Updated 2026-11-02

Is there a messaging app that can't be hacked?

The four ways messages actually get exposed

1. The device

If spyware is running on your phone, it can read your screen and your keyboard. End-to-end encryption protects messages while they travel, not on a compromised device. Commercial spyware has been used against journalists and activists on fully updated phones. No messaging app can fix this, and an app that claims to is not being straight with you.

2. Mistakes in the code

The maths behind modern encryption is sound; implementations are where things go wrong. Home-made cryptography, unreviewed code and bugs in how keys are handled have exposed messages in real apps. This is why open source code, use of audited libraries and independent audits matter more than which cipher a product names.

3. Metadata: who, when and how often

Even when nobody can read your messages, records of who you talk to, when and from where can reveal a great deal. Former NSA and CIA director Michael Hayden put it bluntly in 2014:

“We kill people based on metadata.”

An app that needs your phone number, keeps your contact list on its servers or logs your connections holds exactly this kind of record, even with perfect encryption.

4. People and accounts

Phone numbers can be hijacked through SIM swaps. People can be tricked into scanning a link that adds the attacker's device, or into sharing recovery codes. A contact's identity can be faked if nobody checks it. Good apps make these attacks harder and make verification easy.

What to look for instead

• End-to-end encryption on by default, for every chat including groups.
• Forward secrecy, so stealing today's keys doesn't unlock yesterday's messages.
• Post-quantum key agreement, so traffic recorded now can't be decrypted by future quantum computers.
• As little metadata as possible: ideally no phone number, no permanent account ID and no contact list on the server.
• A way to verify contacts, such as safety numbers you compare in person.
• Open source code and independent audits, so claims can be checked by people who don't work for the company.
• Honest documentation of limits. If an app's site has no section on what it can't protect you from, that is a warning sign.

How the main apps compare

Facts checked on 2026-11-02 from each project's own announcements and independent reporting (sources below). No app wins every row.

Sources

1. Signal: Quantum resistance and the Signal Protocol (2023)
2. Signal: Signal Protocol and Post-Quantum Ratchets (Oct 2025)
3. Signal: Keep your phone number private with usernames (2024)
4. Privacy Guides: Signal enables phone-number-less registration in beta (Sep 2026)
5. SimpleX: protocol overview
6. SimpleX v5.7: quantum-resistant encryption by default in direct chats (Apr 2024)
7. Session: Protocol V2, PFS and post-quantum (2025)
8. Privacy Guides: Session adds PFS, PQE and other improvements (Dec 2025)
9. Threema: New communication protocol "Ibex"
10. Kaspersky: Telegram and secret chats
11. ABC News: Ex-NSA chief: "We kill people based on metadata" (2014)

Where Dead Safe stands

Dead Safe was built around the checklist above. Each of these statements is backed by an automated test in our source code (published before launch):

• No phone number, email address or name is needed to use Dead Safe. Your account is a 12-word recovery phrase created on your device.
• Our servers never receive your identity key, your name or your contact list. Even the first message that connects two people is sealed, so its contents don't reveal who sent it. (The server still sees the IP address a message comes from; see the limits.)
• Messages are end-to-end encrypted with the Double Ratchet algorithm (the design used by Signal). The classical building blocks (X25519, Ed25519, XChaCha20-Poly1305, SHA-256, Argon2id) come from open-source libraries that have had independent security audits. How Dead Safe combines them is our own protocol code, which has not been audited yet.
• Post-quantum protection throughout the conversation: every conversation starts with hybrid key agreement (X25519 plus ML-KEM-768, the NIST standard), and every time the conversation changes direction the keys are refreshed with a new X25519 exchange and a new ML-KEM-768 exchange together. To read recorded traffic, an attacker would have to break both X25519 and ML-KEM-768; ML-KEM-768 is designed to withstand quantum computers, as NIST's standard sets out.
• Forward secrecy: someone who steals your device's current keys still cannot decrypt messages your device has already received. (As in every Double Ratchet app, keys for messages that arrived out of order are kept until those messages arrive.)
• Altered or replayed messages are rejected.
• Invitations are signed by the identity they contain, so changing where a conversation is delivered breaks the invitation. A signature can't prove who sent you an invitation; comparing safety numbers does, and the app marks every contact as not verified until you do.
• You can compare a safety number with each contact to confirm no one is intercepting your conversation.
• Each conversation uses its own private delivery queues. Only you can read your queue, and once two people are connected, only your contact can post to it.
• Messages are padded in 256-byte steps, so the server sees only a rough size, never the exact length.
• The server records message arrival only to the nearest minute, deletes each message as soon as your app confirms it has it, and deletes uncollected messages after 14 days.
• Dead Safe never accepts card numbers. Pro can be paid for with cash by post. Your device claims the licence by signing with a key that never leaves it, and it doesn't even ask until the cash has arrived.

And, just as important, this is what Dead Safe cannot do yet. We publish it because you can't make a good decision without it:

• The relay sees your IP address. Like any server you connect to, the relay sees the network address you connect from, unless you use Tor or a trusted VPN.Plan: Built-in Tor routing in the mobile apps.
• Timing can link your conversations. Your app checks all your queues from the same connection, so the relay could guess that those queues belong to one person. It still cannot see who is at the other end of each queue.Plan: Tor, plus spreading queues across independently run relays.
• A hacked phone or computer defeats any messenger. If spyware is running on your device, it can read your screen and keyboard. No messaging app can prevent that. Keep your device updated and locked.Plan: Not solvable by an app. We will never claim otherwise.
• The web version trusts the server for its code. A web app is downloaded from the server each time you open it, so a compromised server could send altered code. Signed mobile apps with reproducible builds close this gap.Plan: Native iOS and Android apps with reproducible builds; the web version stays as a convenience.
• Keys refresh when the conversation changes direction. New X25519 and ML-KEM-768 keys are mixed in each time the other person replies. A long run of messages in one direction stays on one chain whose keys move forward with every message but get no fresh randomness until a reply arrives. Signal's and SimpleX's ratchets work the same way. Post-quantum key material adds about 2.3 KB to each message, inside the encryption.Plan: None needed for security; we may compress the post-quantum data later, as Signal's SPQR does.
• Our post-quantum library has not had an independent audit. ML-KEM-768 comes from @noble/post-quantum, which tests against the official NIST vectors but has not yet had one. Because the design is hybrid, a flaw in it alone cannot expose your messages: the X25519 layer still has to be broken.Plan: Switch to an audited implementation as soon as one is available for the web.
• No independent audit of Dead Safe yet. The cryptographic libraries we use have been audited. Our protocol and app have not yet had an independent audit. Every security claim is backed by an automated test you can run yourself.Plan: A published third-party audit before the 1.0 release.
• An invitation proves nothing about who sent it until you compare safety numbers. An invitation works once. If someone intercepts it before your contact uses it, they could connect in their place; if someone replaces the link with their own, you would connect to them. The app marks every contact as not verified until you compare safety numbers, which reveals both. An attacker who learns an invitation can also fill its queue with junk to stop the connection.Plan: Share invitations in person by QR code where possible. Planned: a one-time posting token inside each invitation, and an option to block messaging until safety numbers are compared.
• No notifications while locked (web version). While Dead Safe is locked, even the app cannot open your queues, so it cannot tell you when a message arrives.Plan: Content-free wake-up notifications in the mobile apps.
• Auto-destroy only runs when the app is opened. An app cannot run while it is closed. Someone who copies your device's storage first can bypass auto-destroy, but still faces the encryption and your passphrase.Plan: Hardware-backed keys in the mobile apps.
• Your passphrase is the lock on your device. Stored data is encrypted with a key made from your passphrase using Argon2id. The app requires at least 10 characters but cannot stop you choosing a guessable phrase, and anyone who copies your device's storage can try guesses offline. Four or more random words are much safer.Plan: Planned: a built-in strong-passphrase generator and a common-password block list. Hardware-backed key storage in the mobile apps.
• The second-profile feature is public knowledge. Dead Safe is open source, so anyone can know the feature exists. What they cannot tell, without your passphrase, is whether you use it.Plan: None needed; this is the honest limit of deniability.
• The second profile is hidden in one copy of your storage, not across several. Someone who examines a single copy of your device's storage can't tell whether a second profile exists. Someone who has an older copy as well, for example from a backup, can see that the second slot changed, which suggests it is in use.Plan: Researching storage designs that hide which parts change, for the mobile apps.
• Our server could link a Pro licence to its cash order. Order codes contain no identity, but the server issues each licence for a specific order.Plan: Blind signatures (RFC 9474) so even we cannot link them.

Practical steps, whatever app you use

• Keep your phone's operating system updated, and restart it regularly.
• If you face serious threats, turn on your phone's high-security mode (Lockdown Mode on iPhone).
• Use a long passcode, not a 4-digit PIN.
• Verify your important contacts' safety numbers in person.
• Turn on disappearing or auto-deleting messages for sensitive conversations.
• Don't open links or scan codes that ask you to “link a device” unless you started it.

Frequently asked questions

Can end-to-end encrypted messages be hacked?

Not by breaking the encryption: the algorithms used by serious messengers have no known practical attack. Messages are exposed in other ways: spyware on the phone, a stolen unlocked device, bugs in the app, or someone tricked into connecting to an attacker. Metadata such as who talks to whom can also leak even when content does not.

Is there a messaging app that cannot be hacked?

No. Any app that promises it can never be hacked is promising something no one can deliver, because the phone it runs on can be compromised. The useful question is which app leaves the fewest openings and can prove what it claims.

What is the most secure messaging app?

It depends on what you need to protect. Signal is the strongest widely used choice. SimpleX and Dead Safe need no phone number or account identifier at all. Session hides your IP address through its own network but currently lacks forward secrecy. Dead Safe combines no identifiers, post-quantum key agreement, anonymous cash payment and a second profile for forced unlocks, and publishes a test for every claim; it has not yet had an independent audit.

Can the police or governments read encrypted messages?

If they get your unlocked phone, or install spyware on it, yes. If they only intercept network traffic or ask the provider, an end-to-end encrypted app gives them no message content. What the provider can hand over is metadata, which is why apps that collect less of it matter.

Does Dead Safe store my messages?

Messages wait on the relay, encrypted and padded, only until your device collects them, and for at most 14 days. On your device they are stored encrypted under a key made from your passphrase.