Session
An onion-routed messenger that never asks for your phone number or your email.
TL;DR verdict
Where Signal takes metadata seriously and still needs a SIM, Session throws the SIM away and routes everything through Lokinet. The privacy story is stronger; the network effect is much weaker, and you feel it every time you try to invite someone.
What we like
- No phone number, no metadata gathered at registration
- Messages routed through Lokinet, an onion-style overlay network
- Recovery phrase is the account, so no server-side identity to subpoena
- Open-source clients with reproducible builds on desktop
Where it falls short
- Small user base, so nobody you want to talk to is already on it
- Message delivery is slower and less reliable than Signal on flaky networks
- Voice and video calling exist but are noticeably rougher than the competition
- Session IDs are 66 characters long and awkward to share verbally
TL;DR verdict
Session is the messenger for people who found Signal's phone number too much of a leash. Registration hands you a long ID and a recovery phrase, messages route through Lokinet instead of a central server, and no email, name or SIM ever enters the picture. Speed and network effect are the price.
What it does well
The identity model is the entire point. A Session account is a keypair. There is no phone number to hand over, no email to correlate, and no server-side account record to subpoena. If your threat model includes "the vendor is compelled to produce whatever they have on me", Session is one of the few messengers where the honest answer is that there is very little to produce.
Lokinet, the overlay network Session rides on, is the other half of the pitch. Messages hop through several service nodes on the way to their destination, so no single node sees the sender and recipient at once. This is closer to how Tor thinks about metadata than how Signal does, and it holds up against the class of adversary that can watch a data centre but not the whole internet.
Clients are open source and available on all the platforms you would expect. The desktop app is Electron but does not feel abandoned, and iOS and Android builds get regular releases.
Where it strains
The network is small. That is the single largest problem with the product, and no amount of protocol elegance fixes it. If the person you want to talk to has not installed Session, and there is no reason for them to have installed Session, then you are back to negotiating a channel. In practice this makes Session a secondary messenger for most people rather than a primary one.
Delivery over Lokinet is slower than delivery over Signal's servers. Text messages usually feel fine. Attachments, especially larger ones, sometimes need a second attempt. Voice and video calls work but they are visibly newer than the competition and behave that way on marginal connections.
Session IDs are 66 characters. There is no username layer sitting on top of them yet, and reading one aloud to a source in a hurry is not fun.
Who it's for
Anyone whose threat model makes a phone number a liability rather than a convenience — investigative journalists, activists in jurisdictions where SIM registration is tied to identity, and people who want a channel that does not sit on Meta or a US foundation's servers. Not the messenger to move a whole friend group to. The messenger to keep alongside Signal for the conversations that need it.
Frequently asked
What is Lokinet and why does Session use it?
Lokinet is an onion-routing network similar in spirit to Tor, run by a set of incentivised service nodes. Session bounces your messages through several of these nodes so that no single point in the network sees both who sent a message and who received it. That is the core reason Session can skip phone numbers — there is no central server holding an identity map.
Is Session as secure as Signal?
For message content, the encryption is comparable. Session removed forward secrecy in an earlier redesign to make asynchronous messaging over an onion network practical, then added a limited form of it back. Signal's cryptographic story is still tighter. Session's advantage is what it does not collect, not what it encrypts.
What happens if I lose my recovery phrase?
The account is gone. There is no email reset, because there was no email. Write the phrase down, put it somewhere you would put a passport, and treat it like one.