No marketing — just what each service asks of you, what its servers can see, and what survives after you hit send. Sources: each project’s public documentation.
| xox | Signal | Telegram | Threema | Session | ||
|---|---|---|---|---|---|---|
| No account needed | ✓ | ✗ | ✗ | ✗ | ◐ | ◐ |
| No phone number / email | ✓ | ✗ | ◐ | ✗ | ✓ | ✓ |
| Works in the browser, nothing to install | ✓ | ◐ | ✗ | ◐ | ◐ | ✗ |
| End-to-end encrypted by default | ✓ | ✓ | ✓ | ✗ | ✓ | ✓ |
| Post-quantum encryption right in the browser | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Server never stores your messages | ✓ | ◐ | ◐ | ✗ | ◐ | ◐ |
| Ephemeral by design (nothing left behind) | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Anonymous by design | ✓ | ✗ | ✗ | ✗ | ◐ | ✓ |
| Disappearing messages | ✓ | ✓ | ✓ | ◐ | ◐ | ✓ |
| PIN lock & contact verification | ✓ | ◐ | ✓ | ◐ | ✓ | ◐ |
| Duress unlock (decoy PIN) | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Disguised app mode (camouflage) | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Voice masking on calls | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
Most messengers encrypt in transit, then keep encrypted copies, backups or metadata. xox’s server deletes each encrypted envelope the moment it’s delivered — your history lives only on your devices, and with disappearing messages, not even there.
No identity, no history, no traces. You open a tab and you exist; you close it and you never did. Everything is encrypted on your device with a post-quantum layer, the server forgets every envelope the instant it delivers it, and every conversation can destroy itself. Privacy is not a setting here — it is the architecture.
Comparison based on public documentation of each service (August 2026). Features change; if you spot an error, tell us and we’ll fix it. All trademarks belong to their owners.