Is WhatsApp Actually Safe? What Cryptographers Say About Your Private Messages

While WhatsApp dominates the global messaging market with over 3 billion users, security experts like Johns Hopkins University’s Matthew Green suggest that the platform’s ubiquity comes with significant privacy trade-offs. Recent legal challenges have accused Meta of maintaining “backdoors” to read messages, but Green argues that the real reasons to switch apps are far more grounded in technical reality than in grand conspiracies.

Debunking the “Backdoor” Theory

A recent class-action lawsuit claims Meta has been defrauding users since 2016 by secretly accessing encrypted chats. Green, however, finds this highly unlikely. Because WhatsApp uses the Signal Protocol for end-to-end encryption (E2EE), the actual encryption happens on your physical device, not on Meta’s servers.

For Meta to secretly read messages, they would have to implement a flaw in the app’s code that would be visible to any security researcher performing reverse engineering. Given the constant scrutiny from the cybersecurity community, Green suggests that maintaining such a massive lie would be “extremely stupid” and virtually impossible to hide for nearly a decade.

The Real Privacy Gap: Metadata and Backups

The true issue isn’t that Meta is reading your texts; it’s what they know around those texts. Even with E2EE, WhatsApp collects extensive metadata:

• Social Graphing: Who you talk to, how often, and for how long.

• Cloud Vulnerabilities: Unless specifically configured (like using Apple’s Advanced Data Protection), chat backups on iCloud or Google Drive often lack the same E2EE protection as the messages themselves.

• Proprietary Code: Because WhatsApp is “closed-source,” users must take Meta’s word that the app is behaving as advertised.

Why Experts Lean Toward Signal

For those who prefer verified security over corporate promises, Green points to Signal. As an open-source, non-profit platform, Signal’s entire codebase is available for public audit. Unlike WhatsApp, Signal stores almost zero metadata—it doesn’t even know who you are talking to.

While the transition is often hindered by “network effect”—Signal has roughly 40 million users compared to WhatsApp’s billions—the trade-off offers a level of transparency that a data-driven giant like Meta simply cannot provide.