Element is a free messenger for text, files and voice and video calls, with apps for Android, iPhone, Windows, Mac and Linux and a version that runs in a web browser. It is built by Element Creations Ltd, a London company called New Vector Ltd until 2025, set up in 2017 by the people who created Matrix, the open messaging standard Element runs on.

What sets Element apart is federation. Matrix is not one service but many independent servers that talk to each other. Your account lives on one server, called a homeserver, and you can message people whose accounts live on other servers. When a room has members from several servers, each of those servers keeps its own copy of the room. Element offers matrix.org as the default server, but you can pick another one or run your own.

The price of this design is metadata. To pass messages between servers, each server has to know who is in a room, and it stores the room’s name, topic and member list in plaintext even when the messages themselves are end-to-end encrypted. Which server you use, and who runs it, decides who holds that information.

Cryptography & Protocol

Element uses two messenger protocols from Matrix. Olm, an implementation of the Double Ratchet, carries encryption keys between devices. Megolm, a group ratchet, encrypts the messages in a room. Keys are shared per device rather than per person, and devices confirm each other through cross-signed verification.

Megolm is the weak point. Its own specification says it gives only partial forward secrecy: someone who steals a ratchet value can decrypt the messages encrypted with that value and every later one. It has no post-compromise security, so a conversation does not recover its secrecy after a key is stolen. The specification also says the same message can be decrypted more than once, and that there is no guarantee all members of a group received the same messages.

End-to-end encryption has been on by default since May 2020 for direct messages and private, invite-only rooms. Once encryption is on in a room, nobody can turn it off. Group encryption has one gap: public rooms that anyone can join are not encrypted. Element’s documentation says making a room public prevents enabling end-to-end encryption, and advises against adding encryption to public rooms. Messages in those rooms are stored readable on every server that takes part.

A new member of an encrypted room can read messages only from the point the keys were shared with them, not the room’s earlier history.

Element Call, the calling feature, keeps end-to-end encryption throughout, according to Element.

Metadata Privacy

The sign-up identifier depends on the server. On matrix.org, the default, the sign-up form asks for a username and then an email address, or a login through Google, Apple, GitHub, Facebook or GitLab. A phone number is not required; Element uses one only if you add it for two-factor sign-in by text message. Other servers set their own sign-up rules.

Your address on the network is a Matrix ID of the form @name:server. People find you by that ID, so contact discovery works by username. Matching contacts by email or phone needs an identity server, which is optional and asks for your consent.

Metadata protection is limited. In an encrypted room, the homeserver cannot read messages or files, but it stores the room name, topic and member list in plaintext and knows who sent each message and when. Element itself describes this in a 2025 post and proposes encrypting room names and topics; at the time of the post this was a proposal, not a shipped feature.

Federation multiplies these copies. Every server taking part in a room keeps the room’s history and metadata, and Matrix.org says it cannot guarantee that other servers honour requests to delete data. A room with members on ten servers is stored on ten servers run by ten different operators.

The matrix.org server records each device’s ID, the IP address it connected from, its user agent and the time it last connected, and keeps these logs for up to 180 days. Element’s privacy policy gives the same 180 days for IP addresses in the Element app.

Telemetry is opt-in. The app asks whether you agree to share anonymised usage data, and using the service does not depend on saying yes. Element runs its analytics on Matomo, an open-source platform hosted on its own network. Error reports go to the monitoring service Sentry and can include your IP address, hostname, name and email.

Element Creations Ltd falls under UK law. The Matrix.org Foundation, which runs the matrix.org server, is also registered in the UK. A server run by someone else falls under the law of whoever operates it.

Transparency & Verifiability

The Element apps are open source. Element Web and the desktop app are licensed under AGPL-3.0, GPL-3.0 or a paid commercial licence; Element X for Android and iPhone under AGPL-3.0 or a commercial licence. Synapse, the main Matrix server, is free under AGPL-3.0 or available under a paid Element licence, so Element is fully self-hostable. Matrix is a federated network: no single company runs all of its servers.

Reproducible builds are not documented for any Element app. Without them, nobody outside Element can confirm that the app in a store was built from the published code.

Element has one public audit. In 2022 Least Authority audited vodozemac, the Rust library that implements Olm and Megolm and that Element X uses through matrix-rust-sdk. It raised 10 valid concerns; 8 were fixed during the audit and the other 2 were left for later maintenance. The audit covers that library only, not the apps, the Synapse server or the Matrix protocol as a whole. Matrix commissioned it, sharing the cost with Germany’s gematik, and the report is public. Matrix said in 2022 that audits of matrix-rust-sdk would follow; none has been published.

The 2019 matrix.org breach

On 13 March 2019 an attacker broke into an outdated Jenkins server, a build tool, used by matrix.org. By 4 April the attacker had reached the production servers of matrix.org. The flaw was reported on 9 April. On 11 April the team rebuilt the systems and logged out every user. On 12 April the attacker defaced matrix.org through its DNS, using a compromised Cloudflare API key.

According to the operator’s own account, unencrypted content on the server, including private messages, password hashes and access tokens, may have been exposed. The hashed passwords were copied from the production database, and no passwords were leaked in plain text. The GPG keys used to sign software packages were compromised. Data on the identity server did not appear to have been affected.

Messages in end-to-end encrypted rooms are not stored readable on the server. Rooms that are not end-to-end encrypted can be read by anyone who breaks into the server that holds them. The incident counts toward Element’s data breach history.

Vulnerabilities in Matrix encryption

In 2022 researchers from Royal Holloway, Brave and the University of Sheffield described six attacks on Matrix end-to-end encryption. All of them needed a malicious homeserver, meaning the server itself had to be run or taken over by an attacker. Four were fixed at disclosure. One, in which a malicious server adds users it controls to an encrypted room, was not fixed at disclosure; the developers said they aimed to mitigate it. A weakness in how message key backups are encrypted was theoretical and not fixed, and the developers called it an issue in the Matrix specification.

Matrix rated two of the flaws critical. They were in the older libraries that power Element on the web, iPhone and Android, and Matrix fixed them in September 2022, saying it had seen no evidence of them being exploited. Matrix’s post lists Element X among the apps that were not affected.

Flaws of this kind keep appearing in matrix-rust-sdk, the library behind Element X, and are published as advisories. In June 2025 one rated High let a homeserver administrator spoof the sender of encrypted messages, and in June 2026 another rated High allowed sender spoofing through messages sent between devices.

These were vulnerabilities, not leaks of user data.

Usability & Reach

Element X is the current mobile app, on the App Store for iPhone and on Google Play and F-Droid for Android; the older Element mobile app is still offered. The iPhone app needs iOS 18 or later and the Android app Android 7.0 or later. Desktop apps cover macOS, Windows and Linux, and Element Web runs in a browser at app.element.io.

Multi-device use is independent: each phone, computer or browser signs in on its own and does not depend on a primary phone. You verify new devices to let them read encrypted messages.

Message history is kept in an encrypted backup on the server. A recovery key verifies new devices and, according to Element’s documentation, lets you keep access to your encrypted chat history even if you lose all your devices. Store the key yourself: the documentation names it as the way back in.

Element X supports one-to-one voice and video calls, and Element Call works in the mobile apps, on desktop and on the web. In Matrix’s directory of apps, group calls through MatrixRTC are still marked experimental.

Funding & Sustainability

Element’s funding model is mixed. The company earns money from subscriptions sold to governments and organisations for its server software and workplace app. Server plans run from Community, free under the AGPL for up to 100 users, to Enterprise, priced per user per month, and Sovereign, for air-gapped deployments. The consumer app is free.

Element has also raised venture money: a Series A in 2019 and a $30 million Series B in July 2021, led by Protocol Labs and Metaplanet, the firm founded by Skype co-founder Jaan Tallinn.

Element dual-licenses its code: anyone can use it for free under the AGPL, or pay for a commercial licence that does not carry the AGPL’s conditions.

Element and the Matrix.org Foundation are closely tied. The Foundation, a UK Community Interest Company, is the custodian of the Matrix specification and runs on donations and staff funding. Its four directors include Element’s two founders, Matthew Hodgson and Amandine Le Pape, and Element employs most of the Foundation’s staff under contract.

Pros and Cons

Direct messages and private rooms are end-to-end encrypted by default, and encryption cannot be turned off once on
No phone number needed: matrix.org asks for an email or a social login
Federated: you choose your server, and Synapse lets you run your own
The apps and the Synapse server are open source under the AGPL-3.0 license
Each device works on its own, with no primary phone required
An encrypted server backup and a recovery key bring message history to new devices
Apps for Android, iPhone, Windows, Mac and Linux, plus a web version
Telemetry is opt-in and the analytics run on Element's own servers

Servers store room names, topics and member lists in plaintext, and see who sent each message and when
Every server in a room keeps a copy of its history, and matrix.org logs IP addresses for up to 180 days
Megolm gives only partial forward secrecy and no post-compromise security
Public rooms cannot be end-to-end encrypted
The only public audit covers the vodozemac library, and reproducible builds are not documented
A 2022 attack in which a malicious server adds its own users to an encrypted room was not fixed at disclosure
In 2019 an attacker reached the matrix.org servers, and unencrypted messages, password hashes and access tokens may have been exposed
If you lose all your devices, encrypted history depends on a recovery key you must keep yourself

Our Rating

Cryptography & Protocol7.0/10
Direct messages and private rooms are end-to-end encrypted by default with Olm and Megolm, and once encryption is on in a room it cannot be turned off. Megolm gives only partial forward secrecy and no post-compromise security, public rooms cannot be encrypted, and a 2022 attack in which a malicious server adds its own users to an encrypted room was not fixed at disclosure.
Metadata Privacy4.5/10
The default server asks for an email address or a social login, not a phone number, and anyone can run their own server. In an encrypted room the server still stores the room name, topic and member list in plaintext and knows who sent each message and when, every server in a room keeps a copy, and matrix.org logs IP addresses for up to 180 days.
Transparency & Verifiability7.5/10
The apps and the Synapse server are open source under the AGPL-3.0 license, and Least Authority audited the vodozemac encryption library in 2022. That audit covers only the library, the announced audits of matrix-rust-sdk are not published, and reproducible builds are not documented.
Usability & Reach7.5/10
Element runs on Android, iPhone, Windows, Mac, Linux and in a web browser, each device works on its own, and a recovery key brings encrypted history to new devices. Keeping that history after losing every device depends on the recovery key, and the current iPhone app needs iOS 18 or later.
Funding & Sustainability7.5/10
Subscriptions from governments and organisations and two venture rounds pay for Element, and the consumer app and the Community server edition are free. Element is a venture-backed company that employs most of the Matrix.org Foundation's staff, so the protocol's custodian depends on one commercial firm.

Overall6.6/10

Cryptography & Protocol 30% · Metadata Privacy 25% · Transparency & Verifiability 20% · Usability & Reach 15% · Funding & Sustainability 10%

See our rating methodology →