Session

Session is an encrypted messenger that doesn’t ask for a phone number or an email address. It started as a fork of Signal’s Android app, and its code still carries Signal’s copyright lines. Since October 2024 it has been run by the Session Technology Foundation in Switzerland; the Australian foundation that ran it before cited “the current regulatory environment in Australia around privacy technology and encrypted messaging” for the move. It is actively developed.

How it works

• No phone number. Your identity is an Account ID, with a recovery password that is the only way to restore it.
• No central message server. Messages wait encrypted on groups of servers called service nodes, and the app reaches them through onion routing: three hops, so that, as the app puts it, it “hides your IP by routing your messages through multiple service nodes”.
• Messages expire from the network after 14 days, which matters when you restore an account on a new phone.
• One-to-one chats, groups and open communities, and voice and video calls, which are a beta feature and off by default. The app warns that during calls “Your IP is visible to your call partner and a Session Foundation server”.
• Options to disguise the app icon as a calculator, notes, weather and others.

Notifications: Fast Mode and Slow Mode

During setup Session asks how to deliver notifications. Fast Mode uses Google’s Firebase Cloud Messaging; Session registers with its own push server, and a maintainer says Google’s service sees “just that a notification needs to be sent”, not the content. It is preselected on phones with Google Play services. Slow Mode checks the network every 15 minutes or so in the background, and Session asks once to be exempted from battery optimisation for it. That background check runs in both modes.

What goes online

• Always: Session’s seed servers, contacted directly to find the network, and its service nodes, through onion routing.
• Its file server, also through onion routing, for attachments and profile pictures and a version check every four hours.
• Google’s Firebase Cloud Messaging, in Fast Mode. From our reading of the code, the app most likely also asks Firebase for a token in Slow Mode, when the network comes back, on phones that have Google Play services.
• Only when you use them: GIF search, which goes to Giphy through Signal’s proxy server, with a warning that you “will not have full metadata protection”; link previews, off by default, which load the linked page directly; calls through Session’s relay servers.

The app’s manifest switches off Firebase Analytics, Crashlytics and Google’s advertising-ID collection, and our scan found no tracking libraries.

About this file

• This is the Google Play edition of version 1.33.7 from the project’s GitHub release, session-1.33.7-universal-play-release.apk, signed with the certificate Session has used since 2019, issued to “Loki Project”. Its hash is listed in the release’s signature.asc, which carries the GPG signature of the person who signs Session’s releases. The same release’s Huawei APK uses a different key and can’t update this one.
• It contains Firebase Cloud Messaging for Fast Mode, Google Play Billing and Play’s in-app review. Exodus’s tracker list doesn’t include Cloud Messaging, which is why the scan shows none. The billing is for Session Pro, a paid plan from $2.99 a month that version 1.33.7 switches off by default.
• The 125.0 MB file runs on Android 8.0 and later, on ARM and x86, 32- and 64-bit, and declares 37 permissions. Most are for calls, voice messages and attachments; one is Google’s push permission.
• Session is licensed under the GPL-3.0; its icon font, Lucide, under the ISC licence. It also bundles emoji images in Apple’s style, inherited from Signal, and MaxMind’s GeoLite2 country data for showing where onion paths run; the repository states no licence for either.
• The project’s store images are marketing pictures rather than screenshots, so we don’t show them.

CPU types in this build: arm64-v8a (64-bit ARM, almost every phone since 2017); armeabi-v7a (32-bit ARM, older and budget phones); x86 (32-bit Intel, emulators); x86_64 (64-bit Intel, emulators and Chromebooks).

Recent releases on the project’s GitHub. We host and check only the newest one. Full changelog.