Encryption has become a checkbox on the features page, and that is a problem. Two apps can scramble your messages flawlessly and still differ wildly in what the company running them learns about you: who you know, when you talk to them, how long your messages are, and what happens to the copy sitting in a backup.

Metadata is the part people skip past. Here is what the main options actually expose, and the handful of settings that make a real difference.

The content is the easy part

End-to-end encryption means your device scrambles a message and the recipient's device unscrambles it. The server in between relays ciphertext it cannot read. That matters: it defeats mass interception and makes a compromised server far less useful to an attacker.

But a messenger still has to deliver. It must know which device to hand a message to, and roughly when. Everything beyond that — whether it records the sender's identity, how long it keeps delivery logs, whether it can see your contact list — is a design choice, not a mathematical limit. Two services can both be "encrypted" and be opposites in practice.

Your contact graph is the biggest leak

To tell you which of your friends already use an app, most services need a list of your friends. The cheap way is to upload your entire address book. The privacy-preserving way is to check the overlap without revealing the whole list. This is where the apps diverge most sharply:

• Signal registers you with a phone number, but uses private contact discovery rather than dumping your address book onto its servers. Sealed sender hides who sent a message from the service, and you can now use a username so fewer people need your number.
• WhatsApp encrypts message content by default, yet the account is tied to your number, your address book is uploaded for matching, and group membership is visible to the service.
• Telegram is the odd one out. Cloud chats and groups are not end-to-end encrypted — only one-to-one Secret Chats are, and those are phone-only and tied to a single device. Everything else sits on Telegram's servers in a form it can read.
• Matrix and Element are federated, so no single company holds the graph — but every homeserver in a room sees room ID, membership and timestamps. Encryption hides what was said, not who was in the room.
• Threema, Session and SimpleX avoid phone numbers. Threema uses a random ID with minimal server records, Session routes traffic through onion nodes, and SimpleX goes furthest, using no account identifier at all — just per-contact queues.
• Briar has no central server. Messages travel peer to peer over Tor, or over Bluetooth when there is no internet at all. The trade-off is that both people generally need to be online.

Read that list with your own life in mind. If your concern is a nosy advertiser, the differences are merely irritating. If it is someone with access to a company's records, the contact graph is often more revealing than the messages themselves.

Timestamps, message lengths and quiet signals

Even with no names attached, a server that logs when packets move can infer a lot: sleep patterns, working hours, when a relationship got busy. Message length narrows things further — a short reply to a long one looks different from a forwarded document. Delivery receipts, read receipts, typing indicators and "last seen" are metadata you generate deliberately, and several apps let you switch them off.

Push notifications are a common weak spot. If a preview is generated by the service, it may pass through third-party infrastructure. Turning off message previews on your lock screen costs you very little.

Backups: where encryption usually stops

The most common way encrypted chats get read is not a broken cipher. It is a backup.

If your WhatsApp history goes to Google Drive or iCloud without encryption enabled, that cloud copy is protected by your account, not by the promise you relied on. WhatsApp lets you turn on end-to-end encrypted backups using a password or a long key you keep yourself. Set it up before you need it, and accept that losing the key means losing the history.

The same pattern appears on iPhones. Messages are encrypted in transit, but an iCloud backup can include a copy whose keys Apple holds — unless you enable Advanced Data Protection, which moves more categories under keys only you control. Test recovery before you trust it. An unusable backup is worse than none.

Signal stores little on its servers by design, and its cloud backup option encrypts the archive with a key held on your device. Telegram's cloud chats are stored server-side by definition. Threema keeps its servers out of the loop and expects you to manage backups yourself.

Settings worth changing this week

Whatever app you use, these steps cut down what leaks without much inconvenience:

1. Turn off cloud backups you don't need, then enable encrypted backups where offered and store the key in a password manager — not a screenshot.
2. Disable read receipts and last-seen visibility where the app allows it. Accept that this is usually reciprocal.
3. Set disappearing messages as the default in your most sensitive conversations. Short retention limits the damage from any future breach.
4. Check whether your phone number is discoverable, and use usernames or IDs for new contacts where they exist.
5. Review linked devices every few months and remove anything you don't recognise.
6. Switch off notification previews, and prefer apps that don't require your address book to function.

Choosing without the hype

There is no single winner. Signal is the sensible default for most people: strong defaults, usable metadata protections and no advertising incentive. WhatsApp is where your friends already are, and enabling encrypted backups plus tightening its privacy settings makes it meaningfully better than a default install. If your contacts will follow you to a smaller network, Threema or Session reduce what the server knows; SimpleX and Briar go further at the cost of convenience.

Pick one app for the conversations that matter, apply the settings above, and check your backup before you need it. That is a more honest improvement than any badge on a download page. If you depend on secure messaging for work, journalism, legal or personal-safety reasons, get advice for your particular situation rather than relying on an app's marketing.

Photo: Erik_Lucatero / Pixabay