Recommended Free Tools
For routine confidential-source conversations, compare Signal, WhatsApp, and Wire—but don’t treat any app as a guarantee of anonymity or safety. CPJ recommends end-to-end encrypted messaging where possible and names all three. Signal says its conversations are encrypted by default; WhatsApp distinguishes personal messages from some business messaging; Wire says its messages, calls, and media are encrypted by default. For anonymous document submissions, a newsroom-operated SecureDrop system may fit better than a chat app. The right choice depends on the source’s risk, device security, backups, and the newsroom’s records practices.
What does end-to-end encryption protect?
End-to-end encryption is designed to protect message content while it travels between participants: the service should not be able to read the content in transit. It does not make either participant anonymous, secure a compromised or unlocked phone, prevent screenshots or copying, or erase other copies of a conversation. Notifications, contact lists, linked devices, backups, telecom records, and location data can all create exposure. CPJ also warns that a sent file’s timestamp and metadata inside the document may help identify a source. CPJ’s digital safety guidance explains these risks.
As an Amazon Associate I earn from qualifying purchases.
App features and data practices can change by version, country, and operating system. Provider descriptions below are their own claims, not an independent finding that one service is universally safest.
How do Signal, WhatsApp, and Wire compare?
| Service | Encryption and verification | Identity, metadata, and copies to review | Best fit to consider |
|---|---|---|---|
| Signal | Signal says conversations are always end-to-end encrypted. Its safety numbers let participants verify they are communicating with the intended contact. Signal says its client and server code are publicly available for examination. Signal’s privacy and trust explanation. | Review linked devices, notification previews, and backup or transfer settings. Signal’s support documentation describes optional Secure Backups protected by end-to-end encryption and a recovery key, as well as platform-specific transfer and local backup options; check current settings rather than assuming all copies work alike. Signal’s backup and transfer documentation. | A strong default to compare for one-to-one confidential conversations, especially when participants can verify safety numbers and manage device settings. |
| WhatsApp says personal one-to-one and group messages use end-to-end encryption with the Signal protocol. Its explanation distinguishes this from some business messaging arrangements, including cases where a business chooses cloud storage WhatsApp does not consider end-to-end encrypted. WhatsApp’s privacy explanation. | WhatsApp says it handles information needed to route messages and describes group information and legal-order disclosures. Review encrypted-backup settings separately: message encryption does not by itself establish that a backup is encrypted end to end. Also check profile visibility and who can add you to groups. | A practical option when the source already uses it and can communicate without creating a risky new account trail; be precise about personal versus business chats and backups. | |
| Wire | Wire says messages, conference calls, and files are end-to-end encrypted by default. Its March 2, 2026 support page treats Wire Drive files and folders differently: they are secured in transit and encrypted at rest. Wire’s encryption explanation. | Wire says it collects account data including registration email, username, profile name, and device metadata for synchronization. These are provider statements, not an independent audit conclusion. Wire’s security information. | Worth comparing when its default encryption and account model suit both participants. The reviewed documentation does not establish that Wire is universally more suitable than Signal or WhatsApp. |
CPJ’s guidance names Signal, WhatsApp, and Wire as end-to-end encrypted options and advises users of Signal and WhatsApp to turn on disappearing messages. That setting can reduce how long a chat remains visible, but it cannot prevent a recipient from preserving a copy or settle record-retention duties.
#1 Best Overall
Which app is safest for talking to a confidential source?
There is no universal winner. For many routine conversations, Signal is a straightforward starting point because Signal says encryption is always on and supports safety-number checks. WhatsApp can be a reasonable choice when a source already uses it and its personal-message protections meet the need. Wire may fit when both parties can use it and its account and device model make sense for the conversation. In practice, a source’s ability to use a service safely matters as much as the app’s stated encryption.
Ask what could identify or harm the source if exposed: the fact of contact, the account used, a group membership, a document’s contents or metadata, or a device location. If installing a new app or creating an account would itself draw attention, switching services may increase rather than reduce risk.
Rank #2
- Distraction Free: The MP02 4G cell phone makes it easier to be where you are—whether that’s a weekend away or an important business meeting. Keep what matters close with calls and SMS-first texting, without the constant onslaught of designed-for-addiction notifications.
- Privacy & Security Focused: Built with security in mind from the start, the MP02 is designed to help safeguard your information without requiring you to share more personal data than necessary. Enjoy peace of mind with a phone experience that prioritizes discretion and control.
- Carrier Compatibility & Connection: AT&T is supported (coverage verified, VoLTE supported). T-Mobile is supported, but VoLTE is not supported. Verizon is not supported. Many US carriers use VoLTE for voice calls - if VoLTE isn’t supported on your carrier, call performance may be limited even with signal. The MP02 supports 4G LTE across key bands (2G: 850/900/1800/1900 3G: WCDMA 1/2/4/5/6/8/19 4G: FDD LTE 1/2/3/4/5/7/8/12/17/19/20).
- Simple By Design: A minimalist interface keeps everyday actions straightforward. Call and text buttons provide quick access, while a streamlined menu helps you stay focused on essentials. Note: messaging is SMS-first (MMS group chats aren’t supported), helping to keep communication simple.
- Built for Everyday: Designed for comfortable one-handed use with a clean, minimalist silhouette. Reinforced glass fiber construction supports daily use, while the lightweight shape makes it easy to carry anywhere.
How should a journalist and source set up a safer conversation?
- Choose the channel without exposing the source. Agree on a method through a contact route that is already safe. Consider using a pseudonym rather than the source’s real name in contacts. CPJ advises considering deletion of contact details when contact ends.
- Verify the person. In a high-risk Signal conversation, compare safety numbers through a trusted method. Treat an unexpected account or security-code change, login prompt, or request to move the conversation as a reason to verify independently before proceeding.
- Secure both endpoints and accounts. Keep the operating system and app updated, set a strong device passcode, use available account locks and two-step verification, restrict profile visibility and group additions, and hide sensitive lock-screen previews. FBI guidance also recommends reviewing linked devices and using app-specific controls such as Signal Registration Lock and Screen Lock.
- Review every copy and access point. Check cloud and local backup settings, linked devices, and message-retention choices together. If reporting requires keeping a record, agree on a deliberate secure retention plan rather than assuming deletion removes all copies. FBI guidance recommends disabling backups unless they are end-to-end encrypted and strongly protected.
- Check the file, not just the transfer. Before sending a document, consider whether its author, location, creation details, or send time could identify the source. Use specialist digital-security help for sensitive data management when needed.
- Respect records obligations. Disappearing messages are a risk-reduction control, not a promise that no record exists. In official or business contexts, ephemeral messaging may conflict with legal, professional, discovery, or records duties; check the applicable newsroom policy and law before enabling automatic deletion.
The FBI’s mobile communications recommendations provide general cybersecurity guidance, not an endorsement of a particular messaging app.
When should you use SecureDrop instead of a messaging app?
SecureDrop is not a general chat app. It is an open-source submission and communication system operated by a media organization for anonymous sources. The newsroom must run an instance and follow its operational procedures. SecureDrop’s journalist workflow includes encrypted submissions, a transfer device, and an air-gapped environment for viewing sensitive files; its documentation says the system limits collected metadata. SecureDrop’s documentation describes the system and newsroom workflow.
A SecureDrop site does not make every step invisible: its source guide warns that visiting a site can leave traces with an internet service provider and offers source-side precautions. CPJ says that where SecureDrop is unavailable, journalists may receive documents under 100 MB through Signal or another end-to-end encrypted service, but file metadata can still expose a source. That file-size guidance is not a guarantee that messaging is the right channel for a high-risk submission. CPJ’s source-protection guidance also notes that an in-person meeting may be safer in some circumstances, depending on the risks.
What should you decide before exchanging sensitive information?
- Is the priority an ongoing conversation, a document submission, or anonymity? Choose the workflow accordingly.
- Can both people use the service without creating a conspicuous or unsafe account trail?
- Have both participants protected their devices, accounts, notifications, linked devices, and backups?
- Can the recipient verify the sender, and can the sender safely verify the recipient?
- Could the conversation itself, its timing, or a document’s metadata expose the source?
- Does the newsroom have a retention policy or legal duty that affects disappearing messages or deletion?
For exceptional-risk reporting, get individualized digital-security advice and assess the source’s circumstances rather than relying on an app comparison alone.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
