Open Free and open source — read the code

How this compares

Four messengers, side by side. A few things on this table only Flamenet Messenger does: it runs on a server you control, it never asks for your phone number, and your address is yours rather than the server's — so a relay shutting down costs you a mailbox, not your name. The rest is laid out plainly and sourced from each project's own documentation, so you can check every line of it.

  Flamenet Signal Telegram Apple Messages
Nobody in between can read it Yes
Every conversation. There is no plain mode to switch to — the server has no route that accepts a readable message.
Yes No
Only in Secret Chats, which are one-to-one and have to be started deliberately.
Yes
Between Apple devices, and with Android since iOS 26.5 — but only for the newer kind of text message, not the old kind.
Works without a phone number Yes
A username and an email address.
No
A number is required to register. Usernames hide it from other people, but not from Signal.
No Partly
An Apple ID, reachable by phone number or email.
You can run the server yourself Yes
Two containers and a config file.
No No No
Message someone on a different server Android now
Like email: your friend doesn’t have to be on the same server as you, and each server picks who it will exchange messages with. Out now on Android, on iPhone once Apple approves — and you both need it, since it takes two sides to cross.
No
Deliberately. Letting servers talk to each other means more companies learn who is talking to whom, which Signal has chosen not to do.
No No
You keep your name if you move servers Android now
Your address comes from your passphrase, not from a number a server handed you. Sign in somewhere else with the same passphrase and you are still the same person to everyone who knows you. Out now on Android, on iPhone once Apple approves.
No
Your account lives on Signal's servers.
No No
Messages can wait for you in more than one place Android now
Keep a mailbox on two servers, and losing one costs you neither your messages nor your address. Add the second before you need it. Out now on Android, on iPhone once Apple approves.
No No No
Anyone can read the code Apps and server
All of it, under the MIT licence: both apps, the server, and the shared code that does the encrypting. Four repositories, nothing held back.
Apps and server
Under licences that require anyone who changes it and runs it for others to publish their changes.
Apps only
The server side is closed.
No
Safe from the computers that are coming — when a conversation starts Android now
Stops someone recording your messages today and reading them years from now, once the computers to do it exist. Out now on Android, on iPhone once Apple approves — and it counts only once you both have it.
Yes
Yes, at the start of a conversation.
No Yes
Yes. Apple has done this longest.
— and every message after that Android now
The row above protects the start of a conversation; this carries the same protection through every message, with fresh maths each time rather than once at the beginning. Out now on Android, on iPhone once Apple approves — and like everything here it counts only once you both have it, so today that means two Android phones.
Yes
Signal added this in October 2025 and is rolling it out gradually. It works alongside what they already had rather than replacing it.
No Yes
Yes. Apple has done this longest.
Your app checks your contact is really them Android now
Your app checks, by itself and with nothing to switch on, that your contact’s key really is theirs. A server that goes quiet about a key it already vouched for is treated as caught rather than as having a bad day. Out now on Android, on iPhone once Apple approves.
Yes No Yes
Contact Key Verification, opt-in.
Checked by outsiders Planned
The scope for one is written and public, and donations pay for it. Until then the code is open and heavily tested.
Yes Partly
Its protocol has been examined externally, with mixed findings.
Yes
Apple’s design was examined by academics outside the company.
You can install it today Android yes
Android is out and you can install it from this site today. The iPhone app is built and being prepared for the App Store — this row changes the day it opens, and not before.
Yes Yes Yes
People already using it Early days
It is new, and the people who arrive now are the ones who shape what it becomes.
Many millions Hundreds of millions Built into every iPhone
What pays for it Donations Donations and grants, to a non-profit Ads and subscriptions Selling the hardware it runs on

One design difference worth naming: sent, never hosted

On every mainstream platform, a story or a profile photo is hosted: the server holds one copy and decides, per viewer, who is shown it. Your audience setting is a promise the operator enforces — and could stop enforcing, or be compelled to.

Here a story is sent. When you post one, your device encrypts it separately to each person in the audience you chose and delivers it like any other message. Someone outside the audience is not "denied access" — there is nothing to deny them access to. No copy exists on the server that a policy, a bug, or a subpoena could ever widen the audience of. The per-story audience picker in the composer is that property made visible: the choice happens on your device, before anything leaves it, and it is enforced by who receives the bytes rather than by who is shown them. The honest cost is the same one it always is: an audience decided at send time cannot be widened later without sending again.

Reading the table fairly

Rows are easy to count and harder to weigh. Apple's key transparency has run for years across a billion devices; ours is new, and scale is a security property of its own. Worth saying plainly, because we would rather you trust the table than the tone of it.

All four are serious pieces of engineering, and on post-quantum we are not ahead of anyone: Apple and Signal both carry it through the ongoing conversation, and Signal has been doing so since October 2025. This page scored that row wrong — against Signal, in our own favour — until 2026-09-04, which is exactly the kind of mistake the note below asks you to report. But every other messenger on this table has one thing in common: somebody else runs the server, and you are trusting them to. Flamenet Messenger is built so that you do not have to — the whole thing runs on a machine you control, under a licence that lets you keep it that way, with no phone number attached to any of it. That is the trade this project exists to remove, and nothing else here offers it.

Where these facts come from

Everything above is drawn from each project's own published documentation and from public security research, checked in August 2026. These are given as references rather than links, because this site deliberately doesn't send you anywhere else:

  • Signal — Signal Support, "Phone Number Privacy and Usernames"; Signal blog, "Keep your phone number private with Signal usernames"; the PQXDH specification.
  • Telegram — Telegram Core API, "End-to-End Encryption, Secret Chats", which documents that cloud chats are client–server encrypted and that Secret Chats are opt-in and one-to-one.
  • Apple — Apple Security Research, "iMessage with PQ3"; Apple Support, "iCloud data security overview"; the iOS 26.5 release notes covering encrypted RCS; Stebila, "Security analysis of the iMessage PQ3 protocol", and the USENIX Security 2025 formal analysis of PQ3.
  • Flamenet Messenger — the specification, the metadata page and the roadmap on this site.

If you find a row here that is out of date or unfair to one of the others, that is a bug and we would like to hear about it — see community. Signal is a trademark of Signal Messenger, LLC; Telegram is a trademark of Telegram Messenger Inc.; Apple and iMessage are trademarks of Apple Inc. This project is not affiliated with, endorsed by, or connected to any of them.

The real names, if you want to go and check

Nothing in the table above uses these, on purpose: a heading you have to look up first has asked you to do our work. They are here because a reader who wants to verify a row needs the actual term to search for, and leaving them out entirely would be its own kind of unhelpful.

  • Safe from the computers that are coming — the field calls this post-quantum cryptography. At the start of a conversation Signal calls theirs PQXDH, Apple’s is part of PQ3, and ours is a hybrid of X25519 and ML-KEM-768.
  • And every message after that — the repeating part of a conversation’s encryption is called a ratchet. Signal’s post-quantum one is the Sparse Post-Quantum Ratchet, announced October 2025; ours is protocol v3.
  • Your app checks your contact is really themkey transparency, built on an append-only Merkle log.
  • Anyone can read the code — ours is MIT; Signal’s apps and server are AGPL and GPL.
  • Message someone on a different serverfederation.
  • Between Apple devices, and with Android — the newer kind of text message is RCS; the old kind is SMS.