WhatsApp is a free app for text messages and voice and video calls on Android and iPhone, with apps for Windows and Mac and a web version. WhatsApp LLC, based in Menlo Park, California, runs the service, and WhatsApp Ireland Limited serves users in the European Economic Area. WhatsApp is one of the Meta companies.

Messaging is free, and Meta, the parent company, funds the service. Ads appear only in Status and Channels, separate from personal chats and calls.

Personal chats, group chats and calls in WhatsApp are end-to-end encrypted by default, with no setting to turn on. The weak points are elsewhere: WhatsApp collects usage, device and connection information and shares information with the other Meta companies, a phone number is required, the apps are closed source, and chats with some businesses and with Meta services are not end-to-end encrypted.

Cryptography & Protocol

WhatsApp encrypts messages and calls with the Signal Protocol, the messenger protocol described in WhatsApp’s technical white paper. Messages, photos, videos, voice messages, documents, live location, status updates and calls between people using WhatsApp are end-to-end encrypted by default. WhatsApp states that no one outside the chat, WhatsApp included, can read, listen to or share them.

Group chats are encrypted end-to-end as well. WhatsApp distributes the Sender Key component of the Signal Protocol to group members through the pairwise encrypted sessions already set up between them. The keys are ephemeral, which gives WhatsApp forward secrecy: according to the white paper, even if the current keys are taken from a device, they cannot decrypt messages sent earlier.

Every one-to-one chat has a security code, shown as a QR code and a 60-digit number, that two people can compare to confirm they are talking to each other. WhatsApp also verifies keys automatically through key transparency.

End-to-end encryption has exceptions, and WhatsApp names them itself. WhatsApp does not consider communications with Meta services or with businesses using Cloud API to be end-to-end encrypted. Some businesses let Meta store their messages or answer them with AI from Meta; WhatsApp shows this in the chat and does not consider those messages end-to-end encrypted. Payments and messages with third-party agents are not end-to-end encrypted either.

Chats with businesses that use the WhatsApp Business app are end-to-end encrypted. Once the business receives a message, the business’s own privacy practices apply to it.

Metadata Privacy

WhatsApp requires a mobile phone number to create an account; the number is the sign-up identifier. Optional usernames are rolling out gradually and may not be available yet. A username keeps your number private from people who do not have it saved, but people who have the number can still contact you by it. WhatsApp offers no searchable directory of usernames, and an optional username key can be required before someone sends you a first message.

For contact discovery, the privacy policy states that you provide WhatsApp, where the law allows, with the phone numbers in your address book on a regular basis, including those of people who do not use WhatsApp. WhatsApp states that it handles contacts who do not use the service so that it cannot identify them.

The privacy policy states that WhatsApp does not retain messages in the ordinary course of providing the service: messages are stored on your device, and once delivered, they are deleted from WhatsApp’s servers. Connections between the app and the servers run through a separate encrypted channel built on Noise Pipes, which hides metadata from unauthorized network observers. This metadata protection covers the network, not WhatsApp itself.

WhatsApp collects information about your activity, including diagnostic, crash and performance logs and reports, plus device and connection information such as the IP address and mobile network. The policy describes no setting to turn this telemetry off. WhatsApp receives information from, and shares information with, the other Meta companies, and may share information in response to legal process or government requests.

Transparency & Verifiability

The WhatsApp apps and servers are not open source. WhatsApp’s GitHub organization publishes developer tools and infrastructure code, such as a proxy implementation and Erlang libraries, but no source repository for the apps or the servers.

The protocol is documented in WhatsApp’s technical white paper, version 9, dated 25 February 2026. It covers the Signal Protocol, group encryption, linked devices and the encrypted connection to the servers.

Meta commissioned NCC Group to review two components. In August 2023 three NCC Group consultants spent 20 person-days on the Auditable Key Directory library behind WhatsApp’s key transparency feature; the report was published on 14 November 2023, and a retest confirmed that all findings were fixed. In May 2024 NCC Group assessed the protocol that stores in-app contacts on WhatsApp’s servers using hardware security modules; that report page gives no summary of the findings. Neither review covers the apps’ messaging code as a whole.

The 2019 spyware incident

In 2019 a buffer overflow in WhatsApp’s voice and video calling stack (CVE-2019-3568) allowed remote code execution through a specially crafted series of packets sent to a target phone number. According to Meta, NSO used the flaw to install its Pegasus spyware on the phones of over a thousand WhatsApp users, including human rights activists, journalists and diplomats. Meta states the spyware could collect information from any app installed on the device, which is why the incident counts toward WhatsApp’s data breach history. The attack targeted individual phones through the calling stack.

WhatsApp engineers detected and stopped the attack. The fix shipped in WhatsApp for Android 2.19.134, WhatsApp Business for Android 2.19.44 and WhatsApp and WhatsApp Business for iOS 2.19.51, with builds for older platforms. WhatsApp worked with Citizen Lab to investigate and to alert the people it believed were targeted. In May 2025 a jury ordered NSO to pay damages.

Usability & Reach

WhatsApp runs on Android and iPhone as the primary phone, with apps for Windows and Mac and WhatsApp Web. Voice and video calls are built in, and the desktop apps make calls with up to 32 people. Disappearing messages can be set per chat or as the default for new chats, with timers of 24 hours, 7 days or 90 days.

Multi-device use works through the primary phone. You can link up to four devices at a time, including computers, tablets and a second phone, and each one connects to WhatsApp independently, so linked devices work without the phone online. The primary phone is still needed to register the account and to link new devices, and linked devices log out if the phone is unused for over 14 days.

End-to-end encrypted backup protects backups stored in a Google Account or iCloud, a backup model where the backup is locked with a passkey, a 64-digit encryption key or a password. You turn it on in Settings, under Chats and Chat Backup. WhatsApp cannot send you a copy of the key, reset it or restore the backup for you.

Funding & Sustainability

WhatsApp’s funding model is a parent company: Meta funds the service, and WhatsApp shares information with the other Meta companies.

Ads appear only in Status and Channels, separate from personal chats and calls, and are rolling out gradually. A person who uses WhatsApp only for personal messaging does not see ads.

Pros and Cons

Chats, groups and calls are end-to-end encrypted from the first message, with nothing to switch on
Every one-to-one chat has a security code you can compare in person, and keys are also verified automatically
According to its privacy policy, WhatsApp deletes messages from its servers once they are delivered
Up to four linked devices work at the same time, and they keep working with the phone off
Backups to Google or iCloud can be locked with a key or password that WhatsApp cannot reset or recover
Free, with ads only in Status and Channels, never in personal chats or calls
Apps for Android, iPhone, Windows and Mac plus the web, with calls and disappearing messages built in

A phone number is required, and usernames only hide it from people who do not have it saved
WhatsApp regularly receives the phone numbers in your address book
Usage, device and connection data is collected and shared with the other Meta companies, and the policy describes no way to switch the usage and diagnostic part off
Chats with Meta services and with some businesses are not end-to-end encrypted
Encrypted backup stays off until you turn it on
The apps and servers are closed source, and only two components have public reviews, both commissioned by Meta
In 2019 a flaw in the calling feature let spyware onto the phones of over a thousand people
Linked devices log out if the phone goes unused for over 14 days

Our Rating

Cryptography & Protocol8.5/10
Personal chats, groups and calls are end-to-end encrypted by default with the Signal Protocol and forward secrecy; chats with some businesses and with Meta services are not, and encrypted backup is a setting you turn on.
Metadata Privacy3.5/10
A phone number is required, address-book numbers are uploaded, and usage and device information is collected and shared with the other Meta companies; delivered messages are deleted from WhatsApp's servers.
Transparency & Verifiability5.5/10
The apps and servers are closed source, but the protocol is documented in a detailed white paper and two components had public NCC Group reviews commissioned by Meta.
Usability & Reach9.0/10
Runs on Android, iPhone, Windows, Mac and the web, with up to four linked devices that work without the phone online; the primary phone is needed to register and link devices.
Funding & Sustainability4.5/10
Free and funded by Meta, with information shared with the other Meta companies and ads only in Status and Channels, never in personal chats or calls.

Overall6.3/10

Cryptography & Protocol 30% · Metadata Privacy 25% · Transparency & Verifiability 20% · Usability & Reach 15% · Funding & Sustainability 10%

See our rating methodology →