Session is a decentralized encrypted messenger forked from Signal in 2018, operated by the Oxen Privacy Tech Foundation (Australia). Routes messages through the Lokinet onion network rather than centralized servers. No phone number, no email required for account creation: identity is a self-generated cryptographic ID. Open-source, audited.
What it means in practice
The architectural choice is the difference. Signal requires a phone number, which links accounts to carrier records and enables SIM-swap-driven identification. Session generates a random 66-character public key as the account identity, which has no upstream registry. Messages route through a decentralized service-node network (Lokinet, descended from Tor research) so no single server sees the source-destination pair. The trade-offs are real: Session is slower than Signal (multi-hop routing adds latency), the network is smaller (fewer service nodes than Tor relays), the user base is small (the “source already uses it” problem applies here too), and message delivery is best-effort with longer queue times during network congestion.
Who uses it, and against whom
Adopted by: privacy maximalists (the user base most willing to accept latency for unlinkability), activists in jurisdictions where SIM ownership is registered to ID and Signal’s phone-number requirement creates linkage risk, journalists working with sources who refuse to identify themselves to any centralized service, and the Oxen ecosystem (the $OXEN cryptocurrency project that funds the foundation). Adversaries: same as Signal at the endpoint level, plus a structural concern that the smaller and less-funded the network, the more vulnerable it is to nation-state takeover-via-Sybil attacks where an adversary spins up a majority of service nodes.
What you can change today
Install Session from getsession.org (verify the download signature via the published GPG key). On first launch, save the recovery phrase offline (12 words, the only way to recover the account if you lose the device). Share your Session ID with priority contacts via a secure out-of-band channel; the ID is the 66-character string under your account profile. Use Session as the channel where the no-phone-number requirement is binding (sources who refuse to share a number, accounts that must not link to your real identity at any registry). For most other use cases, Signal’s larger user base and faster delivery make it the better default.