PrivChat compared with WhatsApp, Telegram, Signal, SimpleX, Tox and Briar

01

Summary

PrivChat is the strictest of the seven in one specific way: your messages pass through no server, there is no account and no phone number, and everything — the key agreement, its renewal, the signatures and the envelope that says who is writing — is post-quantum.

It does not win everywhere. Signal, SimpleX and Briar have published independent audits while ours is internal; almost all of them reach more platforms and are open source. Signal and SimpleX also already protect message content against a quantum computer.

02

The full table

Criterion	PrivChat	WhatsApp	Telegram	Signal	SimpleX	Tox	Briar
Works without a phone number	Yes	No	No ¹	No	Yes	Yes	Yes
Works without an account	Yes	No	No	No	Yes	Yes	Yes
Servers everything passes through	None	Meta’s	Telegram’s	Signal’s	Relays with no identity	None	None
Who can know who you talk to	Nobody	Meta	Telegram ²	Signal, the minimum	Nobody	Your IP can leak	Nobody
End-to-end encrypted by default	Yes	Yes	Only in “secret chats”	Yes	Yes	Yes	Yes
Post-quantum key agreement	Yes	No	No	Yes	Yes	No	No
The ratchet renews post-quantum too	Yes	No	No	Yes ³	Yes	No	No
Post-quantum signatures and envelope	Yes	No	No	No	No	No	No
Every message the same size	Yes	No	No	No	Yes	No	—
Sends decoys when you are not writing	Yes	No	No	No	No	No	No
Works with no internet	Yes: Bluetooth, local network or package ⁵	No	No	No	No	Local network only	Yes ⁴
Platforms	Android, Windows and Linux	All	All	All	All	Several	Android; desktop in beta
Open source	No	No	Clients only	Yes	Yes	Yes	Yes
Security audit	Internal, by SecureAudit	Internal, by Meta	Academic review (2020)	External, published	Trail of Bits (2022 and 2024)	Unaudited	Cure53 (2017)

¹ Telegram allows signing up with an anonymous +888 number, which is paid for.

² Since 2024 Telegram hands IP addresses and phone numbers to authorities on a valid court order.

³ Signal added the post-quantum ratchet (Triple Ratchet, SPQR) in October 2025.

⁴ Briar syncs over Bluetooth, local wifi or USB with no internet connection at all.

⁵ Since 2.10, PrivChat talks to contacts within range over the same local network or Bluetooth, in a mode both of you turn on on purpose, and by package: a file only the recipient can open, which goes as far as someone carries it. It does not relay through third parties or look for anyone.

“—” means we could not find a public fact we can check.

Checked in September 2026 against each app’s public documentation. These things change: if you see something wrong or out of date, write to us and we will correct it.

03

Architecture and network

What separates these apps most is not how they encrypt, but where the messages travel.

	Model	Is there a server?	Network anonymity
PrivChat	Peer-to-peer: each device is its own Tor onion service	No	Yes: everything over Tor, with padding and decoys
WhatsApp	Meta’s servers, which hold a message until delivery (up to 30 days)	Yes	No
Telegram	Telegram’s servers; regular chats live in its cloud	Yes	No
Signal	Signal’s server, which relays messages and hands out keys	Yes	No
SimpleX	Relays with anonymous queues; messages are deleted on delivery	Relays with no user identity	Partial: private routing; Tor optional
Tox	Distributed network (DHT); both ends must be online	No	No: your contacts see your IP
Briar	Peer-to-peer over Tor, Bluetooth, wifi or USB	No	Yes, over Tor

04

Encryption

They all encrypt content well. The differences are in how keys are agreed and how they are renewed.

	Key agreement	Renewal	Signatures
PrivChat	PQXDH: X25519 + ML-KEM-768	Double Ratchet with ML-KEM-768 in every epoch	Ed25519 + ML-DSA-65, both required
WhatsApp	Signal Protocol	Double Ratchet	Classical
Telegram	2048-bit Diffie-Hellman (MTProto 2.0), secret chats only	New key every 100 messages or every week, secret chats only	—
Signal	PQXDH: X25519 + ML-KEM (since 2023)	Triple Ratchet with SPQR, post-quantum (since 2025)	Classical
SimpleX	Hybrid post-quantum exchange inside the Double Ratchet	Post-quantum Double Ratchet	Classical
Tox	Curve25519 (NaCl)	—	—
Briar	Bramble protocol	—	—

05

Post-quantum

A future quantum computer does not only break tomorrow’s traffic: it opens whatever someone recorded today. That is why it matters how far each app has gone.

	Key agreement	Renewal	Signatures	Envelope (who writes)
PrivChat	Yes	Yes	Yes	Yes
WhatsApp	No	No	No	No
Telegram	No	No	No	No
Signal	Yes	Yes	No	No
SimpleX	Yes	Yes	No	—
Tox	No	No	No	No
Briar	No	No	No	No

Signal and SimpleX already protect content against a quantum computer. What PrivChat adds is the signatures and the envelope: nobody can forge an identity or later work out who was writing to whom.

06

Metadata

Who talks to whom, when and how much. It often says more than the message itself.

	Who can know it	What the service keeps	Against traffic analysis
PrivChat	Nobody: there is no service	Nothing: there is no server	Uniform size and decoys when you are not writing
WhatsApp	Meta	Usage and device data, per its policy	No
Telegram	Telegram	Phone number, IP and activity; handed over on court orders since 2024	No
Signal	Signal, the minimum	Sign-up date and last connection date	No
SimpleX	Nobody	Relays hold no user identity	Uniform size
Tox	Your contacts see your IP	No server	No
Briar	Nobody	No server	—

07

Identity and sign-up

What you have to hand over to start using it.

	Phone number	Account	How you are identified
PrivChat	No	No	A key; added with a QR code and verified with a fingerprint
WhatsApp	Yes	Yes	Phone number
Telegram	Yes, or a paid anonymous +888 number	Yes	Number and username
Signal	Yes, to register	Yes	Number; optional username since 2024
SimpleX	No	No	No persistent identifier, not even a random one
Tox	No	No	Public key (Tox ID)
Briar	No	No	Link or QR code

08

On the device

What protects your data when someone has your phone or computer in their hands.

	Local encryption	Lock	Emergency wipe
PrivChat	SQLCipher: system keystore key on the phone, 13-word phrase on the computer	PIN on the phone (Argon2id); phrase on the computer	Panic PIN on the phone, which destroys the keys
WhatsApp	—	Biometrics or passcode	—
Telegram	—	Passcode	—
Signal	Encrypted database	PIN, biometrics	—
SimpleX	Database encrypted with a passphrase	Passcode	Self-destruct passcode
Tox	—	—	—
Briar	Database encrypted with a password	Password	—

09

What each one does differently

PrivChat

One-way channels with their own Tor address; decoys when you are not writing; post-quantum signatures and envelope; panic PIN.

WhatsApp

The largest user base in the world; communities and group calls.

Telegram

Huge channels, bots, groups of up to 200,000 members and cloud sync.

Signal

The reference for end-to-end encryption; calls; usernames; post-quantum ratchet.

SimpleX

No user identifier at all, not even a random one; hidden profiles; incognito mode.

Tox

No infrastructure at all; several compatible clients.

Briar

Works without internet, over Bluetooth, wifi or USB; designed for crises and blackouts.

10

Where PrivChat wins and where it does not

Where it wins

It is the only one of the seven with post-quantum signatures and a post-quantum envelope.
It is the only one that sends decoys when you are not writing. SimpleX also makes every message the same size.
No server, no number, no account. Briar and Tox have none either; SimpleX uses relays with no identity.
The panic PIN destroys the keys. SimpleX has a similar self-destruct passcode.

Where it does not

It has no independent audit: SecureAudit audits it internally. Signal, SimpleX and Briar have published ones.
It is not open source.
It is not on iPhone yet (in testing).
Groups hold up to 200 people and are text-only; WhatsApp, Telegram and Signal allow far more, with photos.
It is little known: your contacts most likely do not have it yet.

11

Sources

Checked in September 2026 against each app’s public documentation. These things change: if you see something wrong or out of date, write to privchat.wiki@proton.me and we will correct it.

Seven apps, no tricks.