by side.

Reach for something else when you want

• To sign up without a phone number, and keep your address book on your phone: SimpleX Chat or Threema.
• No identifier of any kind, so there is no account for a server to link your conversations to: SimpleX Chat.
• Code you or anyone else can read: Signal and SimpleX Chat publish their apps and servers, Threema its apps.
• An app paid for by its users or donors, not by a parent company it shares information with: Signal or Threema.
• Every chat encrypted, with no list of exceptions: Signal.

Each of these has costs of its own, and their reviews spell them out. Signal still needs a phone number, and its servers see who receives each message and from which IP address. SimpleX Chat cannot use one profile on two phones and has no cloud backup, only a database file you export yourself. Threema costs CHF 6, a Threema ID cannot be used on two phones at once, its forward secrecy is switched off while the multi-device protocol is in use, and its chat servers are closed. The independent reviews of all three are partial: Signal’s covers the protocol, SimpleX’s the cryptography library and the protocol design, Threema’s the apps but not the servers. And the people you write to will have to install the app too.

Summary

WhatsApp encrypts what you write to people, and for a person whose contacts are all there, that is a good reason to stay. What it does not do is limit what it learns about you: your number, the numbers in your address book and how you use the app. It also draws its own line around end-to-end encryption, and it keeps its code closed. If one of those three matters to you, there is an app that answers it: SimpleX Chat or Threema for the identifier, Signal for the encryption line and the code. If none does, WhatsApp with encrypted backup turned on is a defensible default.