Signal and Molly review — the standard for encrypted calls and messages
Who is this for? Anyone who wants to replace WhatsApp with something that takes privacy seriously. Molly is for Android users who want to go one step further than standard Signal.
Signal and Molly review
Who is this for? Anyone who wants to replace WhatsApp with something that takes privacy seriously. Molly is for Android users who want to go one step further than standard Signal.
Signal is the messenger recommended worldwide by security researchers, journalists and privacy communities. Not because of marketing, but because of its design. Molly is a hardened fork of Signal for Android users who want to go one step further.
What makes Signal different from WhatsApp?
Both apps use end-to-end encryption. The difference is not in the message content but in everything around it.
Metadata: WhatsApp is owned by Meta. Message content is encrypted, but Meta collects who you message, when, how often, and links this to your advertising profile. Signal deliberately collects minimal metadata — the protocol is built so that even Signal itself cannot see who communicates with whom.
Sealed Sender: Signal uses a technique where the recipient doesn’t know which server the message came from, and Signal’s servers don’t know who is sending the message. The sender identity is encrypted before transmission.
Open-source: Signal’s protocol and apps are fully open-source and independently audited. WhatsApp is closed-source — verification is not possible.
No advertising model: Signal is a non-profit. No ads, no data sales, no investors expecting returns on your usage data.
Specifications
| Property | Signal | |
|---|---|---|
| Encryption | Signal Protocol (E2E) | Signal Protocol (E2E) |
| Metadata collection | Minimal | Extensive (Meta) |
| Open-source | Fully | No |
| Owner | Signal Foundation (non-profit) | Meta |
| Phone number required | Yes | Yes |
| Disappearing messages | Yes | Limited |
| Notes to self | Yes | Yes |
| Groups | Up to 1000 | Up to 1024 |
| Desktop | Yes (Windows, Mac, Linux) | Yes |
| Price | Free | Free |
Signal in practice
Disappearing messages: Set a timer per conversation — messages automatically disappear after 1 hour, 1 day, 1 week or longer. Off by default, but recommended for sensitive conversations.
Note to self: Signal has a “Notes” conversation with yourself. Useful as an encrypted clipboard between devices.
Phone number as identity: Signal requires a phone number for registration. You can use a separate number (prepaid, VoIP) if you want to shield your primary number. Signal doesn’t show your number to contacts by default — you can set a username instead.
Molly — the hardened Android fork
Molly is an independently maintained fork of Signal for Android. Same messages, same protocol, but with extra security options Signal doesn’t provide.
What Molly adds:
- Memory encryption: Molly can encrypt the Signal database in RAM. If the device is locked and memory is read out (forensic or via exploit), messages are unreadable.
- Auto-lock: Set after which inactivity period the app locks itself and wipes the memory.
- No Google dependency: Standard Signal uses Firebase Cloud Messaging (Google) for push notifications. Molly has a version without Google dependencies — works via websocket polling. Ideal on GrapheneOS without Google Play.
- USB connection blocking: Molly can block USB data connections while the app is locked.
- SOCKS5 proxy support: Direct proxy configuration without needing a VPN app.
Molly-W vs Molly-FOSS: There are two versions. Molly-W uses Google services (push notifications via FCM). Molly-FOSS has no Google dependencies — the recommended version for GrapheneOS users.
Availability: Molly is not in the Play Store. Install via F-Droid (Molly’s own repository) or directly as APK from GitHub:
- — add the Molly F-Droid repo for automatic updates
- GitHub APK — direct download
Who uses what?
Signal (default): For everyone who wants to replace WhatsApp and doesn’t want to go deeper. Install, invite contacts, done.
Molly: For GrapheneOS users, people with a higher profile, or anyone who doesn’t want Google services in the Signal stack.
Caveats
Phone number required: For maximum anonymity, a phone number not linked to your identity is needed. That’s an extra step outside the app.
Contacts must also use Signal: End-to-end encryption only works if both parties use Signal. Group migration from WhatsApp takes time.
Molly follows upstream Signal with a small delay: The project says it normally merges the latest Signal features and fixes about every two weeks, with faster rollout for security patches. Expect a small delay compared with the official Signal app.
Pros and cons
Pros
- Sealed Sender encrypts the sender identity before transmission — even Signal’s servers cannot see who is messaging whom
- Fully open-source and independently audited; non-profit ownership with no advertising model
- Molly-FOSS has no Google dependencies — works on GrapheneOS without Google Play via websocket polling
- Molly adds RAM encryption — if the device is locked and memory is read forensically, messages are unreadable
- Disappearing messages with configurable timers per conversation
Cons
- Phone number required for registration — anonymity requires a prepaid or VoIP number not linked to your identity
- End-to-end encryption only works if both parties use Signal — group migration from WhatsApp takes time
- Molly follows upstream Signal with a small, deliberate delay
Conclusion
Signal is the best WhatsApp replacement for most people — free, open-source, minimal metadata. Molly is the choice if you’re on GrapheneOS or want to eliminate Google dependencies.
Both are free. There is no reason to keep using WhatsApp if you are serious about privacy.
Getting started
1. Install Signal
Download Signal from the official source: signal.org/download/ for desktop, the Play Store or App Store for mobile. Register with a phone number.
2. First settings
Turn on disappearing messages for new conversations via Settings → Privacy → Default timer for new chats. Choose a timer that fits how you communicate. Also set a PIN via Settings → Account → Signal PIN to protect your profile when switching devices.
3. Invite contacts
Signal automatically shows which of your contacts already use it. Invite the people you message most often. One active group is enough to make Signal feel useful — you don’t need to convince everyone at once.
4. Molly instead of Signal (optional)
Choose Molly if you are on GrapheneOS or want to avoid Google services. Add the Molly F-Droid repository at molly.im/fdroid/. Choose Molly-FOSS for a fully Google-free install. You can sign into the same Signal account you already have.
Next step
Choose this if…
Signal is the default choice for anyone replacing WhatsApp. Choose Molly only if you have a real reason for additional local protection or a Google-free Android stack.
- WhatsApp privacy explained — what WhatsApp actually collects and why switching makes sense
- Recommended privacy apps — Signal in the context of your broader app setup
Already have this?
If you already use Signal or Molly, set up disappearing messages and PIN protection before thinking about heavier options.
- App hardening guide — which app settings still make a difference
- GrapheneOS first setup — running Molly on a Google-free Android setup
Want to go further?
Signal is the endpoint for most people. If communication security is a more serious concern, look at your broader situation.
- Profile: stalking or domestic abuse — communicating safely when you are being monitored
- XMPP guide — a decentralised option with no fixed provider