XMPP vs Matrix vs Signal vs WhatsApp for private chat

This page compares four ways to message people: WhatsApp, Signal, Matrix and XMPP. It looks at who runs the servers, what those servers can see, and how much work self-hosting takes, so you can decide whether a federated, self-hosted messenger is worth it for you.

What you are choosing between

All four encrypt messages. They differ in who runs the servers and whether those servers can talk to other servers.

Centralised: one company runs every server, and you can only message people on that company's service. WhatsApp and Signal work this way.
Federated: anyone can run a server, and servers exchange messages with each other, as email providers do. Matrix and XMPP work this way, so you can run a server at home and still talk to people on other servers.

Encryption protects what you write. The operator of a server can still see some metadata: who has an account, who talks to whom, when, and from which IP address. The choice between these messengers is mostly a choice about who holds that metadata and how much of it they keep.

WhatsApp, Signal, Matrix and XMPP compared

	WhatsApp	Signal	Matrix	XMPP
Who runs the servers	Meta	Signal	Anyone	Anyone
Federation	No; opt-in chats with a few third-party apps in Europe only	No, by design	Yes	Yes
Self-host and stay connected	No	No; the server code is published, but it doesn't connect to Signal's network	Yes	Yes
Your address	Phone number	Phone number, with an optional username to share instead	`@name:server`	`name@server`
End-to-end encryption	On for all chats and calls (Signal Protocol)	On for all chats and calls	On by default in Element for new private chats	OMEMO; depends on the client
What the operator keeps	Usage, device and connection data, shared with other Meta companies	Says it can only produce account creation date and last connection date	Every server in a room keeps a copy of that room's history	Your server stores your contact list and sees when you message whom

WhatsApp encrypts messages and calls end to end with the Signal Protocol, according to its security whitepaper. Meta can't read your messages. What WhatsApp does collect is described in its privacy policy: information about your activity in the app, device and connection details including your IP address, and an estimate of your location. The policy says WhatsApp shares information with the other Meta companies.

WhatsApp is not federated. Under the EU's Digital Markets Act, Meta announced in November 2025 that WhatsApp users in Europe can turn on chats with third-party apps, starting with BirdyChat and Haiket. It is opt-in for both sides, works only on phones, and only in Europe. You can't connect your own server to WhatsApp.

WhatsApp's strength is that your contacts are already on it. That is also the reason it is hard to leave.

Signal

Signal encrypts all messages and calls end to end and is designed to keep as little data as possible. Its page on legal requests lists the subpoenas it has received. For each one, it says the only data it could hand over was the date an account was created and the date it last connected. The most recent entry is dated 3 November 2026.

Signal is not federated, and that is a deliberate choice. In a 2016 post, Signal's founder argued that federated protocols are hard to change once deployed, so a centralised service can improve faster. The server source code is published under the AGPL, but running it gives you a separate network that can't message Signal users.

You still need a phone number to sign up. Since February 2024 you can share a username instead of your number.

If your main concern is keeping metadata away from the operator, and you don't need to run anything yourself, Signal is the strongest of the four. It does mean trusting one organisation and one service.

Matrix

Matrix is a federated protocol for chat rooms. You can run your own homeserver; Synapse is the reference server, and its latest release was 1.164.2 on 2 November 2026. Element is the best-known client. Since May 2020 it turns on end-to-end encryption by default for new conversations that aren't public.

Matrix federates by replicating rooms. When a room has members on several servers, each of those servers keeps its own copy of the room's history and receives every new message. If the room is encrypted, the copies are encrypted, but every participating server still holds them. When you join a large public room from your home server, your server stores that room's history too, which costs disk space.

XMPP

XMPP is a federated chat protocol, standardised by the IETF; the current core specification is RFC 6120 from 2011. Its servers, such as Prosody and ejabberd, deliver messages and keep only what you configure them to keep. Your server stores your contact list, which RFC 6121 calls the roster, so the server knows who your contacts are.

End-to-end encryption in XMPP is OMEMO. The Conversations README notes that only some clients implement it. The client guide lists current clients that do. The OMEMO specification says it does not protect against metadata and traffic analysis. Federation also means that the server of each contact you message sees that the message came from your address.

XMPP's strength for a home server is that you control the server that holds your metadata, and you can still reach anyone on any other XMPP server. Its weakness is that the experience depends on picking good clients and enabling the right server features. The XMPP glossary explains those features.

What self-hosting chat actually involves

Running your own XMPP or Matrix server moves your metadata from a company to you. It also moves the work and the risk to you.

Your server holds the metadata. You see your users' contact lists and connection times. If friends or family use your server, you are now the operator they trust.
Uptime is your job. Messages from other servers can't be delivered while your server is down. A home connection, a power cut or a failed SD card takes your chat offline.
Phones still need Google or Apple for push. On iPhone, and in the Google Play build of Conversations, a sleeping app is woken through the platform's push service via an app server run by the client's developers. In Conversations the push carries no message content. The F-Droid build of Conversations keeps its own connection open instead.
Security updates and certificates. The server faces the internet, so you need to install updates and keep a valid TLS certificate for your domain.
Calls need a TURN server. Reliable audio and video calls between devices behind home routers or mobile networks need a relay. The audio and video calls guide covers it.

If you are prepared for that, the Prosody guide sets up a home XMPP server with the features phones need.

When self-hosting chat isn't worth it

Your contacts won't install anything new. A server only you use doesn't protect anyone's conversations. If the people you talk to will only use WhatsApp or Signal, ask them to use Signal.
You need it to work during an emergency. A home server on one internet line and no backup power is not a good choice for messages that must arrive.
You can't keep up with updates. An unpatched server on the internet is a liability. A trustworthy hosted provider is better than a neglected home server.
Your goal is hiding metadata from everyone. Federation spreads some metadata to the other servers you talk to, as described above. Running your own server gives control, not invisibility.

A middle path

You can get most of the benefit of XMPP without running a server. Use a public XMPP provider, or point your own domain at a hosted XMPP service. The Conversations README notes that an address on your own domain lets you move between providers without changing it. You can bring the server home later and keep the same address.

Moving people over

The hard part of leaving WhatsApp is not the software. It is getting the people you talk to to come with you. A few things make it easier:

Start with one group that wants to move, such as family or a club, instead of every contact at once.
Set up their accounts and apps with them. On your own server, create the accounts yourself and give each person their address and password.
Pick one client per platform for everyone, so you can answer questions. The client guide recommends one for each.
Keep the old app installed for the people who don't move.

Frequently asked questions

Is XMPP more private than Signal?

Not by default. Signal says it can only produce an account's creation date and last connection date. An XMPP server stores your contact list and sees when you message whom, so XMPP is only as private as the server you trust, which can be your own.

Is XMPP better than Matrix for self-hosting?

They make different trade-offs. In Matrix, every server in a room keeps a copy of that room's history, so joining large rooms costs your server disk space. An XMPP server only keeps what you configure it to keep, but the experience depends more on choosing good clients.

Can I self-host Signal or WhatsApp?

No. Signal publishes its server code, but a server you run can't connect to Signal's network. WhatsApp can't be self-hosted, and its third-party chats are limited to a few apps in Europe.

Is WhatsApp end-to-end encrypted?

Yes. WhatsApp encrypts messages and calls with the Signal Protocol. Its privacy policy says it still collects usage, device and connection data and shares information with other Meta companies.

Does self-hosting XMPP stop Google or Apple seeing my messages?

Message content stays encrypted, but phones still wake chat apps through Google's or Apple's push service. In Conversations these pushes carry no message content, and the F-Droid build doesn't use Google push at all.

Have you considered the alternative? Federated chat compared with WhatsApp and Signal