Signal vs Threema vs Session in 2026

Encrypted messaging is a category with one universally recommended app (Signal) and several specialized alternatives. After 18 months of using Signal, Threema, and Session in parallel, here’s the honest comparison — including the parts the “Signal is the only choice” articles skip.

TL;DR

• Signal — best default for most users. Free, polished, widely adopted. Phone number requirement is the main concern.
• Threema — best for users who want anonymous signup (no phone number, no email). Swiss-based. Paid ($3.50 one-time).
• Session — best for journalists, activists, anyone with serious anonymity needs. No phone, no account, onion-routed. Trade-offs in usability.

All three are end-to-end encrypted. The differences are in what metadata they reveal, how they handle identity, and their threat model coverage.

Why “encrypted messenger” alone isn’t enough

End-to-end encryption (E2EE) protects message content from being read by anyone except sender and receiver. What it doesn’t protect:

Metadata. Who you message, when, how often, from where (IP). Most encrypted messengers leak some metadata. The differences between Signal, Threema, and Session are largely about what metadata they expose and to whom.

For threat models like “I don’t want advertisers reading my content,” Signal is overkill but fine. For threat models like “I don’t want anyone to know I’m communicating with this person at all,” Signal isn’t enough — you need Session or extreme operational security.

Signal

Owner: Signal Foundation (non-profit, US)
Pricing: Free
Identity: Phone number required
Best for: Default secure messenger for most users

What’s good

1. Best-in-class encryption protocol. The Signal protocol (forward secrecy, future secrecy, deniable authentication) is the industry standard. WhatsApp adopted it. Wire and Threema use variants.

2. Open source through and through. Both client and server code are public. The protocol is academically audited.

3. Genuinely free, no monetization. Funded by donations and grants. Not selling data, not running ads.

4. UX is excellent. Mobile apps polished. Desktop app works. Group features, calls (audio and video), stories, reactions, message effects — feature parity with mainstream messengers.

5. Network effect. ~150M monthly active users. More likely your contacts already have it than Threema or Session.

6. Multiple devices supported. Phone + desktop + tablet seamlessly.

7. Disappearing messages, screenshot detection (Android), incognito keyboard.

What’s not so good

1. Phone number requirement is a real privacy concern. Even with usernames now (added 2024), the underlying account is linked to a phone number. If someone has your phone number, they can verify you on Signal.

2. The recent username feature helps but isn’t perfect. You can now share a username instead of phone number. But your phone number is still in Signal’s database; it just isn’t shown to contacts by default.

3. Centralized infrastructure. Signal Foundation operates the servers. If they’re compelled by US authorities, they have what they have — which is minimal (the famous subpoena response: “we don’t have a list of your contacts, your message content, or anything else”), but not zero.

4. Some “convenience” features cost privacy. Cloud backups (Android only) encrypt with a PIN, which is weaker than no backup. Disappearing messages aren’t truly disappearing (forensic recovery possible on the device).

Real-world test

Signal works for our team. Group chats with non-technical family members work. Voice calls reliable. Backups (locally, with file export) work fine.

Threema

Owner: Threema GmbH (Switzerland)
Pricing: $3.50 one-time purchase (iOS and Android)
Identity: Random ID generated, no phone or email required
Best for: Anonymous signup with mainstream UX

What’s good

1. No phone number required. When you install Threema, it generates a random “Threema ID” (8-character string). You share this with contacts. No phone, no email, nothing personal needed.

2. Swiss jurisdiction. Strong privacy law. No data retention mandate.

3. Open source clients. Both Android and iOS clients are open source (since 2020). Server code is proprietary.

4. Audited. Multiple independent audits, results published.

5. One-time purchase. $3.50 once, no subscription, no ads, no monetization concerns.

6. Polished UX. Comparable to Signal/WhatsApp on iOS and Android.

7. Group calls, voice messages, file sharing. Feature-complete for personal/business use.

8. Threema Work for business use is a separate product. Companies adopt Threema for internal communication.

What’s not so good

1. Smaller network. Far fewer users than Signal. You’re more likely to recruit contacts rather than find them already on Threema.

2. Threema ID exchange friction. Adding someone requires exchanging the 8-character ID (in person via QR scan, or text). Less seamless than “they’re in my contacts.”

3. Server code is closed. You can audit the client but not the server. Trust required.

4. Costs $3.50. Tiny but enough to be a barrier for many.

5. Smaller team than Signal Foundation. Less frequent feature updates.

When to use

If you specifically want anonymous identity (no phone number), Threema is the easy answer. The phone-number-less signup is genuinely different.

Session

Owner: Session Technology Foundation (Australia/decentralized)
Pricing: Free
Identity: No phone, no email, no central account at all
Best for: Maximum anonymity, journalist/activist threat models

What’s good

1. No accounts whatsoever. No phone, no email, no username. You have a 66-character “Session ID” derived from cryptographic keys you control.

2. Onion-routed messaging. Messages route through a network of nodes, similar to Tor. Server operators can’t see who’s talking to whom.

3. No central server. The Session network is decentralized. Even Session Foundation can’t access your communications.

4. Open source through and through. Clients and the underlying Lokinet network are open source.

5. No metadata leakage. Unlike Signal (which knows who’s talking to whom at a metadata level), Session doesn’t have central metadata.

6. Cross-platform. iOS, Android, macOS, Windows, Linux desktop clients.

What’s not so good

1. Slower. Onion routing adds latency. Messages can take 1-3 seconds to arrive vs Signal’s instant.

2. No phone calls. Voice calls don’t work the same way over Session’s network.

3. Smaller network. Fewer users. Recruiting required.

4. UX is functional, not polished. Compared to Signal, Session feels rougher.

5. Group features less mature. Smaller groups, fewer features.

6. Backup/multi-device complex. Restoring access on a new device requires careful key management (you backed up your Session ID, right?).

7. Australia base. Australia has aggressive anti-encryption legislation (TOLA Act). Session Foundation is structured to push back but the jurisdictional risk is real.

When to use

Specific use cases:
– You’re a journalist talking to sources who can’t risk metadata exposure
– You’re an activist in a country with hostile surveillance
– You want a “burner” identity for specific conversations
– You’re paranoid about Signal’s centralized server (even though Signal has demonstrated good subpoena resistance)

For most users, Session is overkill. For specific threat models, nothing else is adequate.

Direct comparison

Criterion	Signal	Threema	Session
Cost	Free	$3.50 one-time	Free
Phone/email needed	Phone (mostly)	None	None
Open source client	Yes	Yes	Yes
Open source server	Yes	No	Yes (decentralized)
Onion routing	No	No	Yes
Voice calls	Yes	Yes	No
Video calls	Yes	Yes	No
Disappearing messages	Yes	Yes	Yes
Multi-device	Yes	Yes	Limited
Backup	Encrypted PIN (Android), local export	Manual backup	Manual key backup
Group features	Yes	Yes	Limited
Network size (users)	Huge	Medium	Small
Jurisdiction	US	Switzerland	Australia/decentralized
Best for	Default secure messenger	Anonymous signup	Maximum anonymity

How to think about choice

Use Signal unless you have a specific reason not to. The network effect makes it the practical choice. For >90% of privacy-aware users, Signal is the right answer.

Use Threema if:
– You don’t want to give Signal your phone number
– Your contacts are tech-savvy enough to download a paid app
– Swiss jurisdiction matters to you

Use Session if:
– You have a specific high-threat use case (journalist, activist, abuse evasion)
– You’re willing to accept the UX tradeoffs for the metadata protection
– You can recruit your specific contacts to Session

The “use multiple” pattern

Many privacy-conscious users run multiple messengers for different contexts:

• Signal: family, friends, default
• Threema: work colleagues who care about privacy but won’t use Session
• Session: specific sensitive conversations (journalism, sensitive personal topics)
• WhatsApp (despite Meta): the contacts who only use WhatsApp

This isn’t ideal but it’s pragmatic. Don’t force everyone to use your favorite messenger; meet contacts where they are.

What about WhatsApp, iMessage, Telegram?

WhatsApp: Uses Signal protocol for content encryption. Meta-owned. Meta gets metadata (who you talk to, when, from where) even though it can’t read content. Fine for casual use; not for privacy.

iMessage: Apple-encrypted, decent privacy from Apple but no protection if Apple is compelled. Works only Apple-to-Apple.

Telegram: Defaults to NOT being E2E encrypted. Only “Secret Chats” are. The default chat mode is server-readable. Telegram has multiple times handed data to authorities. Do not assume Telegram is private.

For private messaging, Signal/Threema/Session — not Telegram.

Common mistakes

Mistake 1: Using Signal but linking with your real phone number. If you want some anonymity within Signal, use a separate VoIP number (Google Voice, MySudo, JMP) for Signal registration, not your real phone.

Mistake 2: Backing up Signal to iCloud. iCloud backup is generally accessible by Apple (and US government). Don’t enable iCloud backup of Signal messages.

Mistake 3: Sharing your Session ID publicly. Your Session ID is your identity. Sharing it widely allows anyone to message you. Treat it like an email.

Mistake 4: Assuming “encrypted” means “anonymous.” Encryption protects content. Anonymity (who you talk to) requires different design. Signal is encrypted but not anonymous. Session is encrypted AND anonymous.

What we use

The Privacy Stacks team is split:
– All 5 of us use Signal as the default messenger
– 3 also use Threema for specific contacts
– 1 uses Session for source communication (journalism background)
– 0 of us use Telegram for any private communication

Disclosure

None of these have meaningful affiliate programs. Signal is a non-profit. Threema is a one-time purchase. Session is free open-source. We mention them based on quality, not commission. See our affiliate disclosure.

---

Last updated 2026 Q2. Based on 18+ months of personal use of all three.