Messaging Apps

Think

Explore

At one time, text messages were typically sent using SMS (short message service), through cellular networks. Today, it is more likely that you send text messages using an internet-based messaging app like Whatsapp, Facebook Messenger, WeChat or Snapchat. Internet based messaging has been more common for at least ten years: a 2013 study found that more messages were sent through internet-based apps than over SMS.

Why does messaging app security matter?

Just as you likely wouldn’t want Canada Post, your letter carrier, your landlord, your neighbors or your roommate to open and read your physical mail, you probably don’t want anyone other than the intended recipient to read your text messages!

• Governments, Law enforcement and Security Agencies: Authoritarian regimes intercept and censor messages, security agencies engage in large scale surveillance of messaging to identify security threats and identify dissidents, and law enforcement agencies may intercept messages to collect evidence of crimes. Most of your messages may be pretty innocuous, but what if you are living in or passing through a country with an authoritarian government, or repressive laws? It might be important for your own safety for communications related to your political views, your participation in activism, or your sexual identity to be private and secure.
• Cyber-crime: Hackers might want to read your communications to find passwords, or collect other personal information.
• Data collection and corporate surveillance: Your data is valuable. Companies could use information about your habits and preferences for targeted advertisement, or they could use the way you communicate to train AI models. Are you comfortable with your messages with your friends being used to train chatbots?

How secure are my messages?

The security of your messages depends a lot on which messaging app you use. Most messaging apps will encrypt the message in some way while it is being transmitted. Essentially, encryption means that messages are scrambled when they are sent, and unscrambled when they are received, to prevent them from being intercepted and read while passing through a network. The effectiveness and security of this process depends on the protocols your messaging app uses, how securely they implement encryption, and whether there are any loopholes or back doors.

• End-to-end encryption (E2EE): ‘End-to-end encryption’ means that messages are encrypted on the sender’s device, and can only be decrypted on the receiver’s device. The details and computer science behind how this works are interesting – but can get a little complicated. Theoretically, if messages are sent using end-to-end encryption, it should not be possible for anyone (including law enforcement, security agencies, hackers, internet providers, or the app companies themselves) to intercept and read the messages. Here is a list of the most popular messaging apps and whether they support E2EE as of 2026. Most messaging apps will discuss encryption in ‘FAQ’ or ‘Privacy’ sections of their websites, and you can double check at the links provided whether this information is still up to date:
  • Whatsapp: Yes! Calls, messages, photos, videos, location sharing and documents are all protected using E2EE!
  • Instagram: No. Instagram previously had an E2EE feature for DMs, but this has been discontinued.
  • Signal: Yes! Signal conversations are all encrypted using E2EE, and Signal is very transparent about this process. Signal has a firm commitment to security and privacy, and is often used by investigative journalists.
  • Discord: Yes! Discord uses E2EE by default, including for messages, audio calls and video calls.
  • Snapchat: Maybe. Snapchat has reportedly developed a form of E2EE for some content, but it is not specified or described in the privacy agreement.
  • Facebook messenger: Mostly. Many, but not all, conversations on Facebook Messenger use E2EE.
  • SMS message: No. SMS messages sent over cellular networks do not use E2EE.
  • WeChat: No. WeChat does use a form of encryption, but it is not end-to-end encryption, which means that WeChat servers can decrypt and read messages.
  • Slack: No. Slack does use a form of encryption but it is not end-to-end encryption.
  • Telegram: Sometimes. Telegram chats only use E2EE if you manually select a ‘Secret Chat’.
  • iMessage: Yes. iMessage conversations do use E2EE.
• Cryptographic backdoors and public policy context: The security of end-to-end encryption depends on these technical protocols being implemented transparently, according to best practices and without ‘backdoors’. Some security agencies, including the FBI and British Intelligence Agency have publicly argued that they should be able to mandate backdoors that would allow them to bypass encryption, and have otherwise attempted to weaken secure encryption protocols. Other government attempts to control and limit encryption are more covert or indirect. This comprehensive guide to the history of policies and debates around encryption in Canada comprehensively summarizes these conversations in the Canadian context.
• Data storage and AI analysis: Once messages are received, the technical guarantees of end-to-end encryption no longer apply. Could the receiver forward your message to someone else? Could someone steal your phone and read your messages? Could your messaging app insecurely upload your conversations or analyze them using AI? Even if your messaging app uses end-to-end encryption the answer to all these questions is yes! Some messaging apps (Facebook Messenger for example) have ‘AI assistant’ features, which allow AI models to analyze messages. Since this analysis is done on messages that have already been received and decrypted, the process is not related to end-to-end encryption, and presents a separate set of privacy and security concerns. To understand exactly how this data is being used, analyzed and distributed to third parties during AI analysis, you can review the section of the app’s privacy policy that relates to AI. Our tutorial, Your Privacy and AI Tools discusses these topics in more detail.
• Metadata: End-to-end encryption prevents anyone except the receiver from opening the message and reading it’s contents, but it does not protect the metadata. It may be possible for third parties to see who you have communicated with, when and how much. You can think an encrypted message like a physical letter in an envelope: the post office, letter carriers and your neighbors can’t read the contents, but they might see how much mail you are receiving and who it is coming from.

If my messaging app is secure, then I can send any message I want?

Not necessarily! It is important to remember that regardless of how they are sent, messages might be forwarded or screenshot by the receiver. Do you trust the person who you are messaging? Are they definitely the person they are claiming to be? If your message is shared more broadly, how could that impact your reputation or your safety?

Check out our other tutorials to think more about how your messaging habits relate to broader questions of online safety and digital identity:

• Online Dating: What are the risks associated with messaging over a dating app?
• Sextortion: What are the risks associated with sharing sexually explicit images online?
• Phishing and Pharming: What if hackers message you, claiming to be someone else, in order to get your personal information?
• Online Harassment: What can you do if someone is sending you abusive messages or DMs?

Links

• Secure your Chats: Why Encrypted Messaging Matters | Citizen Lab (2017)
• Secure your Chats (Web Graphic) | NetAlert (2017)
• A Deep Dive on End-to-End Encryption: How do Public Key Encryption Systems Work? | Electronic Frontier Foundation (2025)
• How to Think About Encryption and AI: Training, Processing, Disclosure and Consent | Knodel et al (2025)
• Lets talk about AI and End-to-End Encryption | Matthew Green (2025)
• Shining a Light on the Encryption Debate: A Canadian Field Guide | The Citizen Lab & The Canadian Internet and Public Interest Clinic (2018)

Discuss

The Digital Tattoo Project encourages critical discussion on topics surrounding digital citizenship and online identity. There are no correct answers and every person will view these topics from a different perspective. Be sure to complete the previous sections before answering the questions.

• Check the apps that you use! Do they use end-to-end encryption? Do you have AI analysis of messages, or an AI assistant enabled?
• Think about the conversations that you have over messaging apps? Why is it important for you that this information is private?

What do you think? Tell us using the comment below.