Secure messaging for journalists compared. Signal, Session, Wire, and Briar.

What the comparison measures

Four questions separate these apps in practice. What does the provider hold that a court order can reach. What identifier does a source have to reveal to start talking. What happens when a device is seized with the app installed. And does the channel still work when the network is hostile or absent.

Content encryption is not on the list because all four pass. The Signal protocol and its derivatives are not where source protection breaks. It breaks at the metadata layer, at the identifier layer, and at the endpoint. That is where secure messaging for journalists is actually decided, and the comparison lives there.

One boundary before the contenders: none of these apps is the right channel for first contact with an unknown source. First contact belongs to anonymous submission systems, covered in our guide to SecureDrop, OnionShare and digital dead drops. Messaging apps are for the relationship that comes after.

The four contenders

Signal

The reference. End-to-end encryption on everything, sealed sender to reduce server-side metadata, and the strongest legal record in the category: when subpoenaed, Signal has produced account creation timestamps and last-connection dates, nothing more, because that is all it retains. Usernames, added in 2024, let a source connect without ever seeing your phone number.

The phone number is still required at registration, which ties the account to an identity unless the source went through the considerable trouble of an anonymous SIM. And the endpoint is the open flank. A seized, unlocked device yields the full plaintext history, and artifacts can survive in places the app does not control. The case where the FBI recovered deleted Signal messages from an iOS notification database is the canonical example. Disappearing messages, set to days rather than weeks, are mandatory tradecraft, not a preference.

Session

A Signal-protocol descendant with the identifier problem removed. No phone number, no email: an account is a generated key pair, and a source can create one in a minute on a clean device. Messages route through an onion network of community nodes, so no central server holds a usable connection log. The foundation behind it relocated to Switzerland in 2024.

The cost is operational maturity. Delivery is slower and occasionally unreliable, group features and calls trail Signal by years, and perfect forward secrecy was traded away for the routing model, a real cryptographic concession. Session is the answer to one precise question: how does a source who cannot reveal any identifier reach me on a phone. For that question it is the best tool on the list.

Wire

E2EE messaging with email signup, built for organizations: multi-device by design, federated team spaces, audited clients, EU jurisdiction. For newsroom-internal coordination, editor to reporter to legal desk, it fits where consumer apps chafe, and procurement departments can actually sign it.

Past independent analyses found Wire retaining more connection metadata server-side than Signal retains, and its enterprise pivot means the consumer client is not the center of gravity. Treat it as the newsroom layer, not the source layer.

Briar

The shutdown tool. Briar is peer-to-peer: no servers exist to subpoena, log, or block. Over the internet it routes through Tor. When the internet is gone, protest zones, blackout regions, it keeps moving messages over Bluetooth and local Wi-Fi between nearby devices.

Android only, no iOS. Both parties must be contacts before the network drops. Battery cost is real. Briar is not a daily messenger and does not try to be: it is the channel you established in advance because the threat model said the network itself would become the adversary. Operating procedures for that environment are in our pillar on digital security for journalists.

Verdict by profile

Established source relationship, normal network conditions: Signal with usernames, disappearing messages on, safety numbers verified in person or over a separate channel. The endpoint discipline matters more than the app from this point on.

Source who cannot expose a phone number, or jurisdictions where SIM registration is identity registration: Session, accepted with its delivery quirks. Pair it with an agreed check-in rhythm so silence is information.

Newsroom coordination and anything involving the institution: Wire or a managed Signal deployment, decided by your security desk, not by individual reporters.

Hostile or absent network, planned in advance: Briar, installed and paired before deployment. It cannot be set up after the blackout starts.

Crossing borders with any of these installed is its own problem: an unlocked device at a checkpoint defeats every protocol equally. Channel choice for that scenario is covered in encrypted messaging apps for travel into hostile regions.

Channel hygiene rules

The app is the smaller half of the channel. Verify safety numbers or keys at the start of every sensitive relationship and re-verify after any device change; an unverified channel is an assumption, not a channel. Audit linked devices monthly on Signal and Wire, because a silently linked desktop is the cleanest interception there is. Keep cloud backups off for sensitive threads on every platform that offers them, since a backup is a plaintext copy governed by none of the app’s guarantees.

Then rehearse the failure. Agree with each source, in advance, what happens if either side goes silent, gets a new number, or sends a message that feels off. A channel with no agreed failure protocol fails at the worst possible moment, and the protocol costs one conversation to establish.

Frequently asked questions

Is WhatsApp ever acceptable for sources?

The content encryption is real Signal protocol. The metadata is Meta’s: who messaged whom, when, how often, from which IP, retained and producible under legal process, and cloud backups can silently break end-to-end guarantees. For sources, no. For logistics with people who will install nothing else, it beats SMS.

What about Telegram?

Default Telegram chats are not end-to-end encrypted, the server can read them, and Telegram has confirmed disclosing user data to authorities under court orders since 2024. Secret Chats exist, are opt-in, one-to-one only, and most users never enable them. It is a publishing platform with a messaging feature. Do not put a source on it.

What does a subpoena to each provider actually return?

Signal: registration date and last connection, per its published responses. Session: no central operator holds a comparable record. Wire: account data and connection metadata under EU process. Briar: there is no provider. None of the four can produce message content they never possessed.

Does the source need the same level of discipline I have?

More. You are exposed once; the source is exposed permanently. Their device lock, their disappearing-message settings, their backup configuration all sit outside your control, which is why channel onboarding is part of the first conversation, not an afterthought.

Should I keep the app visible on my phone at all?

On a device that crosses borders or could plausibly be seized, app presence is itself a data point. Some reporters run sensitive channels on a separate device that stays home. Whether that applies to you is a threat-model output, and you can build one in twenty minutes with our guide.

---

There’s no perfect setup. Anyone selling you perfect is selling fear. The goal is simple: make yourself a harder target than the person next to you.