Signal and Molly review — the standard for encrypted calls and messages
Who is this for? Anyone who wants to replace WhatsApp with something that takes privacy seriously. Molly is for Android users who want to go one step further than standard Signal.
Signal and Molly review
Who is this for? Anyone who wants to replace WhatsApp with something that takes privacy seriously. Molly is for Android users who want to go one step further than standard Signal.
Signal is the messenger recommended worldwide by security researchers, journalists and privacy communities. Not because of marketing, but because of its design. Molly is a hardened fork of Signal for Android users who want to go one step further.
What makes Signal different from WhatsApp?
Both apps use end-to-end encryption. The difference is not in the message content but in everything around it.
Metadata: WhatsApp is owned by Meta. Message content is encrypted, but Meta collects who you message, when, how often, and links this to your advertising profile. Signal deliberately collects minimal metadata — the protocol is built so that even Signal itself cannot see who communicates with whom.
Sealed Sender: Signal uses a technique where its own servers don’t need to know who sent a message in order to deliver it — while the recipient can still cryptographically verify who actually sent it. The sender identity is encrypted before transmission and only revealed to the recipient, not to Signal’s infrastructure in between.
Open-source: Signal’s protocol and apps are fully open-source and independently audited. WhatsApp is closed-source — verification is not possible.
No advertising model: Signal is a non-profit. No ads, no data sales, no investors expecting returns on your usage data.
Specifications
| Property | Signal | |
|---|---|---|
| Encryption | Signal Protocol (E2E) | Signal Protocol (E2E) |
| Metadata collection | Minimal | Extensive (Meta) |
| Open-source | Fully | No |
| Owner | Signal Foundation (non-profit) | Meta |
| Phone number required | Yes | Yes |
| Disappearing messages | Yes | Limited |
| Notes to self | Yes | Yes |
| Groups | Up to 1000 | Up to 1024 |
| Desktop | Yes (Windows, Mac, Linux) | Yes |
| Price | Free | Free |
Signal in practice
Disappearing messages: Set a timer per conversation — messages automatically disappear after 1 hour, 1 day, 1 week or longer. Off by default, but recommended for sensitive conversations.
Note to self: Signal has a “Notes” conversation with yourself. Useful as an encrypted clipboard between devices.
Payments (MobileCoin): Signal has a built-in payment feature via MobileCoin. Not widely usable and not the app’s main purpose, but it exists if you want it.
Phone number as identity: Signal requires a phone number for registration. You can use a separate number as long as it can receive SMS or a verification call. Since usernames and phone-number privacy shipped, Signal no longer shows your number by default in your profile to people who haven’t already saved it. People who already have your number, or share a group with you, can still see it.
Molly — the hardened Android fork
Molly is an independently maintained fork of Signal for Android. Same messages, same protocol, but with extra security options Signal doesn’t provide.
What Molly adds:
- Passphrase encryption: Molly brings back local database passphrase protection (a feature standard Signal removed when it switched to Android’s file-based encryption).
- RAM shredding + auto-lock: Molly wipes sensitive data from memory and can lock itself automatically under conditions you set.
- Push without Google: Molly supports WebSocket and UnifiedPush for notifications. The regular Molly build can also use FCM (Google); Molly-FOSS runs without those proprietary Google components entirely.
- SOCKS5 proxy and Tor: Route traffic through a proxy or Orbot directly, without a separate VPN app.
- Additional hardening: Molly also adds options like unknown-contact blocking and more extensive backup management.
Molly vs Molly-FOSS: There are two versions. Molly contains the same proprietary Google components as standard Signal and can use FCM, but also supports WebSocket and UnifiedPush. Molly-FOSS strips those proprietary components and uses WebSocket or UnifiedPush only. For GrapheneOS or other Google-free setups, Molly-FOSS is usually the logical choice.
Availability: Molly is not in the Play Store. Install via Molly’s own F-Droid repository, via Accrescent (for Molly-FOSS), or directly as an APK from GitHub:
- F-Droid — add the Molly repo for automatic updates
- Accrescent — Molly-FOSS via a privacy-focused app store
- GitHub APK — direct download
Who uses what?
Signal (default): For everyone who wants to replace WhatsApp and doesn’t want to go deeper. Install, invite contacts, done.
Molly: For GrapheneOS users, people with a higher profile, or anyone who doesn’t want Google services in the Signal stack.
Caveats
Phone number required: For maximum anonymity, a phone number not linked to your identity is needed. That’s an extra step outside the app.
Contacts must also use Signal: End-to-end encryption only works if both parties use Signal. Group migration from WhatsApp takes time.
Molly follows upstream Signal with a small delay: The project says it normally merges the latest Signal features and fixes about every two weeks, with faster rollout for security patches. Expect a small delay compared with the official Signal app.
Pros and cons
Pros
- Sealed Sender encrypts the sender identity before transmission — even Signal’s servers cannot see who is messaging whom
- Fully open-source and independently audited; non-profit ownership with no advertising model
- Molly-FOSS has no Google dependencies — works on GrapheneOS without Google Play via websocket polling
- Molly adds passphrase encryption and RAM shredding — sensitive data is actively wiped from memory, not just left encrypted at rest
- Disappearing messages with configurable timers per conversation
Cons
- Phone number required for registration — anonymity requires a prepaid or VoIP number not linked to your identity
- End-to-end encryption only works if both parties use Signal — group migration from WhatsApp takes time
- Molly follows upstream Signal with a small, deliberate delay
Conclusion
Signal is the best WhatsApp replacement for most people — free, open-source, minimal metadata. Molly is the choice if you’re on GrapheneOS or want to eliminate Google dependencies.
Both are free. There is no reason to keep using WhatsApp if you are serious about privacy.
Getting started
1. Install Signal
Download Signal from the official source: signal.org/download/ for desktop, the Play Store or App Store for mobile. Register with a phone number.
2. First settings
Turn on disappearing messages for new conversations via Settings → Privacy → Default timer for new chats. Choose a timer that fits how you communicate. Also set a PIN via Settings → Account → Signal PIN to protect your profile when switching devices.
3. Invite contacts
Signal automatically shows which of your contacts already use it. Invite the people you message most often. One active group is enough to make Signal feel useful — you don’t need to convince everyone at once.
4. Molly instead of Signal (optional)
Choose Molly if you are on GrapheneOS or want to avoid Google services. Add the Molly F-Droid repository at molly.im/fdroid/. Choose Molly-FOSS for a fully Google-free install. You can sign into the same Signal account you already have.
Next step
Choose this if…
Signal is the default choice for anyone replacing WhatsApp. Choose Molly only if you have a real reason for additional local protection or a Google-free Android stack.
- WhatsApp privacy explained — what WhatsApp actually collects and why switching makes sense
- Recommended privacy apps — Signal in the context of your broader app setup
Already have this?
If you already use Signal or Molly, set up disappearing messages and PIN protection before thinking about heavier options.
- Setting up Signal — which settings still make a difference
- GrapheneOS first setup — running Molly on a Google-free Android setup
Want to go further?
Signal is the endpoint for most people. If communication security is a more serious concern, look at your broader situation.
- Profile: stalking or domestic abuse — communicating safely when you are being monitored
- XMPP guide — a decentralised option with no fixed provider