Secure messaging apps for travelling abroad
What makes a messenger secure, a plain comparison of Signal, WhatsApp, iMessage, Telegram, Threema and Session, and what to watch for abroad: public Wi-Fi, verification codes and VPNs.
Quick answer
- A secure messaging app turns on end-to-end encryption by default, collects minimal metadata, uses an open and audited protocol, offers disappearing messages and encrypted backups. Signal, WhatsApp, iMessage, Threema and Session are end-to-end encrypted by default; on Telegram only secret chats are, not normal chats.
- While travelling, the app is only half the picture; the network matters too. Messaging over eSIM or mobile data is generally lower risk than open public Wi-Fi, and apps that verify by phone number send the SMS code to your home SIM.
- Features change between versions, so always verify current settings and the app's own security documentation before relying on them.
What makes a messaging app secure?
A secure messenger is one where even the provider cannot read the content of your messages and where as little as possible is recorded about you. Use the criteria below to check any app.
- End-to-end encryption (E2EE) on by default, not something you have to switch on chat by chat. Only the sender and recipient can decrypt the content.
- Minimal metadata. The app should not retain more than necessary about who you talk to, when and how often, because that information reveals a lot even without the content.
- An open-source or independently audited protocol, so outside experts can look for weaknesses.
- Disappearing messages, which reduce what stays on the device if a phone is lost or inspected.
- Options that avoid exposing your phone number, such as usernames, so you need not share your real number with new contacts.
- An encrypted backup option, because a well-encrypted chat that is backed up to the cloud unencrypted can still leak.
How do Signal, WhatsApp, iMessage, Telegram, Threema and Session compare?
This table covers only well-established properties and does not rank the apps. Features change, so verify current details with each app directly.
| App | E2EE by default | Needs a phone number | Encrypted backup option |
|---|---|---|---|
| Signal | Yes | Yes to register (usernames let you avoid sharing it) | Yes, passphrase-protected local backups |
| Yes | Yes | Yes, as an opt-in setting | |
| iMessage | Yes (between Apple devices) | Uses an Apple Account tied to a number or email | Yes, via optional iCloud Advanced Data Protection |
| Telegram | No (secret chats only) | Yes to register (usernames exist) | Secret chats are not cloud-stored; normal chats are held on servers |
| Threema | Yes | No (uses a random Threema ID) | Yes, password-encrypted backups |
| Session | Yes | No (uses a Session ID) | No central cloud backup; recovery uses a recovery phrase |
Popular messengers compared (verify current details before relying on them)
Is messaging over eSIM data safer than hotel Wi-Fi?
Generally yes. Mobile data is a connection between your device and an operator's network, whereas public Wi-Fi is shared with strangers and carries risks such as fake hotspots named to imitate the hotel.
With E2EE the message content stays encrypted even on public Wi-Fi, but an insecure network can still expose some metadata and put other apps on your phone at risk, such as sites not using HTTPS. Using eSIM data for chats and anything sensitive reduces that exposure. See our guides on staying safe on public Wi-Fi and on eSIM security and privacy.
- Guide: /guides/staying-safe-on-public-wifi
- Guide: /guides/esim-security-and-privacy
Where does the verification code go if an app needs my phone number abroad?
The SMS code goes to the number on your home SIM, not to a travel eSIM. Our eSIMs are data-only, with no phone number and no SMS, so they cannot receive verification codes.
- Install and register any number-based messaging app before you leave home.
- Keep your home SIM active for SMS (for example with roaming) or know how you will receive texts, in case you must re-verify mid-trip.
- Set a registration PIN or lock if the app offers one, and turn on two-step verification.
More detail is in /guides/sms-otp-while-abroad and /guides/esim-and-phone-numbers.
Do I need a VPN, and do some countries restrict messaging apps?
A VPN encrypts traffic between your device and the VPN server, which helps on public Wi-Fi, but it does not turn a non-E2EE chat into an E2EE one and you must trust the VPN provider instead. See /guides/vpn-while-travelling for details.
Some countries restrict or block certain messaging apps or features, such as in-app calling, and rules can change. Check the rules of your destination before you travel and follow local law.
How much data does messaging use?
Plain text messages use very little data, while photos, video and in-app calls use clearly more. See /guides/how-much-data-line-whatsapp-messaging for how to estimate it, then pick a GB plan that fits your trip.
What should I set up before travelling to keep my chats secure?
- 1Update apps and the OSUpdate your messaging apps and iOS or Android to the latest versions, since security fixes ship in updates.
- 2Lock the screen and enable two-step verificationUse a passcode or biometrics, and enable two-step verification or a PIN in apps that offer it.
- 3Set disappearing messagesFor sensitive chats, set messages to disappear after a suitable period.
- 4Turn on encrypted backupsIf an app backs up to the cloud, enable the encrypted option, or switch the backup off if you don't want one.
- 5Line up private dataInstall a data eSIM in advance so you don't have to depend on public Wi-Fi. See /guides/how-to-install-esim.
FAQ
What is the most secure messaging app?+
There is no single answer for everyone. Judge apps by criteria such as E2EE by default, minimal metadata, an audited protocol and encrypted backups, then choose one that fits your needs and that your contacts will actually use.
Is Telegram end-to-end encrypted?+
Only secret chats are, and you must start those manually. Normal chats and group chats are not end-to-end encrypted by default, unlike Signal, where every chat is.
Is WhatsApp a secure messaging app?+
WhatsApp uses end-to-end encryption by default, but it requires a phone number to register and encrypted backup is an opt-in setting. Check the current settings in the app.
Which messaging apps work without a phone number?+
Threema and Session do not need a phone number to create an account. Signal needs one to register, but usernames let you avoid sharing it with others. Verify current details with each app.
Can I use a data eSIM for apps that verify by phone number?+
Yes for chatting once the account is registered, but not for receiving the code, because a data eSIM has no number or SMS. The code goes to your home SIM, so register before you travel.
Is public Wi-Fi dangerous for messaging apps?+
With E2EE the message content stays encrypted, but insecure Wi-Fi still carries other risks, such as fake hotspots and metadata exposure. Using eSIM data for anything important is a sensible alternative.
Instagram and TikTok have no web share button, so we open your phone's share sheet or copy the link instead.