Signal Without Phone Number — 8 Alternatives Compared (2026)

In May 2026, security teams at Tech Times, the German BSI, and the Dutch AIVD all flagged the same campaign: state-linked attackers were phishing Signal backup keys from journalists, diplomats, and military officers — and once the backup key leaks, the attacker reads every message the victim ever sent or received on Signal.

The phone number is the leash. If your secure messenger is tied to a phone number, every social-engineering attack can target that number: SIM swap, fake support text, QR-code linked-device pairing, port-out fraud. Signal is the gold standard for the cryptography, but its identity layer was never built to survive a state-grade phishing campaign.

Account-free messengers solve a different problem. There is no phone number to spoof, no recovery code to phish, no contact graph to subpoena. You generate an ID (or a room code), share it through a side channel, and the conversation lives behind cryptography you control.

This guide compares 8 messengers that do not require a phone number, ranked by what they actually protect — not by marketing claims. I built the same comparison table I use when a journalist client asks “what should I install before this interview?” and “if I am sued, what can the messenger company hand over?”

What changed in May 2026

Three things happened in three weeks:

The Signal backup-key phishing wave. Attackers sent fake “Signal support” SMS to journalists in DE, NL, and FR. The link installed a malicious linked device. Once the device was linked, the attacker could read message history going back years.
Meta launched WhatsApp Incognito Chat with Meta AI on 13 May 2026. Useful for AI questions, not end-to-end encrypted for normal chats — Meta moved Instagram DMs off E2E on 8 May 2026.
CISA refreshed its mobile secure-communication guidance. The new line: “vetted secure messaging app with E2EE and VoIP” — but no specific apps are named, because phone-number-tied apps have a recovery problem the agency does not want to endorse.

The signal in the noise: demand for account-free messengers tripled in 30 days. Google Trends for signal alternative hit 100/100 in the week of 10–16 May 2026, up from a 90-day baseline of 37/100. People are looking for something Signal cannot give them: an identity that is not their phone.

The 3-criteria filter for “truly account-free”

Most “no phone number” lists are wrong. They include apps that take an email, sync your contact book, or generate an ID that follows you across reinstalls. Use this filter:

No phone number on signup. (Strict.)
No email on signup. (Strict — email + phone tied to one wallet = one subpoena = full graph.)
No contact-list upload, no friends graph, no profile photo. (Strict — passive metadata is what leaks identities, not message content.)

An app that fails any one of these is still a “private messenger,” but it is not account-free. It just moved the leash.

The 8 messengers worth comparing in 2026

Messenger	Phone?	Email?	Contact sync?	Encryption	Disappear on read	Price	Open source	Country
Threema	No	No	No	NaCl + ECDH	Optional timer	$4.99 one-time	Yes (clients)	Switzerland
Session	No	No	No	Signal Protocol (modified)	Optional timer	Free	Yes	Australia (OPTF)
SimpleX Chat	No	No	No	Double Ratchet + DH	Per-conversation	Free	Yes	UK
Element (Matrix)	No	Optional	No	Olm/Megolm (Matrix)	Per-room	Free	Yes	UK
Briar	No	No	No (peer-to-peer)	BTP + Tor	Per-conversation	Free	Yes	UK/EU (Briar Project)
Wire Personal	No	Yes	No	Proteus	Optional timer	Free / paid tiers	Yes	Germany
Skred	No	No	No (peer-to-peer)	AES-256 + DH	Yes	Free	No	France
No Trace Chat	No	No	No	AES-256-GCM + PBKDF2 (100k rounds)	Default — delete on read, no timer	$4.99 one-time (after 50 free messages)	No	UK (Teamz Lab)

A note on what is missing: Telegram (regular chats are not E2E, requires phone), Signal (requires phone), WhatsApp / Meta AI Incognito (requires phone, Meta deprecated Instagram E2E), Snapchat (requires phone and email). These are not account-free messengers in 2026. They are mainstream messengers with privacy features bolted on.

Threema

The Swiss option. Pay $4.99 once, get a Threema ID that is not your phone number. The cryptography is custom (NaCl-based) and has been audited multiple times. Threema does not store contacts on its servers and operates from Swiss jurisdiction, which is a real legal advantage if you are subpoenaed in the US or UK.

Strengths: mature, paid (which weeds out spam), Swiss data protection, business tier. Weaknesses: the network effect is small (most contacts are not on it), and “optional” disappearing messages means most users never enable them. If you turn off the timer, your messages are stored on the recipient’s device forever.

Session

The onion-routed option. Built on a modified Signal Protocol, no phone, no email, generates a 66-character Session ID. Traffic is routed through a decentralized network of service nodes — the “Lokinet” — which makes it hard to map your IP to your messages.

Strengths: strongest metadata protection in the comparison, account-free by default, multi-platform. Weaknesses: message delivery can lag 5–30 seconds, the UX is rougher than Signal, and the protocol fork drops some forward-secrecy guarantees the original Signal Protocol provides.

SimpleX Chat

The “no IDs at all” option. SimpleX does not even generate a long-lived user ID — every conversation starts with a fresh queue address shared via QR or link. There is genuinely nothing to subpoena because the server does not know which queue belongs to which person.

Strengths: the strongest identity-separation model in the comparison, open source, no phone/email/ID. Weaknesses: UX is the most technical of the bunch, no native iOS push (uses background fetch), and the no-ID model means you re-share a link for every new contact.

Element (Matrix)

The federated option. Pick a server (or run your own), create a username, get an end-to-end-encrypted room. Most modern Matrix clients (Element, Element X, Cinny) support cross-signing and verified devices.

Strengths: federation means no single entity owns your account; widely deployed in EU governments; bridges to Slack/Discord/Telegram. Weaknesses: server choice matters (matrix.org is fine for most, but a hostile server can see who talks to whom even if it cannot read messages); UX is still busy.

Briar

The “no internet required” option. Briar runs peer-to-peer over Bluetooth, Wi-Fi, or Tor. There is no central server at all. If the internet is cut, Briar still works over local radio.

Strengths: the only entry that survives an internet shutdown; Tor-by-default; designed for activists. Weaknesses: Android only, no group video, manual contact exchange (you have to be in the same place once or share a link out-of-band).

Wire Personal

The “businessy” option. Wire takes email (not phone) for personal accounts and offers paid tiers for teams. End-to-end encryption is solid (Proteus, derived from the Signal Protocol).

Strengths: the cleanest desktop client in the comparison, multi-device sync, EU jurisdiction. Weaknesses: email tied to account violates criterion 2 above. If you can live with email-as-identity, it is a fine choice. If you cannot, skip.

Skred

The peer-to-peer French option. Skred has been quietly running since 2017. No phone, no email, all communication is end-to-end encrypted and ephemeral messages delete from both ends. The codebase is not open source, which is the main reason it does not rank higher.

Strengths: clean UX, free, no signup required, audit-friendly French data protection regime. Weaknesses: closed source, smaller user base than Threema or Session.

No Trace Chat

The code-based option. Built by Teamz Lab. Instead of generating a long-lived ID, you generate a room code — anyone with the code can join, no one without it can. Messages are end-to-end encrypted with AES-256-GCM and a key derived from the room code through 100,000 rounds of PBKDF2.

The differentiator: messages are deleted on read by default. Not a timer. Not a setting. Once the other person reads it, it is gone from the chat. There is also no push notification, no profile picture, no friends list, no online status — and a Gate Screen mode that makes the app look like a blank screen on unlock.

Strengths: the only entry where ephemeral is the default; the lowest entry barrier (no ID generation, just type a code); pricing is honest ($4.99 lifetime after 50 free messages). Weaknesses: Firestore-backed server side (messages live in Firestore until delete-on-read fires — the server sees encrypted blobs, but the architecture is centralized); no voice or video calls in v1; smaller user base than Threema or Session.

Pick by threat model, not by feature list

Comparison tables are useless without a threat model. Here is how I match the 8 above to actual use cases.

Journalist receiving a tip

You want: maximum metadata protection, no link between your real identity and the tip-line, message disappears after read so a phone seizure does not expose old conversations.

Pick: Session for the onion-routed metadata layer or SimpleX for the no-ID model. Use Signal-via-SecureDrop only for first contact, then move to one of these for follow-up. No Trace Chat works for short-window tip exchange (delete-on-read is automatic) but a determined adversary can subpoena Firestore for the encrypted blob — fine for low-to-medium threat tips, not for state-level sources.

Lawyer-client privileged communication

You want: court-defensible encryption, jurisdiction outside discovery range, message persistence (the lawyer needs the record), no metadata leak about who you are talking to.

Pick: Threema (Swiss jurisdiction, mature audit history, paid model = real company you can subpoena back) or Element on a self-hosted Matrix server. Disappearing messages are a bad fit here — the lawyer needs the record.

HR doing a layoff or sensitive feedback round

You want: ephemeral by default (no one wants the HR conversation in a Slack export six months later), no phone numbers exchanged with the employee, easy enough that a non-technical employee can join.

Pick: No Trace Chat — the code-based room is the lowest-friction option, delete-on-read means there is no record, and the employee installs in 30 seconds. No HR director wants to teach Element to a panicked employee.

Activist in a hostile country

You want: works without the internet (radio blackouts), no centralized server to seize, Tor by default, plausible deniability about even having the app.

Pick: Briar (the only one that works peer-to-peer over Bluetooth) plus Session as a backup for online comms.

Couples or close friends

You want: nothing fancy, just messages that do not stick around forever and a way to share a room without exchanging phone numbers.

Pick: No Trace Chat for the lowest-friction code-based join, or Session if you both already use it for other things.

Founders, dev teams, code review with a contractor

You want: a quick private chat to talk about a sensitive bug, a credential rotation, or a salary negotiation — without it landing in Slack history.

Pick: No Trace Chat for one-off rooms (paste the code in a meeting note, delete the chat after). Wire if your whole team is already on it.

Common questions

Is “Signal without a phone number” possible at all?

In 2026, no — Signal still requires a phone number to register. Workarounds exist (Twilio numbers, MySudo, Google Voice) but they introduce a new identity provider into your threat model, and the Signal team has explicitly said they have no plans to remove the phone requirement. If you want truly account-free, Signal is the wrong tool.

Is Telegram a Signal alternative?

Only for casual privacy. Telegram requires a phone number, regular chats are not end-to-end encrypted, and “Secret Chats” are device-bound and easy to forget to enable. Use it for groups and broadcasts, not for sensitive conversations.

What about “incognito chat” in WhatsApp or Meta AI?

Meta’s Incognito Chat with Meta AI (launched 13 May 2026) is private between you and the AI — not end-to-end-encrypted for human-to-human messages. On 8 May 2026 Meta removed optional E2E from Instagram DMs entirely. Treat Meta’s privacy features as marketing, not as a Signal alternative.

Which option ranks best for journalists in Europe?

For metadata protection: Session. For jurisdiction: Threema (Switzerland is the only mature option outside the 5-Eyes / 14-Eyes reach). For ephemeral by default: No Trace Chat. Most journalists I have helped run two — Threema for ongoing source relationships, Session for first-contact and burner tips.

Is open source required?

It is preferred but not absolute. Threema clients are open source while the server is not — most security researchers consider this acceptable because the cryptography is auditable end-to-end. Skred and No Trace Chat are closed source today; they should not be your only line of defense for state-level threat models.

How does code-based room access (No Trace Chat) compare to a Session ID?

A Session ID is a persistent identity — same ID across conversations, can be subpoenaed against. A code-based room is a single-purpose key — it works for one room only, lives only while the conversation is active, and the server stores only encrypted blobs derived from a 100,000-round PBKDF2 expansion of that code. If you want one identity that lasts, Session. If you want a fresh “burner room” every time, the code model wins.

What about open-source messengers like Status or XChat?

Status (decentralized chain-based identity) is fine for crypto-native users but has UX cost. XChat (Nostr-based) is too new to recommend for sensitive use. Both are worth watching, neither is ready for “install this and trust your life to it” recommendations in mid-2026.

How No Trace Chat fits

No Trace Chat is the entry I built. It is not a universal Signal replacement — it does not have voice/video calls, the user base is small, and the server side runs on Firebase Firestore (the messages are E2E-encrypted blobs to the server, but it is a centralized architecture).

What it is good at: ephemeral one-off rooms. A journalist’s tip line for a single story. An HR conversation that should not live in Slack history. A code-review chat with a freelance contractor about a credential that needs rotating. A couple sharing something they do not want screenshot. The code-based model means you do not need a Session ID, do not need to install Matrix, and do not need to teach the other person what “linked device” means.

If you want to try it: No Trace Chat is free for the first 50 messages, $4.99 lifetime after that, and works on Android, iOS, web (notracechat.teamzlab.com), Linux, and macOS. There is also a Ghost-mode lockscreen that makes the app look like nothing happens when you open it — long-press 3 seconds, tap 3 times to unlock.

What we build at Teamz Lab

We are a UK-based app studio (Teamz Lab LTD, company no. 16106867). We ship privacy-first apps, encrypted-by-default web tools, and B2B integrations where the requirement is “no one but the user can see this.” No Trace Chat is one of our own apps; we also build for journalists, legal tech firms, HR-tech founders, and security researchers who need a custom encrypted channel.

How to work with us: every engagement runs through Upwork escrow. You fund the milestone, we ship the milestone, you release the payment after you verify the result. No upfront wire transfers, no NDAs before you have seen our work, no commitment until you have approved the first deliverable.

See our Upwork agency: Teamz Lab on Upwork
Portfolio: /portfolio/
Book a 20-minute call: teamzlab.com

If you need an encrypted internal-comms tool, a custom whistleblowing channel, or a privacy-by-default messenger for your team, the engagement starts at a $500 escrowed audit and grows from there.

The bottom line

The May 2026 Signal phishing wave did not break Signal’s cryptography. It exploited the identity layer. A phone number is a recoverable identity by design, and any recoverable identity is phishable.

If your threat model is high (journalist, lawyer, activist, target of a state actor), stop using phone-number-tied messengers as the only line of defense. Pick one of Session, SimpleX, or Threema and use Signal only as a fallback.

If your threat model is medium (sensitive work conversations, HR, code-review of a credential, a private chat with a partner), pick the lowest-friction tool that meets the three criteria — no phone, no email, no contact sync. That is where No Trace Chat earns its spot.

If your threat model is low, Signal is still the right default for most people most of the time. Just turn on the registration lock, set a PIN, and never tap a “linked device” link from a text message unless you initiated it.

The right answer is rarely “one app.” It is two — a daily messenger and a burner. Pick from this list accordingly.

Try No Trace Chat: /no-trace-chat/ — free for 50 messages, $4.99 lifetime after that. Code-based rooms, end-to-end encrypted, delete-on-read by default.

Related reading: