"Is it encrypted?" is the wrong first question. Almost everything is encrypted somehow. Here's a better checklist.
1. Is it end-to-end encrypted by default?
Opt-in "secret chats" are easy to forget. Look for E2EE that's on for every chat, including groups and calls, without you flipping a switch.
2. Is the protocol public and reviewed?
Good crypto is boring, documented and attacked by experts in public. Prefer apps built on published protocols (like the Signal Protocol or MLS) that have had independent audits you can actually read.
3. Is the client open source?
Open source doesn't make code secure by magic, but it lets researchers check that the app does what the marketing says.
4. What metadata does it keep?
Ask: does it need my phone number? My contacts? Does the server log who I talk to? Apps differ a lot here.
5. Can I verify who I'm talking to?
Look for safety numbers / security codes you can compare in person or over another channel. That's your defence against a server quietly swapping keys.
6. What happens to backups?
Cloud backups are a classic weak spot. Check whether backups are end-to-end encrypted too, or whether they quietly upload plaintext.
7. Who runs it, and where?
Business model, jurisdiction and whether you can self-host or federate all matter for the long run.
No app scores 7/7 for everyone. The right pick depends on who you're protecting yourself from. We'll dig into specific apps in future posts. 👀