App Review

Signal Review (2026): Still the Gold Standard?

The gold standard for private messaging

9.7
/ 10
★ 4.8 / 5

Signal remains the reference messenger for privacy-conscious users. We award 9.7 / 10 on the strength of its open-source code, sealed-sender metadata minimization, and truly nonprofit business model — the only major messenger where the operator can read almost nothing about you.

Reviewed by the xchat.directory editorial team · Last reviewed

Signal at a glance

Price Free
Encryption Default (E2EE)
Owner Nonprofit · United States
Phone required Yes
Open source Yes (client + server)
Platforms iOS / Android / Web / Desktop
Group size 1,000 members
Founded 2014

What Is Signal?

Signal is a free, open-source, end-to-end encrypted messenger maintained by the nonprofit Signal Foundation. It was started in 2014 by privacy researcher Moxie Marlinspike and later joined by Brian Acton (a co-founder of WhatsApp). Today it is the reference implementation of the Signal Protocol — the same encryption system that protects WhatsApp, Google Messages, and Skype.

For privacy-aware users Signal is the benchmark. Every message, voice call, video call, and group chat is end-to-end encrypted by default with no opt-in toggle to forget, and the client and server code are public on GitHub. Unlike WhatsApp and Telegram, Signal collects almost no metadata: thanks to its sealed-sender design, even the Signal servers don't reliably know who is messaging whom.

Privacy & Security — Why Signal Still Wins

Signal's threat model is what makes it special. Three design choices put it ahead of every mainstream competitor:

  • The Signal Protocol. The Double Ratchet algorithm is so well-audited that WhatsApp, Google Messages, and Skype all use it under licence. There is no compromise on transport crypto.
  • Sealed sender. When you send a message, the message body is end-to-end encrypted, but the sender identity used to be visible to Signal's server. Sealed sender hides the sender identifier inside the encrypted payload, removing that metadata leak at the cost of forcing groups to opt-in.
  • Minimal server-side metadata. Signal's servers only know your phone number, the day you connected, and the last time you used the service. They don't know your contacts, who you talk to, what groups you're in, or what messages you send.

Independent security audits of the Signal app are publicly released, and the protocol itself has been peer-reviewed in the academic cryptography community for over a decade. There is no equivalent transparency for WhatsApp's closed-source server code or XChat's proprietary implementation.

What gets leaked even when E2EE is on

Signal is honest about the limits of its protocol. The following metadata is visible to the server in some form: who you registered with (phone number), when you last connected, your profile photo, your display name, and group membership. The body of every message is encrypted — nobody with access to Signal's servers can read it.

Features — Everything You'd Actually Use

Signal ships every feature everyday messengers do, with no asterisks:

  • One-to-one and group chats with up to 1,000 members, end-to-end encrypted by default
  • Voice & video calls with the same E2EE protection as messages
  • Disappearing messages with custom timers from 30 seconds to 4 weeks
  • Stories (Signal's version of Instagram-style posts)
  • Group admin tools including invite links and member approval
  • Username (added in 2024) so you can chat without sharing your phone number
  • Stickers, GIFs, voice notes, file sharing with the same encryption guarantees
  • Cross-platform sync — same chat history on phone, desktop, and iPad

What Signal doesn't ship: large public broadcast channels like Telegram (1,000 is the group cap), inline bots, and a built-in payment system. Those are deliberate trade-offs in favor of privacy.

Cost — How Signal Survives Without Ads

Signal is free for everyone, with no ads and no tracking — and that raises the obvious question: how does it survive?

The answer is the nonprofit funding model. Signal Foundation relies on donations, including from Brian Acton personally, plus grants from open-internet funders. The 2025 annual funding round raised over $50 million, enough to keep the engineering team independent of any investor pressure to monetize. The trade-off: Signal has no growth team chasing every user — and its user base is dramatically smaller than WhatsApp's.

Who Should Use Signal?

Signal is the right choice if:

  • You want real, peer-reviewed end-to-end encryption rather than marketing claims
  • You're a journalist, activist, lawyer, doctor, or anyone whose threat model includes adversaries
  • You want one app to replace WhatsApp for daily messaging, voice, and video calls
  • You don't mind giving a phone number at signup (Signal usernames exist but the account is still phone-tied)
  • You value a nonprofit business model with no ad pressure

If you want zero identifiers from day one, look at Threema (paid, random ID, no phone) or Session (free, onion-routed, no phone).

Signal vs WhatsApp vs Threema — Quick Comparison

Vs WhatsApp: Both use the Signal Protocol for messages, but WhatsApp is owned by Meta and collects extensive metadata. Signal collects almost none.

Vs Threema: Threema is paid (~$4), requires no phone number, and is fully open source, but has ~1% of Signal's user base. Pick Threema if anonymity beats network effects.

Vs Telegram: Telegram's default chats are not end-to-end encrypted. Only "Secret Chats" are E2EE, and they have to be opted into. Telegram is a different product — cloud-first, broadcast-first, encryption optional.

See our detailed Signal vs Threema comparison or Signal vs Telegram comparison.

The Honest Verdict

Signal isn't the messenger for everyone. Its user base is roughly 70 million vs WhatsApp's three billion, so most of your contacts won't have it. The group chat size cap (1,000) is a fraction of Telegram's channels. And the phone-number registration is unfriendly to anyone who wants true anonymity from day one.

What Signal is is the cleanest implementation of private messaging on the open internet. If you want private conversations without compromising on usability and you trust the nonprofit that runs it, Signal is still the right choice in 2026.

What we like

  • Truly open source (clients + server) with regular third-party audits
  • Minimal metadata collection — sealed sender hides who is messaging whom
  • Nonprofit funding model — no ads, no investor pressure to monetize
  • E2E encrypted by default on every chat, call, and group
  • Phone-number optional usernames (release 2024) without breaking contacts

What we don't

  • Phone number still required at registration — usernames are forward-only
  • No large public broadcast channels like Telegram
  • Sticker / GIF / theme ecosystem is small vs WhatsApp/Telegram

Common questions

Is Signal safe to use?
Yes, Signal is generally one of the safest mainstream messaging apps. It encrypts every message, call, and group chat end to end by default, publishes its client and server code, and has undergone independent security review. No app can protect a compromised phone, so keep your device and Signal updated, use screen locks, and treat unexpected links or registration-code requests as suspicious.

Is Signal safe from hackers?
Signal provides strong protection against interception and server breaches because message content is end-to-end encrypted and the service retains very little account data. It cannot stop malware, an unlocked device, phishing, or someone taking over your phone number. Enable Registration Lock, verify safety numbers for sensitive contacts, and install updates promptly.

Is Signal safe from government surveillance?
Signal is designed to reveal very little to government requests: the service cannot decrypt message content and minimizes stored metadata. However, it does not make a person anonymous. A seized or infected device, phone-registration records, contact behavior outside Signal, and network-level observations may still expose information. High-risk users need broader device and operational security as well as encrypted messaging.

Is Signal safer than Telegram?
For private conversations, yes. Signal uses end-to-end encryption by default for every chat, call, and group. Telegram stores normal private and group chats in its cloud and limits end-to-end encryption to manually started, one-to-one Secret Chats. Telegram is stronger for large channels and cloud convenience; Signal has the safer default privacy model.

Is Signal safer than iMessage?
Signal offers the more transparent and consistent privacy model: it is open source, works across major platforms, minimizes metadata, and never falls back to unencrypted SMS. iMessage is end-to-end encrypted between Apple devices, but its implementation is closed source and cloud-backup protection depends on account settings such as Advanced Data Protection. Both still depend on device security.

Is Signal actually private and secure?
Signal is genuinely private by mainstream-messenger standards: message content stays between participants, metadata collection is deliberately minimized, and the nonprofit has no advertising business built on user profiling. Important limits remain: registration requires a phone number, contacts who already know that number may identify you, and Signal cannot secure a compromised endpoint.

Is Signal really more secure than WhatsApp?
In one important way, yes: Signal is fully end-to-end encrypted by default on every chat, call, and group, and collects almost zero metadata. WhatsApp also uses the Signal Protocol for messages but does not hide who is messaging whom from Meta. For pure privacy Signal is the clear leader; for install-base WhatsApp wins.

Does Signal show my phone number to other people?
By default, yes — your phone number is the registration identity. Since 2024 you can create a Signal username that's separate from your number, but the underlying account is still bound to a real phone number. Mutuals who already have your number will see you.

Has Signal been independently audited?
Yes. Signal Protocol has been audited repeatedly by independent firms, and the Signal app code (both client and server) is open-source. Unlike WhatsApp and XChat, anyone can verify the implementation.

How does Signal make money if it is free?
Signal is run by the nonprofit Signal Foundation, founded by Brian Acton (WhatsApp co-founder) and Moxie Marlinspike. It operates on donations, including from Acton personally, and from grants. There is no advertising and no tracking.

Can I use Signal without giving my phone number?
Not entirely — you need a phone number to register. You can use the Signal username (added in 2024) to keep your number private from contacts, but the underlying account still requires a number at signup.

More encrypted messenger reviews

Threema review

Swiss-made, paid, truly anonymous

9.2 / 10 →

Wire review

Swiss-grade E2EE with team collaboration

9.0 / 10 →

Session review

No phone, no email, onion-routed

8.5 / 10 →

WhatsApp review

Encrypted messaging for 3+ billion people

7.8 / 10 →

Want to compare Signal with another messenger? See our Signal vs Threema and Signal vs Telegram comparisons.