How to Make a Really Secure Messaging App like Signal

Highlights:

• During the time of increasing cyber threats, including data breaches, interception cyberattacks, unauthorized access, and man-in-the-middle attacks, the need for secure communication tools has never been more important among users.
• Furthermore, with data breaches becoming more and more common (in March 2024, over 299 million data records were compromised by threat actors, which is 58% more than in previous month, and 613% increase since 2023), it becomes vital for businesses to build a secure messaging app that prioritizes both security and privacy, to protect users' confidential information and cultivate trust with them.
• As privacy regulations tighten worldwide, the demand for messaging apps with robust security features that guarantee confidentiality is increasing rapidly.

If you’re here to learn how to make an encrypted messaging app, we’d like to share our experience and offer tips. We had already built Chapp, an encrypted messenger app for Middle Eastern young professionals who needed to safeguard their chats with friends and colleagues from prying eyes, including hackers, law enforcement, and intelligence services. We’re guided by Signal, the app used by military forces, and — to make a worthy competition for it — created the MENA-operating messenger with the FBI-recognized level of security.

Chapp, a secure messaging app developed by Mind Studios

Here is how Karina Ivakh, project manager at Chapp, describes our collaboration:

“When we worked on the Chapp project, our goal was to create an app that met the highest standards of security and privacy. Just like Signal. To achieve this, we combined our industry expertise with a transparent and collaborative approach. At Mind Studios, we also highly value long-term partnerships, and our ongoing work with this client has been truly rewarding.”

If you are thinking about creating your own messaging app, don’t hesitate to contact us, and our tech experts will make your ideas come true.

In this article, we’ll talk about what's under the hood of a Signal-like secure messenger, including encryption algorithms, core functionality, and possible risks, as well as how to build encrypted chat yourself. Also, for a secure app development price estimate, scroll to the end of the article.

So, how do you create an encrypted chat app?

Let’s briefly go through the main stages on how to build a secure messaging app like Signal and the time needed for that if you choose Mind Studios as your mobile app development partner.

Discovery

We always recommend starting with a discovery phase. This is a fundamental stage at which we’ll conduct thorough market research, analyze your competitors, and drill down into your target audience’s needs, fears, wants, and habits. It also helps understand whether the niche you are targeting really needs one more app of this kind. Ultimately, we'll come up with the final product vision and draft product requirements specifications.

For instance, for the Chapp app, we tailored our discovery phase to understand the unique needs of Middle Eastern professionals who required both a high level of security and work-life balance.

Time required: 96+ hours

UI/UX design

At this stage, we'll start by drawing up initial concepts for your secure messaging app through wireframes and black-and-white prototypes. After agreeing upon the app's architecture, we'll offer you at least two colored UI concepts from which you'll need to choose. When the main app's visual and functional elements gain your approval (in some cases, the approval from beta testers), our designers will start to draw the entire UI/UX design for your mobile app MVP using the best practices for mobile UX design.

Time required: 168+ hours

Secure messaging app design best practices

If you want to build a messaging app with encryption that stands out from the crowd, you’ll also need to keep up with industry leaders when it comes to design. The Signal app is simple and isn’t famous for its intuitiveness, but it wins over users who care about their privacy more than about bells and whistles. WhatsApp and Telegram, on the other hand, look fancy and are exceptionally intuitive in addition to being secure (while their security might not be on the same level as Signal, it’s still impressive).

Now, let's go through several tips from our UI/UX designers on how you can create a user-friendly interface in a mobile app for secure communication.

Themes and fonts

For a better user experience, it might be worthwhile to offer different chat color themes. Also when you create an encrypted messaging app, think of adding a dark mode to prevent eye strain. For people with visual impairments, allow users to tweak font size, and colors' contrast.

Stickers and GIFs

Every other messenger today integrates the popular GIF service Giphy into its interface to complement emoticons. Stickers became popular when Telegram started offering them for free (as opposed to Viber, for example, where only some stickers are free). You can put some effort into designing unique emojis and themed stickers that reflect your target users’ tone of voice, business jargon, and intended message reactions and thus set your app apart from rivals.

Customizable design

Of course, when you make an encrypted chat app’s UI/UX design, it largely depends on your target audience. For example, Discord, a VoIP instant messaging app that was initially built for gamers, and it has a strict or minimalist design, with users able to customize the app according to their preferences.

Here is what Kseniia Ovsiienko, UX/UI designer at Mind Studios, says about the design of our Chapp project:

“When we worked on Chapp, we tried to make a design that would resonate with users already accustomed to popular apps like WhatsApp and Telegram. So, we redefined the design to ensure it was both secure and intuitive. We also added various features such as media files sharing, geolocation, group chats, and many more to attract users who want to get the most out of the messaging app — rich functionality and security.”

Development

The length of mobile app development could vary depending on the complexity of app features and the number of platforms for which you decide to build your app.
Here, we'll mention a rough estimate of the time that might be spent developing a native iOS client-side mobile app similar to the Signal app architecture, which includes a backend part.

Time required: 1,480+ hours

Encrypted messaging app tech stack

Now, you may wonder how to make an end-to-end encryption chat app and what technologies we recommend you use to make your instant messenger highly secure and crash-free.

The back end is where the magic happens in messengers. Backend specialists are responsible for your chat app’s security and reliability, as they’re the ones who know how to encrypt messages and handle ever-increasing concurrent requests and connections.

Programming language

What language should you choose for your messaging app development? The usual programming language options for a messenger back end are Elixir or Erlang. Ruby on Rails isn't a good choice for handling a large amount of data in the form of text messages, media, and audio/video calls.

“We chose Elixir for our Chapp project due to its exceptional ability to manage the high load of WebSockets and open connections, which is crucial for a secure messaging app. We were also influenced by the fact that WhatsApp employs Erlang, the language on which Elixir is built, while Discord employs Elixir. This gave us confidence that Elixir would provide the scalability and reliability we needed for Chapp,"

says Artem Chervychnyk, Backend Team Lead at Mind Studios.

Of course, when creating your own messenger app, you can choose any programming language, but we would still recommend choosing Elixir.

Message routing

For instant messaging apps where millions of messages are sent per minute, it’s vital to find a message delivery model with a suitable bandwidth for simultaneous interactions. For this purpose, we recommend using a publisher/subscriber model instead of using HTTP requests that work unacceptably slow.

When building Chapp we used Redis as a pub/sub adapter since it allows us to process up to one million messages per second.

Audio/video chat APIs

For real-time audio and video chatting, one of the most demanding technologies is WebRTC (web real-time communication). WebRTC is an open-source project that works smoothly for both modern web browsers and mobile applications. The main advantage of this framework is that WebRTC enables peer-to-peer file sharing and AV streaming without the need for server-side file hosting.

Though WebRTC is a great API for mobile app development itself, it’s also an originator for diverse open-source projects and frameworks aimed to power mobile applications at scale. One of them is Twilio, a cloud communication platform that we’ve preferred to rely on when embedding voice and video SDKs for secure instant messaging apps on iOS and Android.

Here is a brief rundown of technologies our developers prefer to use when building an encrypted instant messaging app architecture:

Testing and refining

This stage is for troubleshooting and polishing your custom instant messaging app to gloss. Our quality assurance specialists will analyze feedback from initial users, provide multiple automated and manual tests to find bugs and fix them, and give recommendations on how to create an instant messaging app more efficiently. Based on QA reports, designers and developers under the supervision of a project manager will refine your product until it meets set success criteria.

Time required: 480+ hours

Key features of an encrypted messaging app to include

Most people use at least one messenger, probably several, and the basic set of features for an encrypted messenger app, like onboarding, sign-up/log-in, or user profile, will hardly surprise you. So we’ll go over them briefly.

To make this block valuable for you, we’ll describe features that made Signal the most secure messenger ever and, which might be even more important, highlight those features that can help you outdo the Signal mobile app.

It is worth noting that these features will be useful not only when you want to develop a messaging app like Signal. They are also valid for creating any messenger application and will help make it more secure.

Feature	Description
Sign up/Log in	A messenger account is usually tied to a phone number or email address. Signal, for instance, asks you to enter your phone number to send you back a verification code via SMS.
Screen lock with PIN	After verification, Signal offers a user to pitch a PIN code, by default consisting of four digits that, if the user so wishes, could be extended by extra characters or changed to an alphanumeric password. Other ways to lock a messaging app screen are with biometric identifiers (Face ID, Touch ID).
Registration lock	Signal requires all registered users to enter the Signal PIN every time a user wants to re-register their account on another device. Besides using a pin code, you can implement two-step authentication via fingerprint, password, verification code, or link.
User profile	A profile stores a user’s personal information and links to important features like contacts, FAQs, and settings. For maximum safety, make it optional for users to provide their real first name, last name, and avatar. In their profiles, Signal allows users to use nicknames or even emojis.
Access to contacts	Instead of automatically granting permission to access users' contacts, it's important to request permission to do so. Only if the permission is received can user contacts be imported to the chat app. Here, it might be convenient for users if your app indicates those who already use the app and those who don't have the option to invite the latter. Sending invitations can also serve your app as an efficient marketing strategy.
Personal and group chats	The Signal app provides personal and group chats as standard. Personal chats allow users to send text and audio messages, images, audio/video files, contacts, location, stickers, and GIFs. For group chats that can hold up to 1,000 members, Signal offers users the ability to create and share group invitation links and manage group chats via admin controls.
Voice and video calls	Most popular instant messaging apps like WhatsApp, Telegram, and Signal support audio and video calls with screen sharing both in personal and group chats but have different limits on the number of participants in a group call.
File transfer	The goal of each messenger is creating a place where millions of users will simultaneously exchange tons of text messages, images, audio, and video files. The size of these files can be different, and equally different is the time required to transfer them. Streamlining the data ciphering, transferring, and deciphering process is your #1 task.
One-time viewable and self-destructing messages	One effective measure to enhance security is implementing a feature that automatically deletes messages after a certain period. Signal, as well as WhatsApp, provides users with a "view once" setting, meaning users can send images and videos that disappear once they have been viewed.
Note to self	Just like Telegram, Signal app has the "Note to self" section, where users can send important text messages, links to audio and video content, and voice notes to themselves. It might come in handy for users to have an Evernote-like organizer built in your secure messaging app as well.
Blurred photos	To protect people’s privacy, Signal provides users with a face-blurring feature. Using it, users can blur faces or other image parts they want to obscure when sharing over the Signal chat. Signal’s image editor can automatically identify and blur faces, meanwhile, other elements of an image can be blurred manually by users with the help of a blur brush.
Incognito keyboard	This feature works for some Android devices. If a user goes to Signal settings and activates incognito keyboard mode, it'll make it impossible for the keyboard’s dictionary to remember the text the user types. There will be no autocomplete or suggestion, however, as well as grammar autocorrecting.
Screenshots blocked	The easiest and fastest way to snoop in on someone’s contacts and correspondence inside the app is by taking screenshots. To prevent your users from being compromised, allow them to disable screenshots for your chat app, as Signal did.
Smart notifications	It’s essential to have a reliable system for instant notifications. In terms of security and privacy, however, it’s worthwhile to enable your users to customize whether they want to have notifications displayed on their lock screens and if yes — what information these notifications should reveal (e.g. name only or name+content+actions).
Media auto-download controls	Since a messenger app might transfer a lot of media from personal and group chats, you should help users avoid overwhelming their galleries by allowing them to disable media auto-downloads.
Backup and restore	Signal doesn't back up any users' contacts, text messages, audio, video files, and other documents. However, suppose a user wants to reinstall Signal on the same phone or entirely move to a new phone (provided that the user will switch from Android to Android or from iPhone to iPhone). In that case, there's an option in the Signal app to enable chat backups and later restore them.
Sync	For users to be able to smoothly switch between devices as they see fit, you’ll need to provide a sync feature. Looking back to the Signal app, it’s a cross-platform encrypted instant messaging app that flawlessly works with Android and iOS platforms as well as desktop programs including Windows, macOS, and Linux.
Settings	Allow users to adjust the messenger for their convenience by going to settings where users can choose dark mode, language, screen security modes, and other above-described features.

Extra features that will make your app unique

Here are some feature ideas from Mind Studios to build a secure messaging app that will stand out in the market:

1. Break chats into multiple rooms according to your target audience’s needs

If you strive to build a messaging app with encryption for business people, consider separating chat rooms for communication with personal contacts, customers, employees, third-party suppliers, etc.

2. Offer secret/private chats

Whether you encrypt your users’ metadata or not, in today’s stormy reality, it might become your app’s selling point to have disappearing or lockable chats. For example, Telegram offers secret chats that automatically disappear if you log out of Telegram on your device. These chats aren’t stored on Telegram’s cloud servers and therefore can’t be backed up or synced even if you’re logged in on more than one device.

3. Integrate a secure document management system

Having all business documents, images, and videos automatically stored in a centralized, secure, and compliant space within one app might come in handy for co-workers. So, consider adding it when you build a messaging app.

4. Add signing documents with an electronic or digital signature

The e-signing feature tends to be appreciated by people in business since it helps their business go paperless — that is, it saves time and money.

5. Provide advanced video conferencing features

Popular messengers have restrictions on the number of video conference participants, with a maximum of 50 attendees in one video call from the Wire app. But what if you offer up to 100 attendees in video calls? For example, if you need to host virtual lectures for large classes or a corporate all-hands meeting for all the departments. It could be your killer feature, provided that you’ll deliver high-quality audio and video communication.

6. Enhance the "Note to self" with Pinterest-like boards

Feeling overwhelmed with the amount of content in this section, chances are, your users will appreciate built-in boards where they can collect links to useful podcasts, articles, videos, quotes, and social media posts. Later, they will be able to share their curated content with friends and colleagues via your instant messenger.

Mind Studios’ tip: The optimization of the app’s performance is not only about choosing the right tech stack, it’s also about strategic prioritization of features during the development process. That means, you first need to focus on core features such as encryption and communication stability and then move on to the additional ones like file sharing or group chats. This will allow you to make an encrypted chat app that is robust before layering more complex features that may result in security flaws later on.

How to secure a messaging app

Most instant messaging apps today use end-to-end encryption, meaning the encryption keys are stored at the ends, i.e. on users’ devices, instead of on the server. This makes it so that no one except you and your friend can read the messages. Not even the service provider who owns the server has access to them. And that’s a great feature that you need to incorporate into a messenger app when you build one.

However, it is equally important to know both the strengths and limitations of such a type of encryption when you decide to create an encrypted messaging app. Despite apparent reliability, end-to-end encryption has weak points. For example:

• Failure to recover message history in case a user changes/loses their device, and there was no server used for storing the chat history.
• Susceptibility to man-in-the-middle (MITM) attacks when skilled MITM hackers can intercept conversations, hack public keys, and — being recognized by the system as rightful recipients — even deliver forged messages.

To battle MITM attacks, prevent any form of data interception, and enhance security, you should consider advanced encryption protocols like the Double Ratchet Algorithm. Signal developers use this protocol to create session keys in addition to the public and private keys created when users install the app. Session keys are created for each message sent, and they self-destruct when the session is complete (i.e. when the message is received). Even if MITM attackers manage to obtain the key for one session, they won’t be able to decrypt all messages, giving you an extra layer of protection.

Different approaches to end-to-end encryption

Now, think beyond the message content. Metadata such as email address, phone number, date of birth, avatar, IP address, or date of last use can reveal no less sensitive information about all participants in your chat than messages themselves.

However, not all secure messaging apps are concerned about their users’ metadata protection.

For example, WhatsApp uses a version of Signal's encryption protocol that only encrypts the contents of messages. This means that WhatsApp— and, by extension, Facebook and anyone they decide to share the information with — can see who you're talking to, when, and from where.

The Signal app uses an updated protocol that encodes metadata as well, and no one — not even the app’s owners — can decode it without direct access to users’ devices. Besides, as per Signal’s Privacy Policy, almost no metadata is stored on their servers permanently — only as long as it takes for a message to be received. Then, everything except the date of the user's last login is deleted.

The two other messenger apps that do this are Telegram and Threema. However, in Telegram, end-to-end encryption is only applied in secret mode and not to all chats by default. General messages aren’t well-encrypted on Telegram. At least, Telegram refuses to share such information with anyone, be they governments or advertisers.

If you don’t know how to safeguard your users’ data when building a messaging app, reach out to us, and our expert will offer the best encryption option for your project.

Mind Studios’ tip: When building a secure messaging app, remember to consider the legal landscape of the target region. Different countries have different laws on data privacy, encryption, and communication tools. For example, when working on Chapp, we had to consider the restrictions on VoIP services for Middle Eastern countries and ensure that the app was legally sound from day one.

How to implement end-to-end encryption

There are several ways to implement end-to-end encryption chat. Usually, encrypted messages are stored on a messenger’s servers — cloud servers are more secure and thus recommended for this purpose — and decryption keys from a chat messenger decryption tool are only available from users’ devices to avoid a data breach in case the servers are hacked.

In the case of Chapp, we mitigated the risks of leaking information in a very unique way. The only time we used a thief-party server was for messaging routing. For this, together with our client, we chose a server located in Switzerland, which, as you may know, has very strict secrecy laws in the banking sector. Plus, it is outside the European Union, so it is not bound by GDPR (which has limitations in preventing individuals from accessing removed private information). What is more, our client constantly monitored FBI reports to evaluate Chapp’s security, ensuring its level of security is comparable to that of Signal.

It’s also possible not to store messages on your secure messaging servers completely and store them on users’ devices. But that means your users won’t be able to restore their message history in case the devices on which they’re logged in are lost or they delete the app. Syncing messages between devices will also be impossible.

Mind Studios’ recommendation: To create your own messenger like Signal, you can actually use the encrypted messaging API from Signal itself. Signal’s open-source encryption protocol is the most popular among developers building messengers, as it’s constantly peer-reviewed and audited.

As of the time of writing, the following messengers use Signal’s secure messaging protocol to encrypt the contents of their messages:

• WhatsApp
• Facebook Messenger (secret chats only)
• Skype (Private Conversations only)
• Google Messages for Android (SMS)

Telegram uses its own 256-bit symmetric AES encryption-based algorithm called MTProto for secret chats. This algorithm is closed-source, though, for which Telegram has been widely criticized.

Challenges of secure messaging application development

Well, up to this point, we’ve described in detail how to build an encrypted messaging app, so everything should now seem simple and clear to you.

However, we’d like you to be prepared for the main challenges that could emerge during your app development and have a clear plan of what to do if:

Chat crashes every time a media file is sent

Such flaws can occur when you create encrypted messaging app because, first, media files tend to be of a large size so their processing, transferring, and ciphering heavily loads the system; second, end-to-end encryption of these files implies a rejection of the encrypted chat server, meaning all processes will take place on the client-side.

Solution

To streamline the processes of data transmitting, coding, and decoding within your secure messenger, look closely at the algorithm that parallelizes encryption, decryption, and keystream creation.

App speed is far from perfect

In most cases, app speed also slows down due to the highly loaded client side.

Solution

In this case, it's vital to conduct load tests, find the most overloaded app spots, and later restore order in the client's internal database, reorganizing its structure.

Budget is being demolished by tons of forged verification messages

If you choose registration via a phone number as a method for users to sign up within your secure chat app, be ready to resist the attacks of numerous robot-bots once your app is brought to populous markets.

Solution

When you build a messaging app with encryption, we recommend using a smart captcha (reCAPTCHA). Its plugin will help you block IP addresses from which intrusive verification requests come, and thus will protect your budget.

Of course, that is not a full list of challenges you may encounter when you start building your secure messaging app. In case you want your development to be seamless and pitfall-free, you can always contact our team, and we will help you throughout the whole process.

Cost to make a secure messaging app

The cost to make an encrypted chat app, as well as any other app, depends heavily on the time required for the development. As far as the number of features goes, messengers don’t seem too complex;

Stage	Hours	Cost, USD
Business analysis and drafting a specification	96+	4,320
Prototyping and UI/UX design	168+	7,560
Developing an iOS client-side mobile app	960+	43,200
Backend development	520+	23,400
iOS app testing and Project Management	480+	21,600
Total	2,224+	100,080

Android development takes slightly less time than iOS development, but testing takes longer due to the wider variety of devices.

With this rough time estimate, the cost to build a secure messaging app for the iOS platform will start at $100,080 and will go up with extra features.

The Mind Studios experience

All the above-described challenges come from our experience working on a secure messaging app for the Middle East region. The solutions to those challenges were hard-won during our immersive brainstorming, both within the team and with the client.

In 2019, the task to develop a p2p encrypted messaging app for Android and iOS platforms seemed fascinating to us from the beginning. Most of all because the government authorities of most countries in the Middle East region have banned foreign VoIP instant messaging apps like WhatsApp, Viber, Skype, Facebook Messenger, and the like since 2013.

Thanks to our timely research, we identified the fierce competition among multiple secure chat apps trying to conquer this tricky market. With the help of our client and a thoroughly outlined target user profile, we came up with a key solution for the app's unique selling point. As a result, our secure messaging app offered users the opportunity to take care of their work-life balance, becoming a one-of-a-kind solution.

At present, this really secure instant messaging app has got more than 17,000 downloads and transmitted more than 366,000 messages. Inspired by a sense of achievement in developing the client-server secure IP-chat app, we’re now working on enriching it with other useful yet distinct features no popular messenger provides, as well as developing effective marketing campaigns.

Conclusion

Today’s messaging apps must provide a reliable way for users to communicate without the fear of their conversations being compromised.

Secure messengers are exceptionally important, and the demand for them is high today and will be higher tomorrow.

To build a messaging app, you’ll need developers experienced in this niche. Besides, your custom chat app will need to be not only secure but user-friendly. Balancing these requirements is no trifling matter. Still, with the right team, it’s possible.

Feel free to schedule a 45-minute consultation with our business development specialist right now to discuss all your project peculiarities.

6