SimpleX vs Session

Choose two to four messengers. Every property comes from the same traceable catalogue; unknowns remain explicit.

Property	SimpleX	Session
Account identifier	SimpleXLocal profile; relationship-specific invitations. [1] [2]	SessionRandom ID without a phone number; onion routing for messages. [1] [2]
Phone required by service	SimpleXNot required. [1] [2]	SessionNot required. [1] [2]
E2EE	SimpleXDouble Ratchet E2EE; message padding is declared. [1] [2]	SessionProtocol V1: WOOT 2026 findings; current fixes and retests not established. [1] [2]
Metadata exposure	SimpleXNo global account; relays, queues, timing and iOS push remain exposure surfaces. [1] [2]	SessionNodes and relays see their portion of traffic; calls expose IP. [1] [2]
IP exposure to peer	SimpleXDefault TURN hides IP from the peer; P2P can reveal it. [1] [2]	SessionBeta P2P calls: IP exposed to peer and managed STUN/TURN. [1] [2]
Multi-device	SimpleXDocumented mobile–desktop pairing on the same local network; desktop beta. [1] [2]	SessionUnknown: not established for the version and configuration in question.
Main strength	SimpleXRelationship separation without a mandatory global identifier. [1] [2]	SessionPhone-free identity and onion routing for messages. [1] [2]
Main weakness	SimpleXMore multi-device friction; relays and notifications require care. [1] [2]	SessionProtocol V1 attacks and unknown fix / retest status; calls expose IP. [1] [2]
Best suited for	SimpleXPseudonymous online contacts; minimising account identifiers. [1] [2] [3] [4]	SessionCandidate for reassessment after documented fixes and retesting; not a high-assurance starting point. [1] [2] [3] [4]
Confidence and scope	SimpleXScope-limited documentary evidence; production metadata and distributed binaries not experimentally verified. [1]	SessionHigh assurance not established: distributed fixes and post-WOOT 2026 retests remain unknown. [1] [2]

Technical details: identity, keys, push, devices, audits and evidence

Property	SimpleX	Session
Email requirement	SimpleXNot required. [1] [2]	SessionUnknown: not established for the version and configuration in question.
Username / discovery	SimpleXNo mandatory global username; optional public address should be avoided for compartmentalisation. [1] [2]	SessionUnknown: not established for the version and configuration in question.
Number visible to contact	SimpleXNo required number to disclose. [1] [2]	SessionNo number required. [1] [2]
Global user ID	SimpleXNo global user ID required. [1] [2]	SessionPersistent Session ID, reusable and therefore linkable. [1] [2]
Forward secrecy	SimpleXDocumented Double Ratchet; versions and implementations still need verification. [1] [2]	SessionProtocol V1 lacks PFS according to the documentation recorded in Phase 2. [1] [2]
Post-compromise security	SimpleXPost-compromise recovery described by the protocol; requires an uncompromised endpoint. [1] [2]	SessionUnknown: not established for the version and configuration in question.
Key verification	SimpleXUnknown: not established for the version and configuration in question.	SessionUnknown: not established for the version and configuration in question.
Relay / TURN	SimpleXAlways use relay; TURN sees IP and duration. [1] [2]	SessionOnion messages and P2P calls use different paths. [1] [2]
What the provider learns	SimpleXRelays see their transport data; message bodies are E2EE. Declared non-logging was not measured here. [1] [2]	SessionVisibility depends on the node; STUN/TURN receives beta-call IP addresses. [1] [2]
What the contact learns	SimpleXThe contact receives messages and the profile you share, and can keep a copy. [1] [2]	SessionThe contact receives messages and the profile you share, and can keep a copy. [1] [2]
What the network / ISP learns	SimpleXThe network sees destinations, timing and volume; Tor or a relay changes the observer. [1] [2]	SessionThe network sees destinations, timing and volume; Tor or a relay changes the observer. [1] [2]
Push notifications	SimpleXiOS push: queue and frequency data partly visible to the service; exact payload not captured. [1] [2]	SessionUnknown: not established for the version and configuration in question.
Apple / Google exposure	SimpleXStore, installation and push can create metadata; exact profile linkage depends on the OS and was not tested here. [1] [2]	SessionStore, installation and push can create metadata; exact profile linkage depends on the OS and was not tested here. [1] [2]
Groups	SimpleXUnknown: not established for the version and configuration in question.	SessionUnknown: not established for the version and configuration in question.
Calls	SimpleXDocumented calls; their network path must be distinguished from messaging. [1] [2]	SessionBeta, opt-in, P2P; not an anonymity guarantee. [1] [2]
Backups	SimpleXLocal profiles and history; complete version-specific backup guarantees not established here. [1] [2]	SessionUnknown: not established for the version and configuration in question.
Source code and binaries	SimpleXRepositories and component-specific scopes recorded in Phase 2; no current binary rebuilt bit-for-bit here. [1] [2]	SessionRepositories and component-specific scopes recorded in Phase 2; no current binary rebuilt bit-for-bit here. [1] [2]
Audits	SimpleXTrail of Bits 2022 and 2024 protocol review; announced 2026 review had no usable public report at the research cutoff. [1] [2] [3]	SessionQuarkslab 2021 and WOOT 2026 cover different scopes / versions. [1] [2] [3]
Public law-enforcement evidence	SimpleX2025 provider claim: 12 requests with no responsive information; no independent court dossiers. [1] [2] [3]	SessionNo individual disclosure case established here; this does not prove an absence of requests or data. [1] [2]
iOS	SimpleXYes, client listed in the study. [1] [2]	SessionYes, client listed in the study. [1] [2]
Android	SimpleXYes, client listed in the study. [1]	SessionYes, client listed in the study. [1]
Windows	SimpleXBeta; desktop-specific limits. [1] [2]	SessionYes, client listed in the study. [1] [2]
macOS	SimpleXBeta; desktop-specific limits. [1] [2]	SessionYes, client listed in the study. [1] [2]
Linux	SimpleXBeta; desktop-specific limits. [1] [2]	SessionYes, client listed in the study. [1] [2]
Avoid if…	SimpleXYou cannot accommodate profile, relay and local-pairing constraints. [1] [2] [3] [4]	SessionYour scenario requires high assurance before findings are resolved. [1] [2] [3] [4]
Recommended configuration	SimpleXFresh profile, single-use invitation, no reused identity; TURN; deliberate iOS notification choice. [1] [2] [3] [4]	SessionCheck fixed version and retest; avoid P2P calls if the peer must not see your IP. [1] [2] [3] [4]
Remaining unknowns	SimpleXCurrent network behaviour, distributed binaries and forensic evidence remain incomplete; check version, OS and configuration. [1] [2]	SessionFixed versions, distribution on each platform and independent retests after WOOT 2026 are not established. [1]
Ease of use	SimpleXMore setup and friction than Signal; local pairing. [1] [2] [3] [4]	SessionCross-platform; security limitations are separate from usability. [1] [2] [3] [4]
Network anonymity	SimpleXNo general resistance to a global passive observer is demonstrated. [1] [2]	SessionNo general resistance to a global passive observer is demonstrated. [1] [2]

Customise this comparison

• Compromised / unlocked device and spyware.
• Copying, screenshots or disclosure by the contact.
• Initial Discord traces, reused alias, avatar, voice or files.
• Global correlation; relay, ISP, telecom, store and backup data depending on the path.