Set up truly private messaging in 15 minutes

If you do only one thing for your digital privacy this week, make it this. Moving your everyday conversations onto an end-to-end encrypted messenger is the single highest-impact step most people can take, and it takes about fifteen minutes.

What “end-to-end encrypted” actually means

End-to-end encryption (E2EE) means your message is scrambled on your device and can only be unscrambled on the recipient’s device. Not the company running the app, not your phone carrier, not someone watching the network in between can read the content. Only the two ends can, hence the name.

This matters because most communication is not like this by default. A standard text message, a typical email, or a chat on many platforms passes through servers that can read it, keep it, and hand it over. E2EE removes that middle ground: there is no readable copy sitting on a company’s servers waiting to be requested, breached, or scanned.

Why Signal is our default recommendation

We recommend Signal as the starting point for most people because it combines strong encryption with a simple, honest design:

• Its encryption protocol is open-source, independently audited, and so well regarded that other apps license it.
• It is run by a non-profit foundation, funded by donations rather than advertising, so there is no business incentive to collect data about you.
• It is deliberately built to hold as little information about you as possible, so there is very little to hand over even if compelled.

Signal is free, works on phones and desktop, and does voice and video calls too.

Set it up properly (the 15 minutes)

Installing the app is only step one. A few settings make a real difference.

1. Install and register

Download Signal from your device’s official app store, or from signal.org. Register with your phone number and verify the code it sends you. Your existing contacts who already use Signal will appear automatically.

2. Turn on disappearing messages

In a chat, open the conversation settings and set a disappearing messages timer (for example, four weeks as a sensible default). Messages then delete themselves from both devices after that time. You can also set a default timer for all new chats. This limits how much history exists to be lost, seized, or exposed if a phone falls into the wrong hands.

3. Enable Registration Lock

In Settings → Account, turn on Registration Lock. This requires your PIN to re-register your number on a new device, which stops someone who gets hold of your SIM or number from hijacking your Signal account.

4. Verify safety numbers for sensitive contacts

Each conversation has a safety number you can compare with the other person (in person, or over another trusted channel). Matching it confirms no one is secretly sitting in the middle of your conversation. You don’t need to do this for every chat, but it’s worth it for your most sensitive ones.

What still leaks: be honest about metadata

E2EE protects the content of your messages extremely well. It does not make you invisible. Even with a well-designed app, some metadata can exist: the fact that an account exists, and in weaker systems, who is talking to whom and when.

Signal is unusually careful here. Features like sealed sender are designed so that even Signal does not readily know who is messaging whom. But no tool erases metadata entirely, and your own device, backups, and the other person’s habits all matter. Privacy is a practice, not a single switch.

An honest word on WhatsApp and SMS

WhatsApp uses the same underlying encryption protocol as Signal, so the content of your chats is end-to-end encrypted, which is genuinely good. The trade-off is metadata: WhatsApp is owned by Meta, and the app collects and shares a considerable amount of information about how, when, and with whom you use it. If Signal isn’t an option for a particular contact, WhatsApp is far better than an unencrypted channel, just be aware of what it records around the edges.

SMS text messages are not private. Ordinary texts are generally unencrypted, readable by carriers, and vulnerable on the network. Treat SMS as a postcard: fine for “running five minutes late”, wrong for anything you’d want kept confidential. The newer RCS standard improves this in some cases but is inconsistent across providers, so don’t assume it.

You don’t have to move everything at once. Switch your most sensitive conversations first, invite the people you talk to daily, and let the rest follow.