WhatsApp is the practical encrypted messenger for 3 billion people. It runs the same Signal Protocol as Signal itself, so message bodies are protected. But Meta — the owner — collects extensive metadata, the apps are closed source, and backups are encrypted by default only if you turn it on. We rate it 7.8 / 10: the best choice for everyday encrypted chat, not the best choice for sensitive conversations.
Reviewed by the xchat.directory editorial team · Last reviewed
WhatsApp at a glance
What Is WhatsApp?
WhatsApp is the world's largest messenger with about 3 billion monthly active users. Founded in 2009 by Jan Koum and Brian Acton and acquired by Facebook (now Meta) in 2014 for $19 billion, WhatsApp is the default messenger on most Android phones and one of the two default messengers (with iMessage) on iPhones.
Critically, WhatsApp adopts end-to-end encryption by default on every chat, voice call, video call, and group message. The encryption algorithm is the Signal Protocol — the same technology that protects Signal itself, licensed to WhatsApp by the Signal Foundation in 2016. That makes WhatsApp technically one of the most secure messengers on the market on a per-message basis. The privacy trade-off is the metadata surrounding those messages.
Privacy & Security — Where WhatsApp Wins and Loses
WhatsApp's security posture is split in two. The transport crypto is excellent. The metadata collection is concerning. Let's walk through each.
What's encrypted (good news)
- Every message body is encrypted with the Signal Protocol — Meta cannot read it.
- Voice and video calls are end-to-end encrypted.
- Disappearing messages are end-to-end encrypted (24h, 7d, 90d, or custom).
- Status updates with the "privacy" setting are encrypted to followers you choose.
- Multi-device companion apps use their own end-to-end encryption keys — your chat history on a paired iPad or laptop is encrypted separately.
What's NOT encrypted (the privacy trade-off)
- Backups. By default, WhatsApp on Android backs up to Google Drive unencrypted, and on iOS to iCloud unencrypted. End-to-end encrypted backups exist but are opt-in, off by default.
- Metadata. Meta collects: who you talk to, when, how often, from what device, on what network, from what country. This is shared with the broader Meta family for advertising (subject to regional regulation).
- Profile photo, About text, status (public), last seen. Visible to your contacts by default.
- Phone number. Your phone number is your WhatsApp identity — there's no way to use it without giving Meta your phone.
- Closed source. WhatsApp client code is partially open source (the E2E implementation is on GitHub) but the server and metadata-collecting layer are not.
Meta ownership — the elephant in the room
WhatsApp was acquired by Meta (then Facebook) in 2014. Before that, Jan Koum had publicly promised no ads, no tracking, no games. After the acquisition those promises changed: WhatsApp now shares metadata with Facebook/Instagram for ad targeting, and has started rolling out business messaging tools and channels. The encryption of message bodies has survived — that's the Signal Protocol license in action — but the user-data practice has moved closer to the broader Meta model.
Features — Why 3 Billion People Use It
WhatsApp's feature set is what makes it dominant. It does everything an everyday user needs:
- 1:1 and group chats up to 1,024 members
- Voice and video calls with E2EE, including 32-person video calls
- Voice notes, video notes, file sharing up to 2GB per file
- Status (Stories-style) with end-to-end encryption option
- Channels — broadcast to unlimited followers (one-way)
- Communities — group up to 64 sub-groups under one roof
- WhatsApp Business — catalogs, automated replies, API integrations
- Multi-device — pair up to 4 companion devices (iPad, Web, Desktop, additional phones)
- Stickers and GIFs with full encryption
- Payments in some markets (limited; meta-owned service)
WhatsApp's killer feature isn't any one item — it's that almost everyone you know already has it installed. Network effects in messaging don't decay; they compound.
Cost — Free, Ad-Supported (Indirectly)
WhatsApp is free. No subscription, no ads inside the chat list. The business model is indirect: WhatsApp collects metadata that flows back to Meta for advertising targeting across Facebook, Instagram, and the broader Meta ecosystem. In the EU, GDPR and the Digital Markets Act force Meta to keep WhatsApp data more siloed from the rest of Meta, so the metadata-sharing effect is reduced for European users.
For users in countries without such regulation, the actual cost is your behavioural profile. WhatsApp's free tier is paid for in data — the same model as Instagram and Facebook itself.
Who Should Use WhatsApp?
WhatsApp is the right choice if:
- You need to reach the largest possible number of people — friends, family, colleagues, customers — without asking them to install anything new
- Your threat model is "casual snooping, not state-level" — the Signal Protocol body encryption is sufficient for everyday private conversations
- You're operating in regions where Signal is blocked or restricted (e.g., UAE, Iran, parts of China) — WhatsApp sometimes still works
- You depend on WhatsApp Business features — catalogs, automated messaging, payment collection
- You're willing to accept Meta metadata collection in exchange for the install base
If you want stronger metadata protection, choose Signal (nonprofit, minimal metadata) or Threema (paid, no identifiers). If your threat model includes state-level adversaries, Session (onion-routed) or Briar (peer-to-peer, no servers) are better picks.
WhatsApp vs Signal vs Threema — Quick Comparison
Vs Signal: Same encryption body (both use Signal Protocol), but different business model and metadata exposure. Signal collects far less metadata and runs as a nonprofit; WhatsApp routes metadata to Meta's ad system. See our detailed WhatsApp vs Signal comparison.
Vs Threema: Threema is paid-once, requires no phone number, and stores data under Swiss jurisdiction. WhatsApp is free, phone-number based, US-based. Threema wins on privacy posture; WhatsApp wins on user base.
Vs Telegram: WhatsApp wins on default encryption (Telegram's default chats are server-encrypted only). Telegram wins on cloud sync, channels, 200K-member broadcasts, and ecosystem bots.
The Honest Verdict
WhatsApp is one of the most secure messengers on the planet for the content of your chats — better than Telegram, better than Discord, better than SMS. But Meta's metadata collection makes it a weak choice for anyone whose threat model includes state-level adversaries or simply the long-term accumulation of behavioural data.
Our recommendation: keep WhatsApp for the universal-install-base conversations — family group chats, school parents, casual friends. Add Signal for the conversations where metadata matters — work, sensitive personal matters, anything you wouldn't want logged in an ad-targeting graph. That two-app setup is the realistic privacy posture for most people in 2026.
And please turn on end-to-end encrypted backups. It's the single most important WhatsApp setting most users have never touched.
What we like
- E2E by default on every chat and call — built on the Signal Protocol
- Universal install base — almost everyone already has it
- Voice/video call quality is excellent and works on slow networks
- Status, channels, communities, and business messaging included
What we don't
- Meta collects significant metadata (who, when, how often)
- Closed source — code audits are external only
- No way to use it without giving Meta your phone number
- Backup encryption is opt-in (turned off by default)