Note 1: being anonymous is almost impossible in the modern world. You can easily hide yourself from "OSINT" kiddies on Telegram and big-tech corps using the tips described below, but not from governments. If you did something illegal using the Internet and the feds really want to find you -- they will find you.
Note 2: I personally don't use all the information that is described in the "guide", I'm just tired of it all. This "guide" is just a compilation of information I once learned about from various sources.
Probably you won't ever find the perfect messenger. The most of popular messengers are not private/secure/anonymous, or they are technically sucks. The best way to talk is to talk IRL. But there may be a little chance that someone is eavesdropping on you, perhaps even with a laser microphone, but that's extremely unlikely. If that scares you, someone from some MUC have come up with an interesting method: you hide your message in a matchbox and you leave it somewhere for your friend to pick up. To keep the matchbox from being picked up by some homeless guy and read, it's worth making a double bottom out of paper. You can also leave one match to burn the message after reading it. However, you and your interlocutor may live in the different cities, so the only way to chat is the Internet (or maybe paper mail where the postman can read your messages).
Before we start, I would like to divide the messengers and protocols into three sections: centralized, federated, and decentralized. Centralized messengers are the messengers that use servers owned by messenger developers (for example, Telegram). Federated messaging protocols use a couple of servers on the network from several owners that are connected to each other. You may have experienced this when using email: sending from your @basedmail.org email to @gmail.com. An example of a federated IM protocol is XMPP. Decentralized. I call these messengers decentralized because idk how to call them else. I know that federated protocols are decentralized too so don't DM me about that. These protocols can work without servers (P2P or over Tor/OXEN nodes). Users are connecting to their interlocutors' nodes (or IPs, avoid these messengers) without routing through the central server.
I can't recommend anything here. Almost every centralized messenger I know has awful problems. For example, Signal asks you for a phone number to sign up, Threema is paid, and others are just bullshit with more problems. I'll talk about them in the "What I can't recommend" section.
Probably the best messaging protocol. It has only useful features, various clients for any platform, big community and it is easy to set up on your own server. But it's not secure by default, because server stores all unencrypted messages and server host can read them. If you prefer XMPP, please consider using additional encryption. For 1v1 conversations you can use OTR encryption. OTR is based on PGP. 1 session - 1 key. To generate new encryption key you must end the session and delete chat history. But this protocol doesn't work in group chats, doesn't support files encryption, doesn't support multiple devices and both users should be online to use OTR. The second one encryption protocol is OMEMO. For each new message, a new encr. key is generated. It supports group chats, file encryption, and sending encrypted messages even if your friend is not online. Howewer, your OMEMO encrypted messages can be compromised because the messages are synced between devices on an account, so if some1 hack your account, he will get access to your encrypted messages just by marking the new device fingerprint as trusted.
Desktop clients: Gajim, Psi+, Dino, Profanity, Pidgin (the least secure client).
Android clients: Conversations (or blabber), Xabber, yaxim, aTalk
iOS - ChatSecure
Some of the servers: 404.city, 5222.de, anonym.im, jabb3r.org, jabber.calyxinstitute.org, jabber.de, jabber.fr, Danwin1210, Disroot, Systemli
Normie-friendly federated IM protocol with convenient clients for most of popular platforms. Uses the libolm-based encryption protocol which is nice. But it has some problems. In matrix, the main matrix.org server is dominant. When registering, they first of all offer to register on it (if you register through the application), as well as the vast majority of users and public rooms use this particular server. Because of this, the ability to select another server (for example, tchncs.de, monero.social) becomes more like a bonus, and not one of the main features of the protocol. However, it's pretty bloated, uses Electron for desktop applications, and doesn't allow other clients that aren't forks of Element to be used normally for two reasons: 1) Most of the servers I know of (including the ones I listed above) do not support registration in the form of an electronic form on the site and offer to register through Element. 2) If you want to switch to a client that is not based on Element (like FluffyChat or gomuks), you won't be able to recover encrypted conversations because Element requires you to confirm your login to another client in order to decrypt conversations, but these clients may not support this confirmation. This happened to me with FluffyChat and gomuks, so I had to stay with Element. You can read more about matrix here, and here. But still matrix can be a good option to transfer some contacts from other, worse messengers like Telegram, WhatsApp, and so on. I had such an experience and everything was fine, but because of bugs in the iOS version of Element, my normie-contacts were "forced" to move the chat to Telegram, because it's simply impossible to use a messenger that sometimes crashes, you can shit yourself with this!!!!
Quite contradictory messenger. It's open-source, works over the Lokinet (OXEN) network, doesn't require an email/phone number/etc. to sign up, and all messages are encrypted with their own protocol based on the libsodium library. But the Session is being developed by the OPTF Foundation, which is based in Australia. Australia is a member of the "five eyes alliance", and in 2018, a law was passed that encourages the creation of encryption vulnerabilities (TOLA Division 7 (3)). As OPTF states, although the foundation is based in Australia, anti-encryption law does not apply to their messenger as the infrastructure is located around the world.
Session has also been audited by QuarksLab in 2021:
Oxen Session really improves Signal privacy and resilience by using an overlay network to the existent end-to-end encryption instant messaging solution. The onion-routing mechanisms make use of Oxen’s Snodes to store and exchange messages, however, there are some other centralized standard web services that are still used through the overlay network (for the push service and to deliver attachments files).
I'll also mention that the OXEN blockchain is based on Cryptonode, which underpins the Monero cryptocurrency. All in all, we can say that Session is not a bad messenger. The only disadvantage at the moment is, perhaps, the jurisdiction of the developer, and perhaps the fact that the messenger is relatively young and there may be inconveniences when using the application.
An amazing alternative to Zoom, Skype, MS Teams, etc. It supports call recording, desktop sharing, unlimited size file transfer (thx to p2p). All calls and messages are encrypted with TLS 1.3 for calls and RSA for messages. When you are sending a message, you don't send it to your interlocutor's device, you send it to a DHT node, and your interlocutor won't see your IP address. I personally didn't use Jami and I can't say anything about the app stability.
Briar works over the Tor network. With Briar, you can make your own mesh network that works with Wi-Fi or Bluetooth and chat without an internet connection. Of course, Briar requires only a login and password to sign up. Briar is available on Android and Linux/Windows in beta. I can't say anything more, but everyone says that Briar is one of the most secure, private, and anonymous messengers right now.
I've found out this messenger at some Telegram channel and read about him at supernovas.space website. Can't write better so I've just pasted the text from his article here.
---
"SimpleX Chat is a newer messenger that has a unique design. For each contact you make you create a unique message queue just for them to send you messages to on a server. They also create a unique message queue for you to send to them. There are no user names to identify specific users of the app, all you know is the location of their messaging queue (which is only for your use). It is like a peer to peer messaging app except that there is a server with a messaging queue in the middle acting as a proxy.
This design has several advantages, including being able to send messages to someone even when they are offline. You send a message to their queue (which is always online) and they then retrieve the message right away if they are online, or they pick it up the next time the come online. This also protects the network connection details of the devices themselves, since only the server address is ever known. This is such a simple yet effective design.
The messenger also uses good proven encryption methods with the NaCL library, Diffie Hellman ECC key exchange and XSalsa20 encryption. The local database is also encrypted with SQLCipher and I have not detected any data leaks into common storage on Android. The features are limited with texts chats, image and file sending, and group chats. But if you want a really secure and private messenger this is looking very promising."
Source: supernova
I told about the most popular good (or just not bad) messengers, but there are other interesting messengers that I would like to tell about, but then the article would be too big, and so I suggest readers to find information about them on their own.
cwtch
delta chat (works over email xd)
tinfoil chat
berty
speek!
ricochet refresh
rocket chat,
mattermost,
revolt,
zulip (discord/slack alternatives)
retroshare (for almost everything)
bitmessage (very interesting email alternative)
It's awful.
First, it's not anonymous, it's not private, and it's probably not secure. It requires a phone number when registering, does not encrypt messages, secret chats with encryption are only available on mobile devices 1 to 1 and uses its own encryption protocol, MTProto 2.0, which was redesigned because MTProto 1.0 was unreliable. Transfers user information to law enforcement agencies (1, 2, 3). There are tons of data-mining bots that are highly used by some stupid angry kids called "doxers". These bots can know your phone number (if you've joined a group monitored by the bot without hiding your phone number once), the groups you're chatting in, one of the bots even knows what channels (not all) you subscribe to!!! And of course, Telegram servers are closed-source. At the same time, many Telegram defenders still claim that Telegram is confidential, citing as the only argument the story of how the saintly Pavel Durov in 2017 refused to hand over encryption keys to Russian law enforcement agencies, because of which Telegram was not blocked, and then attempts to block Telegram stopped ¯\_(ツ)_/¯.
Second, it's bloated as fuck (all messaging apps are bloated tbh (maybe except IRC), but Telegram is one of the worst in my opinion). Telegram is packed with unnecessary functionality, such as sending stickers, stories (recently added), voice messages (for which they invented crutches, which I'll talk about later), reactions, and Telegram Premium features (animated emoji). Telegram Premium is generally a separate issue. It was created as an unobtrusive way to hold Telegram, but in the end it turned out to be a donation, like on shitty Minecraft servers. Telegram Premium users get the ability to send files 2 times larger, add more than 100 chats/channels to chat folders, auto-translate (by the way, this feature is free in some clients, such as Nekogram), there are those very "crutches" for voice messages (you can decrypt voice messages by sending them to Google servers (TOS 7.4, July 2023 archived), or generally prohibit the interlocutor from sending voice messages), they turn off ads, and files load faster.
Unfortunately, I am forced to use this piece of crap (and WA) everyday to communicate with my family and friends. If you're in the same situation, please, don't use your real phone number.
Telegram are liars. Telegram told their messenger will always be free and won't have ads, then they added ads and Premium subscription.
Telegram censors channels: February 2022, March 2022, August 2023. Don't use Telegram.
Requires the phone number, encrypts, belongs to Meta, synchronizes chats with Google Drive, hashes the user's contacts on their servers without salt. If you need more, read WA's Privacy Policy. But I think the affiliation with Meta is enough.
Again, the privacy policy is enough. If you need more, read the articles by spyware watchdog, shy studios, and maybe something from the wiby.me search results.
Signal is 60% okay, but it asks for a phone number and is centralized. Btw phone numbers of ~1000 users of Signal were compromised by Twilio, which was used to check the users' phone numbers.
Email sucks, better call Saul use instant messaging solutions. But email is still popular so I'll talk about some providers and clients. Note: the best provider is your own, below will be written about more or less normal public providers.
IMPORTANT: use PGP encryption every time you talk with e-mail, or use something like Delta Chat/dib2qm.
Paid (1 euro/month), but very good service with not significant disadvantages. They do not save IP addresses (proved by the German Federal Commissioner for Data Protection), they also do not save IP addresses when using a mail client. Letters are deleted instantly (but if there was a backup, you have to wait another week for them to be deleted). Mail payment data is stored for 10 years, but it doesn't seem to be tied to a specific user. Plus there's the option to pay by voucher or cash (send money by post). Quite mild terms of use: it is forbidden to use mail to send advertising, it is forbidden to violate German laws and children's rights. The site has no trackers, has 2 alias addresses (you can buy more), uses renewable energy.
Danwin1210. Free. Supports email clients, has an onion domain, uses TLS 1.3 on the site, does not require JS. Processing of personal data (name, email address OR phone number) complies with GDPR and German data protection regulations. The following data is collected: browser and its version, OS, website, website pages, date and time of visiting the website or sending emails, sender and recipient of emails and others (and which ones - unknown). The provider justifies all of this by optimizing the servers (yep, cnc), but states that it does not draw conclusions about any of the data collected. Data is stored for 48 hours (anonymous data is also stored for 48 hours, stored separately from regular data) and then deleted. No tracking cookies are used ("This site only uses technically necessary session cookies and does not use any form of tracking cookies"). Despite the data it collects, it's a good provider, certainly better than Gmail. However, the big question is how long will it last? The mail service seems to be owned by one person (Daniel Winzen) and I don't know how long he will continue to support it, he may shut it down at any moment. Some RiseUp would be more reliable in that respect. By the way, Danwin1210 also provides XMPP.
Postman. It is available only via i2p (but it can also send mail to the clearnet). Privacy policy, unfortunately, is absent, but there are rules to accept before registration: do not use mail for criminal purposes, use mail at your own risk, do not use mail to send advertisements, and so on. No way can store IP address (because there is nothing to store, connection is only via i2p). No say if mail can be read and if it is encrypted. Suisimail interface is used for webmail, but it is not on the internet but locally, and the ISP recommends using it (even though it supports mail programs). It does not require JS and passing the Google captcha. All in all, the provider is good. It would be nice if the privacy policy was also present.
Source: shadowwiki
RiseUp is free, but to get it, you have to tell them who you are and why you need secure mail, and the application must be approved, or register with an invite code. Support email programs, have an onion domain. Keep the year and month of the last login (day and time are not saved). Store logs (sender and recipient address) for a day, for the sake of protection from spam attacks and advertising from RiseUp users (advertising is prohibited by RiseUp). Stores session IDs that are deleted after logging out of the mail. Do not use tracking cookies or third-party cookies. Do not store IP addresses, browser fingerprints or message metadata. All user data is encrypted and only RiseUp has access to the encryption keys. One of the best email providers.
Also a nice provider. Disroot stores logs for 24h, encrypts server disks, and so on. Basic things for a good email provider. Read more at their Privacy Policy https://disroot.org/en/privacy_policy
neomutt (terminal), Claws (GUI).
Just use SearX.
I absolutely love croc. It's fast, simple and secure. However, if you need the most secure, private and anonymous solution possible, use OnionShare. If you need something like Mediafire, use Lufi or Send.
The best option is the default Tor Browser. For clearnet use LibreWolf or Firefox with custom user.js (Arkenfox, Betterfox) if you need Firefox (Why don't I use the default configuration of FF?). If you need chromium-based browser, use Ungoogled Chromium. If you need minimal browser, use QuteBrowser/Dillo/Suckless Surf/Nyxt/NetSurf. You might also try Pale Moon or Nuegia Web Browser. In my opinion, the best (except TB) is LibreWolf, because the only thing it needs to configure is cleaning the URL in browser.safebrowsing.provider.mozilla.updateURL in about:config, and you can install extensions from the big Mozilla addons library. Extensions I use and recommend: uMatrix (if you're Pale Moon user - eMatrix), uBlock Origin (unnecessary if you already use u(e)Matrix, I use uO because I don't want to block ads manually), Chameleon (unavailable on chromium-based browsers), CanvasBlocker (also unavailable for chromium-cringed browsers), LocalCDN, ClearURLs, Vim Vixen (or Vimium C), Dark Reader (warning: using DR in dynamic mode may change your browser fingerprint. Not sure if it's true, but someone who I trust told me that it does), LibRedirect. Soon I'll paste a link to an article about these and other extensions.
Alternative frontends list: click, + AnonymousOverflow, GotHub.
Cromite or anything from FFUpdater (except Mozilla FFs, Brave, Vivaldi, Kiwi, and maybe DDG)
pass or KeePass (XC, DX - Android) for GUI. If you need cloud pm, use BitWarden hosted on your own server (VaultWarden).
I think this paragraph should be in a daily use software (WIP) list, but there is one reason why I've put it in this article. MS Windows and most of Android ROMs are filled with spyware and without a clean operating system, using everything I'm talking about here may be useless.
First, switch to Linux or BSD. If you are newbie, you may try Linux Mint. When you have some experience with Linux, switch to systemd-free distributions (that's not necessary). But why? And on what distro? Read nosystemd website (+RefractaOS). Also you can read an article at suckless.org. I personally use Artix Linux with OpenRC and have no problems with it (upd: it broke twice and now I'm on openSUSE Tumbleweed but I'm going to try Alpine Linux soon). If you want something unusual, try oasis linux and Plan 9 (or its fork, 9front. Also check out Qubes OS if you need OS that is secure by design (but Qubes use systemd).
If you have Google Pixel phone, use GrapheneOS or CalyxOS. Else, choose one of them: LineageOS (degoogling guide), DivestOS, /e/os (ok in terms of privacy, but the UI looks like poor iOS remake), crDroid, Replicant (for old Samsung devices). Maybe you didn't know, but you can also install Linux on a smartphone! Example: postmarketos
Probably you don't need VPN. Use Tor, it's free and is more secure and anonymous than VPN. But Tor is slow, and the only thing why VPN can be better is the speed. The least bad fast and open source VPN I know is Mullvad. There are also nice free providers such as Calyx and RiseUp, but I don't see any reasons to use them instead of Tor.
As always, host everything on your own machine. But sometimes it's impossible, or you need to host something that should be in another country (vpn or tor node for example), so here's a list of public providers. Haven't tried any of these providers and don't want to say something about them, just read their Privacy Policy and ToS if you are interested in.