Signal vs SimpleX vs Session — which encrypted messenger in 2026

Three end-to-end-encrypted messengers, three different decisions about what identity to require. The trade-offs are well-defined; the right pick depends on whether phone-number registration is part of your threat model.

At a glance#

How each handles identity#

Signal uses your phone number as your identity at registration. The 2024+ username feature lets you talk to contacts without revealing your number to them, but the registration still binds to a SIM. The Signal server knows your phone number; what it learns about your messaging is heavily minimized through Sealed Sender and private contact discovery, but the number is the anchoring identifier. For users whose phone number is itself part of the threat model, this is the binding caveat.

SimpleX has no global identifier at all. When you want to message someone, one of you generates a one-time invitation link and the other accepts it. From that point on, you have a connection — each side sees the other through a per-contact identifier that no one else can see. There is no profile, no username, no phone. The SimpleX servers (you can run your own) see encrypted message queues and nothing else. This is the most metadata-minimizing model in the category.

Session generates a random Session ID at signup — no phone, no email, no SIM. Your contacts find you via the Session ID, which is public. Messages route over Lokinet, an onion network that hides metadata at the network layer. The trade-off is smaller user base and an operator history (Session was originally an Australian project; the foundation has reincorporated since) that warrants reading before betting on it long-term.

Cryptography#

All three use end-to-end encryption derived from the Signal Protocol (the Double Ratchet plus X3DH key agreement). The audited reference implementation is Signal’s; SimpleX and Session use ports or derivatives of the same primitives. For the cryptographic question of “can my messages be read by an outside observer,” all three are sufficient against any practical adversary.

The differences are in metadata: who the server sees you talking to, how often, with what timing. Here:

• Signal uses Sealed Sender (the server doesn’t see who sent a message, just who it’s for) and Private Contact Discovery (the server doesn’t see your full contact list). The server does see your phone number on connection, which is the metadata leak everyone in this space discusses.
• SimpleX has no centralized server with a complete view of your social graph. Per-contact queues means each connection is independent; correlating two queues to the same person requires breaking the queue model.
• Session routes messages through Lokinet, which obscures the network path. The Session server set sees encrypted blobs without knowing the underlying sender.

For most threat models, all three are dramatically more metadata-private than mainstream messengers (WhatsApp, Telegram, iMessage). The differences between them matter at the margin.

Usability and feature parity#

Honest assessment: Signal is the most polished. Voice and video are reliable. Group chats scale to thousands. Stickers, reactions, disappearing messages, message editing — all the features users expect from a 2020s messenger are present. The Desktop and iOS/Android clients are stable. Onboarding is friction-free for people who can register a phone number.

SimpleX has caught up rapidly. Voice and video work. Groups have cryptographic membership which is technically more interesting than Signal’s centralized model, but the user-experience parity for group features is not quite there. Discovery is by design less convenient than Signal’s — you cannot find someone by username; you have to exchange an invite link.

Session has the rougher edges. Voice exists; video does not. Groups work but are smaller-scale than Signal. The Lokinet routing adds latency. The polish gap is largest here.

Which to pick#

The decision tree:

1. Can your contacts register a phone number, and is that OK with your threat model? → Signal.
2. Does your threat model exclude phone-number registration? → SimpleX if friction is acceptable; Session if you want a Signal-ish experience without the phone.
3. Is your environment hostile to network connectivity (censorship, intermittent internet)? → Briar.
4. Do you want a paid Swiss messenger you can buy with cash via vouchers? → Threema.
5. Do you want an open-standard federated messenger? → XMPP via Snikket or conversations.im.

For most users who care about this enough to be reading: Signal as the primary, SimpleX as a side channel for contacts who specifically want no-phone-number. This is the portfolio most privacy-aware users settle into.

What none of them fix#

• What recipients do with your messages. Forwarding, screenshotting, replying-with-quote — all of these defeat any E2E messenger.
• Your association with the account. Signing up over your home IP without Tor links the account to a network identity.
• Compromised endpoints. A keylogger or screen-recorder on your device reads everything before encryption.

These are out-of-scope for the messenger. The messenger’s job is what happens on the wire.

See also#

• Signal, SimpleX Chat, Session — directory entries.
• Briar, Threema, Snikket, Cwtch — other messengers in the directory.
• Best privacy messengers in 2026 — the ranked list.