SimpleX Chat

SimpleX Chat is the first major messenger architecturally without any persistent user identifier — no phone number, no email, no username, not even a random UUID that follows you across sessions. Each contact pair gets its own one-time queue identifier, and the network operator (whoever runs the relay servers you connect through) literally cannot tell which user is talking to which other user. Listed at Grade A · editor's pick because it solves a problem that Signal / Telegram / WhatsApp / Matrix all left unsolved: even with end-to-end encryption, those platforms still have a global identifier (phone, account ID, JID) that ties metadata together; SimpleX has no such anchor.

Background. SimpleX Chat is an open-source project, open since 2020, with 2 million+ app downloads as of this review. Lead by Evgeny Poberezkin; the codebase lives at github.com/simplex-chat/simplex-chat under the AGPLv3 license. Funding mix: project funded by users + Community Credits model (large communities pay for their servers, covering infrastructure + development + governance). The project has shipped two independent security audits (2022 + 2024) — published, with reports linked from simplex.chat. Available as Android, iOS, macOS, Linux, Windows, and a terminal CLI. Roadmap publicly stated through Dec 2027 with milestones in 2026 (scale to large communities) and 2027 (sustainable communities + community-grade tooling).

What you trust. The protocol architecture is the trust story, not the operator. SimpleX uses pairwise queues: every two users who connect generate a unique pair of queue identifiers, which exist only on the relay server for that connection. No queue identifier is reused. No global "this is user X" identifier exists anywhere in the system. Messages are encrypted end-to-end with double-ratchet (Signal's primitive) plus an additional layer per-relay so the relay sees only encrypted blobs. The relay server cannot correlate which queues belong to the same user — it just routes messages between anonymous queue endpoints. Self-hosting: anyone can run an SMP (SimpleX Messaging Protocol) server; users can configure their app to use only their own servers if they want maximum trust minimisation. Default servers: SimpleX team runs default relays for users who don't want to self-host; the team can't see content (E2EE) or metadata-correlations (per-queue architecture) but they do see traffic volume + IP of connecting clients. Tor support: the app can be configured to route through Tor, removing the IP-correlation surface.

Operational specs. Platforms: Android, iOS, macOS, Linux, Windows + terminal CLI. Features: end-to-end-encrypted direct messages, group chats (up to ~hundreds of members), encrypted file transfer via XFTP protocol, voice + video calls (WebRTC-based, E2E-encrypted), disappearing messages, incognito profiles (auto-generated identity per contact for users who want extra isolation), chat profiles (multiple personas per app install). Bot framework available for developers via the SimpleX TypeScript SDK + chat-bot example. Open source under AGPLv3. Reproducible builds documented at simplex.chat/verify-builds. Translated UI: en, العربية, Čeština, Deutsch, Español, Français, Magyar, Indonesia, Italiano, 日本語, Polski, Português, Русский. Roadmap publicly available; Community Credits model for community-funded server infrastructure rolling out 2027.

Philosophy. SimpleX's editorial differentiator is identifier-free messaging as an architectural choice rather than a privacy feature added on top of an identifier-based system. Signal hides messages with E2EE but Signal still has a phone number that ties all your activity together. Telegram offers usernames as an alternative to phone numbers but still gives you one global username. Matrix gives you a JID (`@user:server.org`) that's stable across the federation. SimpleX rejects this entire pattern — by giving every contact pair its own queue identifier, the metadata-correlation problem is solved at the protocol level rather than mitigated at the policy level. The trade-off: no global "find me by username" feature; connections are made via pasting an invitation link or scanning a QR code, then the connection is mutual but the queue is unique. This is friction for casual users; for users who care about metadata privacy, the friction is the point.

Grade rationale. Grade A and editor's pick reflect: architecturally unique no-identifier design (genuinely novel in the messenger space); open-source AGPLv3 codebase; two independent security audits published (2022 + 2024); 2 million+ app downloads with no major security incidents or governance crises; multi-platform coverage including Linux + terminal CLI; self-hosting supported with documented server-deployment guides for SMP and XFTP relays; Tor support; reproducible builds; 13-locale UI translation; public roadmap with clear funding model. Last verified 2026-05-12.

Useful when. You need a messenger and your threat model includes metadata correlation (who you talk to, how often, when). You're a journalist, activist, lawyer, security researcher, or anyone whose contact graph being observable would be a problem. You want a messenger that works for casual use and high-threat use without switching apps. You want voice/video calls without giving up the privacy property (most "private" messengers fall back to standard WebRTC for calls — SimpleX wraps the WebRTC layer). You want to use multiple chat personas without juggling multiple apps (incognito profiles + chat profiles handle this in-app). You want a self-hostable messaging infrastructure for your team / community / family without trusting a third-party operator.

Caveats. No "search by username" — by design — connections require invitation-link sharing (paste a URL or scan a QR code). For casual contact-discovery users, this is friction. Default relay servers see IP + traffic-volume unless you route through Tor or self-host. Self-hosting is real operational work — running your own SMP + XFTP servers is documented but non-trivial; most users use the team's default servers. Group size limit ~hundreds — SimpleX is great for personal + small-community use but not yet at the scale of Telegram groups (10k+). Active development means changing surfaces — version-to-version, the app gains features and occasionally restructures UX; users coming back after 6 months may find things have moved. Onboarding friction — for non-technical users, "scan a QR code to add a contact" is harder than "search @username", and the no-identifier design genuinely loses casual users who can't justify the privacy benefit. Funding model still maturing — Community Credits launches 2027; until then the project depends on user donations + grant funding, which is more fragile than a self-sustaining revenue model. Network effect — most of your contacts probably aren't on SimpleX yet; you'll need to onboard at least one other person to make it useful, which is the universal new-messenger challenge.