How to Send a Secure Text Message: SMS, iMessage, Signal

To send a secure text message, use an end-to-end encrypted app like Signal, which encrypts messages so only you and the recipient can read them, and turn on disappearing messages. Avoid plain SMS. If the text is a password or ID number that shouldn't sit in any chat history or backup, send a one-time link that self-destructs after reading instead.

What makes a text message secure?

A secure text comes down to three questions. Most apps only get the first one right.

• Is it end-to-end encrypted? Only the sender's and recipient's devices can read the message. Your carrier, the app company and anyone on the network see scrambled data.
• Where do the backups go? A message that was encrypted in transit can land in a cloud backup that isn't end-to-end encrypted. That copy is readable by the backup provider or anyone who gets into the account.
• What stays on the phone? Encryption ends at the screen. The message sits in both chat histories until someone deletes it, and anyone who unlocks either phone can scroll back to it.

Keep those three in mind as you compare apps. The third one is where most real leaks happen.

SMS vs iMessage vs WhatsApp vs Signal: which is actually secure?

Here's how the common ways to send a secure message compare.

SMS (and RCS)

Plain SMS isn't end-to-end encrypted. Your carrier handles the content, records can be handed over on request, and SIM-swap attacks can redirect your texts to someone else's phone.

RCS, the newer standard in Google Messages, can be end-to-end encrypted, but historically only when both people use Google Messages. Look for the lock icon before trusting it.

iMessage

Blue bubbles between Apple devices are end-to-end encrypted. Green bubbles mean the message fell back to SMS or RCS, which happens when the other person uses Android or iMessage isn't available.

The weak spot is iCloud. Unless you turn on Advanced Data Protection, your iCloud Backup holds the key needed to read Messages in iCloud, so Apple could access them. Your iPhone also keeps messages forever unless you change the Keep Messages setting.

WhatsApp

Every chat is end-to-end encrypted by default. Chat backups to Google Drive or iCloud are not, unless you switch on end-to-end encrypted backup in the chat backup settings. If the other person hasn't, your message sits in their unencrypted backup anyway.

Disappearing messages can be set to 24 hours, 7 days or 90 days. View once works for photos, videos and voice messages, not typed text. We go deeper in how to send a password on WhatsApp without it staying forever.

Signal

Signal encrypts everything end to end by default, collects very little metadata and keeps your messages out of iCloud and Google Drive backups. Disappearing messages can be set per chat. CISA's mobile communications best practices recommends end-to-end encrypted messaging apps like it.

The catch: the other person has to install it, and a message is still only as safe as the phone it lands on.

How to send a secure text message, step by step

Match the method to what you're sending. For an ongoing private conversation, use Signal. For a single sensitive item like a password, PIN or account number, use a one-time link so nothing readable stays in the thread.

For conversations: Signal with disappearing messages

1. Both of you install Signal and register with your phone numbers.
2. Open the chat, tap the contact's name and set Disappearing messages to a short timer, such as one day.
3. Optionally verify the safety number in person or on a call, so you know you're talking to the right device.
4. In Signal's notification settings, hide message content on the lock screen, and ask the other person to do the same.
5. Send your message.

For one sensitive item: a one-time link

1. Open SecureNotes and paste the text into a new note. No account is needed, and notes can be up to 10,000 characters.
2. Choose when it self-destructs. One view is the tightest setting for a secret meant for one person. Add a time limit as well, such as 1 hour or 24 hours, so an unopened link doesn't sit around.
3. Optionally add a passcode the recipient must enter to open the note.
4. Copy the link and text it through any app, even plain SMS. Only the link sits in the chat, not the secret.
5. Send the passcode another way: say it on a call or send it in a different app.
6. Optionally turn on the read notification. If the recipient says the link was dead before they opened it, someone else got there first, so change the secret.

You can create a self-destructing note in under a minute, and the recipient doesn't need an account or app to read it.

When should a secret stay out of chat history entirely?

Encryption protects a message on its way. It does nothing once the message has been sitting in a thread for months. That matters for anything that still works later:

• Passwords, PINs and recovery codes
• Door, gate, alarm and lockbox codes
• Social Security, passport and account numbers
• API keys and business Wi-Fi passwords

Phones get lost, sold without being wiped, borrowed by kids and synced to laptops. Chats get exported, backed up and screenshotted. Our post on what goes wrong when secrets sit in chat history forever shows how old messages resurface.

A one-time link changes what stays behind. The thread holds a link that stops working after it's read or expires. In SecureNotes data, 70% of notes are set to self-destruct after a single view, but only 18% have a passcode. A passcode is worth adding for anything that would cause real damage if the link were intercepted.

Worked example: texting an alarm code to a house sitter

Jordan is away for a week and her neighbor Luis is feeding the cat. Jordan has an iPhone and Luis has an Android phone, so their texts are green bubbles that may not be end-to-end encrypted. She needs to send him the alarm code and the garage keypad code.

Instead of typing the codes into the thread, she creates a note with these settings:

• Content: Alarm: 4471, then press OFF. Garage keypad: 2290. Spare key is under the blue planter.
• Destroy after: 1 view or 24 hours, whichever comes first. Luis only needs to read it once, and she doesn't want an unopened link lingering.
• Passcode: on, set to a word she'll tell Luis on a quick phone call.
• Read notification: on, so she knows when he's opened it.

She texts the link with a short line: House codes, the link works once. Calling you with the passcode now. Luis taps it, enters the passcode and reads the codes.

Jordan gets an email saying the note was read. If anyone opens that link later, from Luis's phone or a backup of the thread, it no longer works.

When she gets home, she changes the alarm code anyway. A one-time link limits where a secret is stored. It can't make the person you trusted forget it.

Common mistakes that undo a secure text

• Missing the green bubble. iMessage falls back to SMS when it can't deliver. Check the color before sending anything sensitive.
• Forgetting the other person's backups. Your encrypted backup setting doesn't control theirs. Assume the message ends up in their cloud.
• Lock screen previews. A code shown in a notification can be read by anyone near the phone without unlocking it.
• Linked devices. Signal, WhatsApp and iMessage can mirror chats to desktops and tablets, including a shared family iPad or a work laptop.
• Trusting disappearing messages too much. A timer doesn't stop screenshots, copy and paste or someone reading over a shoulder.
• Sending the passcode in the same thread as the link. Anyone who sees one sees both. Here's how to send a note's passcode safely.
• Loose link settings. A link that allows 10 views over 30 days behaves much like a normal message. Use the tightest setting that still works.
• Not changing the secret afterward. When the stakes are high, such as a shared account after someone leaves a job, rotate it.

When texting isn't the right tool

Sometimes the safest option isn't a text at all.

• Credentials you share long term with a partner or team belong in a password manager with sharing, not a chat or a link that self-destructs.
• Card payments should go through the vendor's own payment link or a phone call to a number you looked up yourself.
• Bank details for a transfer should be confirmed by phone, because fraudsters impersonate people over text. Encryption doesn't help if you're talking to the wrong person.
• Anything you need to prove later, like an agreement, needs a lasting record. A self-destructing note is designed not to leave one.

For the in-between case, one secret sent once to one person, a one-time link fits well. The SecureNotes FAQ covers how view limits, time limits and passcodes work.