Messengers
Session privacy rating
End-to-end encrypted messenger that uses a random Account ID instead of a phone number and sends messages through onion routing over a decentralized network of community-operated nodes. Stewarded by the Session Technology Foundation in Switzerland.
Summary
Session scores 94 out of 100 (grade A) on the messengers criteria. It meets 7 of 8 criteria: open source, no trackers or telemetry, no ads or data sales, end-to-end encrypted by default, no phone number needed, metadata protection and decentralized. It partly meets independent audit. It is based in Switzerland: Not in the Five, Nine or Fourteen Eyes; GDPR-style data protection law.
Score 94 out of 100. How scoring works
Criteria
-
Yes
Open source Weight 3 of 3
Is all the source code needed to run the product public?
The apps are GPL-3.0, and the storage server run by network nodes is MIT.
-
Yes
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
Exodus finds no trackers in the Android app, and the privacy policy states Session stores no information that could be used to track users.
-
Yes
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Funded by donations to the Session Technology Foundation, with no ads.
-
Partial
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
Quarkslab published a full audit report, but it is older than three years.
-
Yes
End-to-end encrypted by default Weight 3 of 3
Are all chats, including groups, end-to-end encrypted by default?
One-to-one chats and groups are end-to-end encrypted by default; large public communities are only encrypted in transit to their server.
-
Yes
No phone number needed Weight 2 of 3
Can an account be created without a phone number?
No phone number or email is needed; accounts use a randomly generated Account ID.
-
Yes
Metadata protection Weight 2 of 3
Does the service minimize who-talks-to-whom metadata (for example sealed sender or no user identifiers)?
Onion requests hide the sender's IP address and no single node knows both origin and destination of a message.
-
Yes
Decentralized Weight 1 of 3
Can people run their own server or talk peer to peer?
Messages are stored and relayed by a network of more than a thousand community-operated Session Nodes rather than central servers.