Messengers
Threema privacy rating
Paid end-to-end encrypted messenger from Switzerland that works with a random Threema ID instead of a phone number. The apps are open source; the server is proprietary.
Summary
Threema scores 83 out of 100 (grade B) on the messengers criteria. It meets 5 of 8 criteria: no trackers or telemetry, no ads or data sales, independent audit, end-to-end encrypted by default and no phone number needed. It partly meets open source, metadata protection and decentralized. It is based in Switzerland: Not in the Five, Nine or Fourteen Eyes; GDPR-style data protection law.
Score 83 out of 100. How scoring works
Criteria
-
Partial
Open source Weight 3 of 3
Is all the source code needed to run the product public?
The apps are AGPL-3.0; the server is closed source.
-
Yes
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
Threema states it refrains from advertising and tracking users; the website uses only a first-party affiliate cookie.
-
Yes
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Funded by app purchases and business licenses, with no ads or data trading.
-
Yes
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
Cure53 published a full audit report of the desktop app.
-
Yes
End-to-end encrypted by default Weight 3 of 3
Are all chats, including groups, end-to-end encrypted by default?
All messages, media, calls and group data are end-to-end encrypted.
-
Yes
No phone number needed Weight 2 of 3
Can an account be created without a phone number?
No phone number or email address is required; accounts use a random Threema ID.
-
Partial
Metadata protection Weight 2 of 3
Does the service minimize who-talks-to-whom metadata (for example sealed sender or no user identifiers)?
Group memberships stay on devices and messages are deleted after delivery, but the server routes messages by sender and recipient ID.
-
Partial
Decentralized Weight 1 of 3
Can people run their own server or talk peer to peer?
Organizations can self-host with Threema OnPrem, but servers do not federate.