Is SMS Encrypted? Anonymous SMS vs End-to-End Encryption
Published by Elvento Labs, the maker of Ghost. How we research and review
Is SMS encrypted? Not end to end: the carriers that deliver a text can read it. Anonymous SMS and end-to-end encryption protect different things. Anonymity hides who sent a message: the recipient sees a masked sender instead of your phone number. End-to-end encryption hides what was said: only the devices at each end can read it, not the carriers or the company in between. An ordinary text message has neither protection, and an anonymous SMS adds only the first. If your worry is a stranger keeping your number, you need anonymity. If your worry is someone reading the conversation, you need encryption. Some situations need both.
This guide explains how a plain text travels and who can read it, what iMessage, RCS, Signal and WhatsApp actually encrypt as of October 2026, why number masking is not encryption, and how to choose or combine the two for the risk you actually face.
Anonymity vs Encryption: Two Different Questions
Every message answers two questions for anyone who handles it: who sent this, and what does it say. Anonymity tools change the answer to the first. Encryption tools change the answer to the second. Most confusion about private messaging comes from assuming that a tool which answers one also answers the other.
Think of a paper letter. Encryption is a sealed envelope only the recipient can open, but your return address is still printed on the front. Anonymity is a postcard with no return address, which anyone along the route can read. You can have one without the other, both, or neither.
| Content readable in transit | Content hidden from everyone in between | |
|---|---|---|
| Sender's number shown | Ordinary SMS from your own phone | Encrypted messengers such as iMessage, Signal or WhatsApp |
| Sender's number hidden | A masked or anonymous SMS | Encrypted apps that need no phone number, such as Session |
The top-left box is where most people text from by default. Each step away from it protects you from a different person:
- Anonymity protects you from the recipient. A marketplace buyer, a date you haven't met, or a stranger who might save, share or search your number never gets it. Our explainer on what phone number masking is covers how that substitution works.
- Encryption protects you from everyone in between. Carriers, the messaging company, a compromised network, or anyone with legal access to those systems may see that a message moved, but not read it.
Neither protects you from the person you're talking to, who can screenshot, forward or act on what you sent. And neither, on its own, hides you from the company that runs the service you use.
Is SMS Encrypted? How a Plain Text Message Travels
Not in the way that matters. A standard text message is not end-to-end encrypted, and it was never designed to be. Here is the route it takes:
- Your phone sends the text over the radio link to a nearby cell tower. On modern networks this hop is encrypted, but only to protect the airwaves. The network decrypts it on arrival.
- Your carrier's messaging center receives the text in readable form and works out where to deliver it.
- If the recipient is on another carrier, the message crosses between networks over the signaling systems carriers use to route calls and texts.
- The recipient's carrier delivers it to their phone, where it appears as plain text in the messaging app.
From step two onward, the words are readable by the systems handling them. EFF's guide to the problem with mobile phones advises assuming that ordinary calls and SMS texts have not been secured against eavesdropping or recording. It also notes that carriers can see who called or texted whom, and when.
Who can read an ordinary text message
- Your carrier and the recipient's carrier, as part of delivering it.
- Anyone with lawful access to those carriers' systems, through whatever legal process applies in that country.
- An attacker who gets into the route, for example by abusing weaknesses in the signaling systems that link networks, or by running a fake cell tower (an IMSI catcher). EFF says there is no reliable defense against every IMSI catcher.
- Anyone who holds either phone, or who glances at a lock-screen preview.
What a text reveals besides its words
Even if nobody reads the content, an ordinary SMS hands your phone number to the recipient and leaves both carriers with a record of which numbers exchanged messages and when. Signal cited both problems when it removed SMS support from its Android app in 2022, describing plaintext SMS as insecure and as leaking sensitive metadata to telecom companies.
It would be wrong to treat every text as intercepted. Most people are not targets of network surveillance. The everyday risks are simpler: the recipient keeps your number, the content gets forwarded, or someone picks up a phone. The point is that SMS gives you no technical protection when the content does matter.
iMessage and RCS Encryption as of October 2026
The messaging app on your phone may use something more modern than SMS without making it obvious. Whether a given conversation is encrypted depends on which protocol it's using at that moment.
iMessage: encrypted between Apple devices
According to Apple's guide to iMessage and SMS/MMS, messages sent with iMessage appear in blue bubbles and are end-to-end encrypted. iMessage only works between Apple devices, over Wi-Fi or mobile data. When it isn't available, Messages can use RCS or SMS/MMS instead, and those appear in green bubbles. The other person still sees your phone number or Apple Account email, so iMessage keeps the content private, not your identity.
RCS: encrypted only when the conversation says so
RCS (Rich Communication Services) is the successor to SMS. It adds typing indicators, better media and texting over Wi-Fi. On iPhone, Apple's RCS page says it needs iOS 18 and a carrier that supports RCS on iPhone, and that availability varies by region and carrier.
Encryption is the part still settling. As of October 2026, Apple describes end-to-end encrypted RCS as a beta, starting with iOS 26.5, that works with supported carriers and is on by default. Its iMessage guide adds that an RCS conversation is encrypted only when every participant's carrier supports it, and that encrypted chats show an "Encrypted" label with a lock at the top. Without that label, Apple says, RCS messages aren't protected from third parties while in transit.
On Android, Google Messages has encrypted RCS chats between its own users for several years and marks encrypted conversations with a lock. Google's RCS help page also explains that the Send button shows how a message will go out: over Wi-Fi or mobile data, or as SMS or MMS. If a chat message fails, you can choose to resend it another way.
The fallback problem
Both platforms fall back. When iMessage or RCS can't connect, a conversation can drop to plain SMS, and the encryption goes with it. On iPhone the bubble color doesn't settle the question, because SMS and RCS are both green. The lock is what counts. If you text from an iPhone and also want to hide your number, our guide to texting someone anonymously on iPhone covers the options.
How to check whether a conversation is encrypted
- 1
Check the bubble color on iPhone
Blue means iMessage, which is end-to-end encrypted. Green means SMS or RCS, so keep checking.
- 2
Look for the lock
An encrypted RCS chat on iPhone shows an Encrypted label with a lock at the top of the conversation. Google Messages marks encrypted chats with a lock as well.
- 3
Check the Send button on Android
In Google Messages, the Send icon shows whether the message will go over Wi-Fi or mobile data, or as SMS or MMS.
- 4
Watch for fallback
If a message was resent as a text message after failing, treat that message as unencrypted SMS.
- 5
Switch apps when it matters
For content that must stay private, use an app that encrypts every message by default instead of relying on whichever protocol is active.
Signal and WhatsApp: Encrypted, but Not Anonymous
Dedicated messaging apps avoid the fallback problem: every message between their users is encrypted, every time. What they don't do by default is hide who you are.
Signal
Signal encrypts messages end to end with its open-source Signal Protocol and says it cannot read your messages or listen to your calls. It is run by an independent nonprofit. It also collects little about its users. In its published responses to government requests, the only account data Signal says it could produce was when an account registered and when it last connected.
On identity, Signal still asks for a phone number when you sign up. Since early 2024, though, Signal hides your number by default from people who don't already have it saved, and lets you share a username instead, so a new contact can message you without seeing your number. That is the closest a mainstream encrypted messenger comes to anonymity, and it only works with people who install Signal.
WhatsApp encrypts personal messages end to end by default, using the Signal Protocol. Its accounts are built on phone numbers, though: you register with yours, and people usually find you by it. WhatsApp's privacy settings let you limit who sees details such as your profile photo and last-seen status. That reduces what contacts learn about you, but it isn't anonymity, and encryption covers what you say, not the account information around it.
Telegram, Session and the rest
Telegram is often assumed to be fully encrypted. Its FAQ says ordinary cloud chats, including groups, use server-client encryption, and only "secret chats" between two people are end-to-end encrypted. Session takes the opposite approach to identity: its FAQ says you don't need a mobile number or an email to create an account, and conversations are end-to-end encrypted. The trade-off is reach, because the other person has to use Session too.
For a wider comparison that includes second-number apps and free web senders, see our guide to the best anonymous texting and messaging apps.
| Tool | Content encrypted end to end? | What identifies you to the other person | Who you can reach |
|---|---|---|---|
| Ordinary SMS | No | Your phone number | Any phone |
| iMessage | Yes | Your phone number or Apple Account email | Apple devices; falls back to RCS or SMS |
| RCS | Only when the chat shows it is encrypted | Your phone number | Phones with RCS turned on; falls back to SMS |
| Signal | Yes, always | Your profile name or username; your number is hidden by default from people who do not have it saved | Signal users |
| Yes, for personal chats | An account registered to your phone number | WhatsApp users | |
| Telegram | Only in secret chats | An account registered to a phone number | Telegram users |
| Session | Yes | An account ID; no phone number or email needed | Session users |
| Masked SMS (Ghost) | No | A masked sender instead of your number | Any phone in 100+ countries |
Why Number Masking Is Not Encryption
Number masking replaces one piece of information, the sender's number, before a text goes out. It doesn't change what happens to the words.
When you send through a masking service such as Ghost, which delivers to more than 100 countries, the message goes out as an ordinary SMS. The recipient sees a protected sender ID instead of your number, and texts to the US, Canada and Europe start with "GHOST:", so the recipient can tell the text came through Ghost without learning who sent it. From there it crosses the carrier network like any other text and appears in plain text on the recipient's phone.
It can't work any other way. End-to-end encryption needs software holding a key on the recipient's device. Someone receiving an SMS has only their phone's built-in messaging app, which holds no key for messages from a third-party service. So any service that delivers to an ordinary phone number, without the recipient installing anything, is delivering readable text. If a service advertises "encrypted anonymous SMS" to any phone, the most it can mean is that the connection between your device and its servers is encrypted, which is true of most websites and says nothing about the SMS itself.
Masking also doesn't hide you from the service or the network. Masking hides your number from the recipient, not from the service, the carriers, or lawful legal process. Ghost doesn't sell data and keeps minimal metadata for abuse prevention and valid legal requests, as its privacy summary explains. Anonymous to the recipient is not the same as anonymous to a court order.
None of this makes masking weak. It is aimed at a different risk: the person you're texting. For a marketplace sale, a first text to a date or a message to a contractor, the realistic threat is not a carrier reading "Is the bike still available?" It's a stranger holding your real number for years. Our guide to what someone can do with your phone number explains why that matters, and number masking vs a second phone number compares the two ways to keep it private.
Anonymous vs Encrypted Messaging: Which Do You Need?
Start with three questions. They are the core of the security-planning approach behind EFF's Surveillance Self-Defense guides:
- What are you trying to protect? Your number, your identity, the content, or the fact that you're in contact at all.
- Who are you protecting it from? The recipient, the network, the app company, someone with access to your phone, or a determined adversary with resources.
- Will the other person install an app? If not, you are limited to SMS, and end-to-end encryption is off the table.
| Your situation | Main risk | Best fit | Masking helps? | Encryption helps? |
|---|---|---|---|---|
| Texting a marketplace buyer or seller | They keep, share or look up your number | Masked SMS or a second number | Yes | No |
| First text to a dating match | A stranger gets your real number before you trust them | Masked SMS, then an encrypted app with a username once you trust them | Yes | Later on |
| Discussing health, money or legal matters with a friend | Content read in transit or by a provider | Signal or another app that encrypts by default | No | Yes |
| Journalist, activist or official who may be targeted | Interception, device compromise, metadata | An encrypted app plus expert guidance; not SMS | No | Yes, but not on its own |
| The recipient must never learn who you are | The content or context identifies you | Neither tool alone; rethink the message | Partly | No |
| Protecting accounts from SIM swaps | Someone takes over your number to receive login codes | An authenticator app or security key | No | No |
| Reaching someone who blocked you | This is harassment, not privacy | Do not send it | Not a valid use | Not a valid use |
The most common mistake runs both ways. People reach for an encrypted app to deal with a buyer they've never met, when the buyer doesn't use that app and the problem was never the content. Or they assume a masked text is "secure" and put something sensitive in it. Match the tool to the person you're protecting against.
The third row is the one where SMS of any kind is the wrong answer. If your work makes you a likely target, CISA's mobile communications best practice guidance is the model to follow: it responds to nation-state espionage aimed at commercial telecommunications infrastructure and is aimed at highly targeted people, such as those in senior government, military and political roles.
The fifth row is worth pausing on. If the recipient knows you, your writing style, a shared memory or the timing of a message can identify you faster than any phone number. Anonymity tools hide metadata, not you. The last row isn't a privacy question at all: contacting someone who has blocked you is harassment, whatever tool you use, and it can be illegal.
How to Combine Anonymity and Encryption
Sometimes you need both: a contact who shouldn't have your number, and a conversation that shouldn't be readable. There are three practical ways to get there, each with a cost.
Use an encrypted app that doesn't expose your number
Signal with a username is the mainstream option. You still register with a phone number, but new contacts see your profile and username rather than your number. Signal's 2024 username announcement explains that a separate setting controls who can find you by your number, so someone who already has your number can still look you up unless you change it. Session goes further and needs no number at all, but both of you have to install it.
Start with a masked text, then move to an encrypted app
This is the common real-world pattern for dating and other contacts who might become friends. The first message goes by masked SMS, which reaches any phone without revealing your number. If trust builds, you offer a Signal username. A username isn't a web link, so it fits in a masked text. Ghost texts can't contain links of any kind.
Example: a first masked text, as the recipient sees it
Masked sender
Text Message
GHOST: Hi Dana, it's Sam from Hinge. Looking forward to Saturday. If you'd rather keep chatting somewhere private, I'm on Signal as sam.42
If they need to answer that first text without getting your number, Ghost has an optional Reply Link. You switch it on for that message and enter the number replies should go to. A short link is added to the end of the text, and the recipient opens it in a browser to type one reply, which reaches your phone as an ordinary text. A link accepts a single reply and stops working after 7 days. As of September 2026 it costs 3 credits plus the rate for the reply's destination (pricing). Replying in their own messaging app doesn't reach you, and the reply travels as SMS, so it isn't encrypted either. Our two-way anonymous texting guide walks through the setup.
Keep each tool to its job
Once a conversation has moved to an encrypted app, keep sensitive content there instead of drifting back to SMS. Don't put your real number in your profile if anonymity was the point. And remember what no combination fixes: the content itself. Mention your street, your employer or a mutual friend, and you've identified yourself. If you're weighing when to share your real number with a match at all, see is it safe to give your number on a dating app.
Need someone to get your text, but not your number?
Ghost sends a masked SMS that reaches an ordinary phone without showing your number. Keep anything sensitive for an encrypted app.
Messaging Security Habits That Matter More Than the App
The protocol you use matters less than a few habits. Most real-world message leaks come from accounts, phones and people, not cryptography.
Stop relying on text-message login codes where you can. The FTC's guidance on two-factor authentication says text codes are better than nothing, but someone can take over your number through a SIM swap. It calls an authenticator app safer and security keys the strongest option. NIST's digital identity guidelines (SP 800-63B-4) classify phone-network delivery of codes by SMS or voice as "restricted" and state that out-of-band codes are not phishing-resistant. Our guide to SIM swapping warning signs covers how to lock your number down with your carrier.
Treat every recipient as the weakest link. Encryption ends at their screen. Screenshots, forwarded messages and shared phones defeat any protocol, so send each message as if it could be shown to someone else.
Lock down the device. A strong passcode, current software and hidden lock-screen previews protect messages on your phone, whatever app delivered them.
Before you send something sensitive
- I know whether this conversation is end-to-end encrypted right now, not just usually
- The recipient uses the same encrypted app, and I have checked I am messaging the right account
- Nothing in the message is a password, login code, card number or ID number
- Lock-screen previews are off for the app I am using
- If the recipient should not have my number, I am not sending from my own number
- I would be comfortable if this message were forwarded
For one-off texts to people who shouldn't have your number, our guide on how to send anonymous SMS safely covers what to include, what to leave out, and where the legal lines are.
Frequently Asked Questions
Is anonymous SMS encrypted?
No. A masked or anonymous SMS is delivered as an ordinary text message, so it is not end-to-end encrypted. Masking hides your phone number from the recipient. It does not hide the content from the carriers that deliver it or from the service that sends it.
Are regular text messages encrypted?
Not end to end. The radio link between a phone and the cell tower is usually encrypted, but the message is readable inside carrier networks and on both phones. Treat ordinary SMS as readable by your carrier and the recipient's carrier.
Is iMessage end-to-end encrypted?
Yes. Messages between Apple devices that appear in blue bubbles are end-to-end encrypted. Green bubbles are SMS or RCS, and an RCS chat is encrypted only when Messages shows an Encrypted label with a lock, which Apple listed as a beta with supported carriers from iOS 26.5 as of October 2026.
Is RCS more secure than SMS?
It can be. An RCS conversation that is end-to-end encrypted protects the content, but encryption depends on both sides and their carriers supporting it. Without encryption, RCS messages are not protected from third parties in transit, and RCS falls back to SMS when it cannot connect.
Does Signal hide my phone number?
Partly. Signal needs a phone number to sign up, but since 2024 it hides your number by default from people who do not already have it saved, and you can share a username instead. Signal encrypts message content end to end.
Is WhatsApp anonymous?
No. WhatsApp encrypts personal messages end to end, which protects what you say, but accounts are registered to phone numbers and people usually find you by yours. Privacy settings limit what contacts see, not who you are.
Can I get both anonymity and encryption?
Yes, with limits. Session needs no phone number or email, and Signal with a username keeps your number from new contacts, but both only reach people who install the same app. To reach any phone without sharing your number, a masked SMS works, but its content is not encrypted.
Should I send passwords or login codes by text?
No. Do not send passwords, login codes, card numbers or ID numbers by any SMS, masked or not. For account security, the FTC recommends an authenticator app or a security key over text message codes when they are available.
Sources
- Apple: About iMessage and SMS/MMS
- Apple: Turn on RCS messaging on your iPhone
- Google: Turn on RCS chats in Google Messages
- EFF: The Problem with Mobile Phones
- EFF: Surveillance Self-Defense
- Signal: Signal Messenger
- Signal: Government communication
- Signal: Keep your phone number private with Signal usernames
- Signal: Removing SMS support from Signal Android
- WhatsApp: How to change your privacy settings
- Telegram: FAQ
- Session: Frequently asked questions
- CISA: Mobile Communications Best Practice Guidance
- FTC: Use Two-Factor Authentication To Protect Your Accounts
- NIST: SP 800-63B-4: Authentication and Authenticator Management
See also
