Viber is a free app for text messages and voice and video calls on Android and iPhone, with desktop apps for Windows, Mac and Linux. Viber states that hundreds of millions of people use it each month. The service is run by Viber Media S.à r.l. in Luxembourg, and its parent company is Rakuten Group of Japan, which bought Viber in 2014 for $900 million.

Messaging and calls between Viber users are free. Viber pays for the service with in-app ads, the paid Viber Plus subscription, paid Viber Out calls and messaging for businesses.

One-on-one chats, group chats and one-on-one calls are end-to-end encrypted by default, and the encryption keys keep changing as people exchange messages. The weak points are elsewhere: a phone number is required; Viber receives your address book and collects device, location and activity data for analytics and ads; communities, channels and group calls are not end-to-end encrypted; the apps are closed source; and the protocol description Viber links to dates from 2018.

Cryptography & Protocol

Viber uses its own messenger protocol. According to Viber’s technical document, it is built on the double ratchet concept, and Viber wrote its implementation from scratch. Keys are exchanged with Curve25519, and each message is encrypted with a one-time Salsa20 key. Calls are encrypted with Salsa20 using a key made for each call.

Since Viber 6.0, released in 2016, one-on-one chats, group chats and one-on-one voice and video calls are end-to-end encrypted by default, with no setting to turn on. Viber states that encryption keys exist only on users’ devices. A message that cannot be delivered right away stays encrypted on Viber’s servers until delivery.

In one-on-one chats the keys keep changing as people exchange messages, which according to the technical document gives forward secrecy and post-compromise security: if the keys are compromised, neither past nor future messages can be decrypted. In group chats, all members share one group key, which is sent to each member over the one-on-one sessions and changed with a one-way hash after every message. For groups the document claims only forward secrecy: a compromised group key does not reveal earlier group messages, but the hash chain means it would reveal later ones.

Communities, channels, chats with bots, group calls and Viber Out calls are not end-to-end encrypted. They are protected only in transit, between the app and Viber’s servers. Viber explains that channels and communities show the whole chat history to new members, so the recipients of a message are not fixed when it is sent.

A lock icon in the chat info shows whether a chat is end-to-end encrypted. According to the technical document, a gray lock marks a secure connection with the other person, a green lock one you have verified and a red lock one whose key has changed after verification. During a call, both people can compare a 48-digit number to check that no one is intercepting the connection.

Metadata Privacy

Viber requires a mobile phone number to create an account; the number is the sign-up identifier. In channels and communities, other members cannot see your phone number.

For contact discovery, Viber receives your phone address book, with names, numbers and favorites, if you allow access to it. The privacy policy states that Viber processes the numbers of people who do not use Viber when they are in a user’s address book, and saves the name they were saved under.

According to its privacy policy, Viber does not store messages once they are delivered, and deletes a message that has not been delivered within two weeks. Viber runs on its own central servers, and its help pages list the metadata those servers can see besides message content: your Viber name, phone number, device and activity information, and anything you chose to provide, such as a profile picture, contacts and precise location. The privacy policy adds the IP address, device identifiers, advertising identifiers and a general location estimated from the IP address and the phone number’s area code.

Third-party providers collect analytics on how you use the app. The switches for analytics, content personalization and location services are in Settings, under Privacy and Personal data, and adults can switch them off themselves. For users under 16 (18 in the UK), Viber switches them off automatically and they cannot be changed. The settings made on the phone apply to your other devices as well.

Viber shares your advertising ID and limited information with ad partners, advertisers and their agencies, and shares data within the Viber corporate family, including its parent company, Rakuten Group. In response to a verified request, Viber may disclose activity data, identifiers and your address book to law enforcement and government agencies.

Transparency & Verifiability

The Viber apps and servers are not open source. Viber’s GitHub organization publishes libraries for building bots, API samples and documentation, but no source code for the apps or the servers.

The protocol is described in Viber’s technical document, a six-page file dated July 2018. It explains the key exchange, message and call encryption, group keys and linked devices. Viber’s security page still links to this document.

In January 2025 Viber announced SOC 2 Type II certification and stated that one of the Big Four professional services firms carried out the audit. Viber does not name the auditor, does not publish the report and does not say which products the certification covers. SOC 2 concerns a company’s data security practices, not the code of its apps, so it is not a security audit of the Viber apps. Viber links to no independent security audit of its apps or protocol.

Past security incidents

In July 2013 a Viber employee fell for a phishing email, which gave attackers access to two support systems: a customer support panel and a support administration system. Information from one of them was posted on a defaced page. Viber stated that no sensitive user data was exposed and that its databases were not hacked. It is the one confirmed data breach in Viber’s history; the 2014 flaw and the 2024 claim below are not confirmed breaches.

In April 2014 researchers at the University of New Haven found that images, videos and location information sent through Viber were stored on Viber’s Amazon servers without encryption and could be retrieved without authentication. Viber said a fix for Android was in testing and the iPhone fix was being submitted to Apple, and that it knew of no one affected. The flaw predates the end-to-end encryption that arrived in Viber 6.0 in 2016.

In March 2024 a hacker group called Handala claimed to have stolen 740 GB of Viber data, including source code, and demanded a ransom. Viber stated that its investigation found no evidence of an intrusion into its systems or of compromised user data. The claim has not been confirmed.

Usability & Reach

Viber runs on Android 6 and later, on iPhone and iPad with iOS 15.2 and later, on Windows 10 and 11, on macOS 11 and later, and on Fedora and Ubuntu Linux, where Viber states that updates and support are limited. Voice and video calls are built in. Viber has no smartwatch app.

Disappearing messages work in one-on-one and group chats, with timers of 10 seconds, 1 minute, 1 hour or 1 day. The timer can be set per chat or as the default for all one-on-one chats, and anyone in the chat can turn it off. Hidden chats are kept out of the chat list and open with a PIN; hiding a chat permanently deletes its history from Viber on desktop. A PIN for two-step verification protects the account.

Multi-device use depends on the phone. The desktop app works only after Viber is registered on the phone, and you link it by scanning a QR code with the phone, which, according to the technical document, passes the account’s private key to the desktop app.

Backups go to Google Drive, iCloud or Huawei Drive, daily, weekly, monthly or by hand, and can include photos and videos. A backup is tied to the phone number and the operating system, so it cannot move between Android and iPhone. Viber’s backup page describes no key or password that protects the backup, so under this backup model your chat history in the cloud is as safe as the Google, Apple or Huawei account it is stored in. Privacy International advises keeping automatic backup off for this reason.

Funding & Sustainability

Viber’s funding model is mixed: in-app ads, the Viber Plus subscription, Viber Out calls and messaging for businesses. Rakuten Group owns the company.

Ads appear in places such as the chats list after a call, the More menu, the sticker market and the Explore screen. Ads are chosen by demographics, language, device type, location and your activity on Viber and other platforms. In the European Economic Area, Switzerland and the UK you can switch off ad personalization based on Viber data and on third-party data; in the US the option is called Do Not Sell or Share My Personal Information; in some countries it is not available. The only way to remove ads is Viber Plus.

Viber Plus also lets you delete and edit messages without a trace, leave a group silently, hide your online status and read receipts, and chat with support. Viber’s help page gives no price; it is shown in the Viber Plus menu in the app.

Pros and Cons

One-on-one chats, group chats and one-on-one calls are end-to-end encrypted from the first message, with nothing to switch on
According to Viber's technical document, the protocol keeps changing keys, so compromised keys do not decrypt past or future one-on-one messages
A lock icon shows whether a chat is verified, and a 48-digit number lets both people check that a call is not intercepted
According to its privacy policy, Viber does not store messages once they are delivered
Disappearing messages, hidden chats with a PIN and two-step verification are built in
Apps for Android, iPhone, Windows, Mac and Linux, with voice and video calls
Messaging and calls between Viber users are free

A phone number is required
Viber receives your address book, including the names you saved for people who do not use Viber
Viber collects device identifiers, IP address, estimated location and activity data, and third-party analytics track how you use the app unless you switch them off
Your advertising ID is shared with ad partners, and only the paid Viber Plus removes ads
Communities, channels, chats with bots, group calls and Viber Out calls are not end-to-end encrypted
Backups to Google Drive, iCloud or Huawei Drive have no key or password of their own, so they are as safe as that account
The apps and servers are closed source, the protocol description Viber links to dates from July 2018, and it links to no independent audit of the apps
In 2013 a phishing attack on an employee exposed Viber's support systems

Our Rating

Cryptography & Protocol7.0/10
One-on-one chats, group chats and one-on-one calls are end-to-end encrypted by default with Viber's own double ratchet implementation, which according to Viber's technical document gives one-on-one chats forward secrecy and post-compromise security and groups forward secrecy only; communities, channels, chats with bots, group calls and Viber Out calls are protected only in transit.
Metadata Privacy3.0/10
A phone number is required, Viber receives your address book including the names you saved for people who do not use Viber, and it collects device identifiers, IP address, estimated location and activity data and shares your advertising ID with ad partners; delivered messages are not stored.
Transparency & Verifiability4.0/10
The apps and servers are closed source, the protocol description Viber links to is a six-page document from July 2018, and the SOC 2 Type II certification covers the company's security practices, with no named auditor or published report.
Usability & Reach7.5/10
Viber runs on Android, iPhone, Windows, Mac and Linux with calls, disappearing messages and hidden chats; the desktop app needs the phone to register and link, and backups cannot move between Android and iPhone.
Funding & Sustainability4.5/10
Viber is free, owned by Rakuten Group and funded by in-app ads, Viber Plus, Viber Out calls and business messaging; your advertising ID goes to ad partners, and only Viber Plus removes ads.

Overall5.2/10

Cryptography & Protocol 30% · Metadata Privacy 25% · Transparency & Verifiability 20% · Usability & Reach 15% · Funding & Sustainability 10%

See our rating methodology →