The Game of Phones: WhatsApp vs. Telegram vs. Encryption

** Updated for 2023 **

In this article, ExpressVPN focuses on WhatsApp and Telegram. If you want to see how the other chat apps compare, click here for the best of the rest.

WhatsApp now has a user base of over one billion, but Telegram is quickly catching up. In February 2016, Telegram claimed that over 350,000 users were signing up every day, in addition to the existing 100 million daily active users.

Telegram has faced much criticism for not being fully encrypted by default. But it was the first mass-market messaging app to offer encryption, and as such it was often called “the encrypted chat app” in the media. That’s a moniker that seems to have stuck, and it may have even helped it win endorsements from organizations like ISIS, the notorious terrorist group.

WhatsApp announced it would move to full end-to-end encrypted chats in September 2014, but it only implemented the feature in April 2016. Since then, its PR people have gone to great lengths to claim the title of the encrypted chat app.

The beginnings of Telegram

Behind Telegram are the brothers Nikolai and Pavel Durov, exiled Russian-born billionaires previously known for the Facebook clone Vkontakte (now VK). Pavel Durov had to leave VKontakte in 2014 over a dispute about handing over the user data of Ukrainian protesters. The brothers subsequently left Russia for Berlin, where they founded Telegram.

The beginnings of WhatsApp

Brian Acton and Jan Koum founded WhatsApp in 2009 to post quick status updates similar to those on Facebook. But the messaging feature added in Version 2 multiplied the user count and made the app a huge success.

In February 2014, Facebook bought WhatsApp for $19 billion, and now Facebook wants to integrate it into its vision for internet.org (disclaimer: ExpressVPN supports OpenMedia, an organization critical of internet.org).

Messengers are built on network effects — this means a messenger platform’s value lies not in how big, secure, or feature-rich the platform is, but rather in how many people can be reached with it. But these network effects are fragile, as it is very easy and cheap for a user to switch messaging services. And although users can easily have multiple messengers installed side by side, many users prefer not to. So one platform can easily not only overtake another, but render it completely useless.

As such, the “messenger wars” (which also include other giants like WeChat, Kakao, and Line) are very real. WhatsApp even goes so far as to block all links to the Telegram messenger within its platform.

Messages incoming. Will the ExpressVPN review cause shame, shame, shame?

The battle between WhatsApp and Telegram

ExpressVPN put both messengers to the test so you can be better informed when choosing your favorite.

Let’s start with the biggest category:

Which has better message encryption?

Telegram uses a self-developed protocol called MTProto. Telegram was heavily criticized for creating its own standard instead of using something else. MTProto, however, is not entirely new (it uses the AES and RSA standards), and OpenWhisper Systems (the standard WhatsApp employs) is also a new development.

ExpressVPN is not a cryptographer, but it appears the MTProto protocol has not yet been broken. What’s more, it’s open-source, like all Telegram apps, so everyone is free to try to break it. In fact, Telegram repeatedly offers large bounties (the current one is $200,000 in bitcoin) to anyone who can successfully break the standard, although Moxie Marlinspike, the creator of OpenWhisper Systems, called the bounty “rigged” on his blog.

Telegram’s encryption cipher is certainly very fast and efficient, and encrypted messages can be sent when all other apps fail due to slow internet connections. Telegram also rotates keys every week or after 100 messages to ensure perfect forward secrecy. Perfect forward secrecy guarantees that if your phone is ever hacked and the encryption keys stolen, your deleted messages cannot be decrypted.

The big difference lies not in which encryption protocols are used, but in how they are applied. WhatsApp automatically encrypts all your messages, and there is no option to send an unencrypted message. This is a huge difference compared to Telegram’s encryption, where you have to select “Secret Chat” to start a secure conversation. Many people don’t do this, either because it’s an extra step or because they don’t understand the need.

Without encryption, chats are vulnerable to interception and surveillance — even more so in Telegram, where messages are stored until you delete them. WhatsApp, on the other hand, does not store messages; it only forwards them to your device. Even group chats are encrypted in WhatsApp.

Update on the WhatsApp backdoor:

In January 2023, The Guardian reported a backdoor in WhatsApp’s design. WhatsApp designed its encryption mechanism in a way that makes key changes seamless. However, the setup allows WhatsApp’s servers, or anyone who controls them, to read your messages by asking your app to re-encrypt messages with a different key owned by the attacker. This backdoor only works for messages yet to be delivered and does not work for messages delivered in the past.

To make sure nobody is snooping on your WhatsApp messages, go to Settings -> Account -> Security and activate “Show security notifications.” This will send you a notification if your contact’s keys change, which can be a sign that third parties are using their own key to read your messages. If you receive a notification that a key has changed, stop chatting until you re-verify the intended contact’s public key.

A similar attack is theoretically possible in Telegram as well, though not in active chats. In Telegram, every chat has its own key. This is great in theory, as it allows the creation of individual secure lines among trusted devices, but in practice it doesn’t work well. Every time you start a new secret chat, you have to verify the other person’s identity again.

Verdict: Despite the recent backdoor story, this is still a win for WhatsApp

Getting started: Who has the better registration process?

For WhatsApp, you can only register through a mobile phone app, while Telegram lets you sign up anywhere, even with its web app.

But both Telegram and WhatsApp use your phone number for authentication. This is convenient at first, but it raises serious security concerns. A hacker could take over your account by diverting text messages to the hacker’s own number, or by tricking your mobile operator — or even colluding with it. The latter is especially concerning if your adversary is the local authorities.

For encrypted WhatsApp this would let the hackers impersonate you, but with Telegram someone could gain access to all your unencrypted chats and group chats.

Although WhatsApp has superior encryption, Telegram has the option to set a secondary password, which is effectively two-factor authentication. A hacker would need not only your phone number but also a password to get to your contacts.

Not giving users an option other than number registration is bad practice. Phone numbers can easily be linked to an identity via location, and many countries require you to show identification when purchasing SIM cards.

Verdict: Draw

How to make the registration process better

Both Telegram and WhatsApp should let you register for their services through other identifiers, such as usernames or email addresses. WhatsApp needs a secondary password solution, and both WhatsApp and Telegram should probably make it mandatory.

Who has the best download options?

All Telegram apps are open-source, which means you can build them yourself instead of downloading them from app stores. You can modify the apps, and researchers can comb through them to find flaws in the implementation of security features. You can also build Telegram integration for your own app, which makes it more accessible for people who don’t have access to official app stores (for example, if their country blocks them) — but it also means vulnerability to tampered or malicious versions.

Open source is pretty great, and Telegram impresses further with its wide range of supported platforms. There are the usual ones like iOS, Android, and Windows Phone, but there are also browser apps for Firefox and Chrome OS, a Pidgin plugin, desktop apps, and even a command-line interface! Unfortunately, however, the Windows and Linux apps are just packaged versions of the browser app (Webogram), which does not support end-to-end encryption.

WhatsApp also has apps for Windows and Mac, but it mainly focuses on mobile phones, where it supports older systems like Symbian or BlackBerry. WhatsApp is far more restrictive and has shut down independent implementations in the past, such as the Pidgin plugin.

Verdict: Telegram wins

Which is the least invasive?

WhatsApp requires access to your entire address book to function properly — something ExpressVPN considers highly invasive. Without this access, WhatsApp is practically useless.

In Telegram, you can start chatting without giving the app access to your contacts. Plus, you don’t need to hand out your phone number to everyone you want to talk to. Instead, you can set a username and pass that out instead. This is a pretty great, privacy-friendly feature.

Verdict: Telegram wins

How to make chat better

A messenger should not beg you to upload your entire address book just to get started, and you shouldn’t have to give out a phone number for people to connect with you.

Which offers the best group chat features?

As mentioned, group chats are encrypted in WhatsApp, and you can create groups with up to 256 members. That’s pretty incredible, although with that many people in a group, you might assume it’s no longer private.

Telegram’s group chats are unencrypted, but they have a few more features. You can even create supergroups with thousands of participants. In these supergroups, you can pin messages and create invite URLs that can be posted on your website or sent by email. You can also add Telegram’s infamous bots to your groups, which makes it easier to run polls or play games.

Verdict: WhatsApp wins — encryption is king

Which app has the best features overall?

As we already mentioned, Telegram impresses with its features. While WhatsApp also embeds some content and shows previews for sites and videos, in Telegram everything feels much slicker. You have to leave the Telegram app far less often to view content in chat, and that makes for a good user experience.

Telegram is also the more open platform. You can easily create your own bot, upload your own sticker set (ExpressVPN even found one about information security!), or even modify the client and release it with new features (as GetGems did), which lets you embed the messenger’s capability into any other app. Telegram also has channels, which let you easily share updates about yourself, like a mini blog.

WhatsApp, however, has one feature that ExpressVPN quite likes and really can’t live without: encrypted phone calls. It works pretty well, it’s free, and it beats a regular phone call in terms of convenience, security, and price.

Telegram’s huge advantage is that it’s independent of a single device. You can install Telegram on as many computers and phones as you like, and even have the web app open in separate browsers simultaneously. In WhatsApp, your main device has to be turned on and connected to the internet, even when you’re using WhatsApp Web.

Verdict: WhatsApp wins, purely for the encrypted phone calls

Other privacy and security issues

Both Telegram and WhatsApp let you control the “last seen” stamp, and both allow a compiled list of blocked users.

The fact that you can easily log into Telegram from multiple devices can turn into a security threat, although the platform mitigates this well by making your “active sessions” visible in the settings, where you can also easily deactivate anything that isn’t you.

Telegram will also automatically delete your account, along with all the information contained in it, after six months of disuse (you can set this to one month or one year), so if other people were to get your phone number after you give it up, they wouldn’t gain access to your account.

In Telegram you can additionally control who is allowed to add you to groups, which makes it harder for spammers to annoy you.

Telegram’s “secret chats” come with a few more advantages than just encryption: you get a notification when the other party takes a screenshot, and you can set a self-destruct timer anywhere between one second and one week. Upon destruction, the app deletes all messages on both devices (starting from when the other party reads the message), giving you more control over what your phone stores and what information could become vulnerable if your phone is stolen or lost.

Telegram’s secret chats also don’t send any message previews to Apple’s or Google’s servers, where they could be additionally logged. In WhatsApp (and Telegram’s unencrypted chats) this option exists, but you have to deactivate it manually. Telegram also asks whether you want to enable link previews in secret chats. Link previews are generated on Telegram’s servers and they can compromise privacy, so it’s wise to deactivate them.

Telegram’s secret chats cannot be backed up, while WhatsApp chats can. On iOS you get the option to back up your chats to iCloud, while on Android you can save them to your Google Drive. On other platforms you may have the choice to download them as a file. When you or any of your contacts activate this, your chats are only as protected as that backup. Be careful!

Verdict: Telegram wins

Results: Telegram wins! But so does WhatsApp!

Telegram wins overall! The platform impresses with open source, is easily accessible for designers (stickers) and developers (bots), and can boast a massive lineup of apps for all kinds of platforms. All the apps ExpressVPN tried integrated quickly and beautifully with the operating systems they were made for. Although you’ll be far from anonymous, ExpressVPN feels you control your identity and contacts a little more. The biggest problem is the lack of end-to-end encryption by default.

WhatsApp wins on encryption

The app for a billion people brought end-to-end encryption to the masses, and ExpressVPN believes it might be the only major platform doing encryption right. Unfortunately, WhatsApp struggles to be more than a boring pipe for messages, and some users may expect more. The fact that users are limited to one device / app feels like the biggest barrier.

Curious about other messengers? Click here for ExpressVPN’s chat app privacy ranking.

Also, don’t forget to check out the Mobile Security Guide.