Software

Mobile Apps

personally tested


Threema. Secure Messenger

Secure. Anonymous. Private.

Introduction

Initially, the three Swiss founders of Threema called their messenger EEEMA (End-to-End-Encryption Messenger App). A bit unwieldy, so they renamed it: Three (times) EEE = Three + messenger app = Threema.
03.08.2022: Threema is now also available as a Libre version!
There is not a single line of code in Threema Libre that requires a proprietary software library from Google or other third parties.

Developer

Threema GmbH

Purchase Date

23.12.2020 for 1.99 EUR at Apple's App Store for my iPhone 11 Pro.
Threema apps are open source since 21.12.2020!
Threema is celebrating it with 50% discount until 28.12.2020.
17.09.2021 for 3.99 EUR at Threema's Onlineshop for my Fairphone 3+.

Purchase Price

5.99 EUR for Android smartphones/tablets in Googles Play Store
5.99 EUR for iPhones and iPads in Apples App Store
4.99 EUR for Android smartphones without Google in Threema's Shop
(no subscription, no advertising! You do not pay with your personal data)

New since 03.08.2022: Threema Libre – read FAQ at Threema
4.99 EUR for Android smartphones without Google:
Buy a licence in Threema's Shop, but download at F-Droid

New since 28.09.2023: Pay Threema anonymously with cash

Rating

**** 4 stars

System Requirements

• iOS or iPadOS from vers. 15.0 upwards
• Android OS from vers. 5.0 upwards
• Harmony OS from vers. 5.0 upwards

Compatible with:
• iPhone, iPad and iPod touch
• Android Smartphones/Tablets
• Huawei Smartphones/Tablets

Languages

English, German, Basque (Spain) (iOS), Chinese (traditional and simplified), French, Dutch, Italian, Japanese, Catalan (Android), Norwegian (Bokmål), Polish, Portuguese (Brazil), Romansh, Russian, Spanish, Slovak, Czech, Turkish, Ukrainian, Hungarian, Belarusian

Support

Help competent & friendly by
Threema Support Page (FAQ)
Threema Forum
• Threema-Messenger (*SUPPORT)
• Threema Support Contact form
• E-Mail
Please read the FAQs first and then register in the forum and ask questions. I myself am one of the many active forum members who are quick to help and offer advice and support there.
This way, most open questions can be clarified in advance and we keep the Threema team's back free for real problem cases. Augenzwinkernder Smiley

Features

  • Chats and voice messages
  • Groups and mailing lists (the latter Android only)
  • Share files, media and locations
  • handy survey function
  • Voice and video calls
  • agree/disagree without Push Notification
  • light or dark design according to taste
  • also optimised for tablets, can be used without SIM card
  • text formatting as you like
  • Quote function
  • contact verification via QR code to protect against MitM attacks
  • Personal data unnecessary, telephone number superfluous
  • Telephone number/e-mail address can be stored if desired in order to be found
  • Contact synchronisation optional, no address book access required
  • Backup

Practice

23.12.2020: As of today, I use Threema – on my iPhone 11 Pro.

17.09.2021: Bought a licence in the Threema shop for system change to Fairphone 3+ with /e/OS. Chats and media can only be transferred when switching within the same ecosystem. But with Threema Safe I can transfer ID, contacts, groups and privacy settings. I exported chats and media as encrypted files to an external SSD to read them on the MacBook if needed.

10.12.2021: App move including data (backup + restore) to Fairphone 4.
Use my old iPhone Xs for testing with separate Threema ID. If someone in the Threema forum describes a previously unknown problem, I may be able to recreate it and help.

05.08.2022: The change from the shop version to the Libre version was quite simple. It is important to make regular data backups.

04.09.2022: Tonight my iPhone 11 Pro Max becomes main device again.
I am not satisfied with my Fairphone 4, so I export all chats as encrypted files and e-mail them to my own e-mail account at Tutanota, because I have extra storage space there and everything is end-to-end encrypted.
Then I install Threema from Apple's App Store on iPhone. Unfortunately, you can't move chat histories when you change systems, but if I want to read an old chat history, I can decrypt the archive file and read it on my MacBook. Thanks to Threema Safe, Threema ID (incl. public & private key), nickname, profile picture, contacts (incl. trust level) and group memberships are retained.

16.09.2022: Moving the Threema client from the iPhone 11 Pro Max to my new main device iPhone 14 Pro Max via “Apple Quickstart”. I read in Threema's FAQ that I should do an ID export. I had already done this yesterday as a precaution. I had saved the password for it in my password manager. I was surprised that the generated character string of the ID export changes with every export. I therefore did an ID export twice more and also remembered these passwords for it …

Three hours later, “Quick Start” (1:1 copy to the new iPhone) is ready and I start the Threema client on the iPhone 14 Pro Max for the first time …
As described in the FAQ, I enter the password for the exported ID and it is not accepted! So I try the second password, because I had used different passwords for my three ID exports – but this is not accepted either! OMG smiley
Before panic sets in, I calm down again, read the dialogue text again before the third attempt and see that it also works without ID export … I try this variant and everything works like clockwork. Teeth Smiley

14.03.2023: Now I'm using my licence from the Threema shop again – on a new Google Pixel 7 Pro with GrapheneOS.
I transfer Threema ID, contacts, groups and privacy settings via Threema Safe from my iPhone 14 Pro Max to my Pixel 7 Pro. I export chats and media as encrypted files and email them to my Tuta inbox (end-to-end encrypted mail archive).

14.11.2023: Moving Threema Libre app from Pixel 7 Pro to Pixel 8 Pro. To prevent new incoming messages from landing on the Pixel 7 Pro, I switch it temporary to flight mode.
One last complete data backup with media secures the phone change. This should be done with charger or USB charging cable connected, as most smartphones have very aggressive power-saving methods that disturbs the backup process.
As I have little data to back up and GrapheneOS does not use any power-saving tricks (does not kill any active apps in the background), I back up this time without charging the battery in parallel. It takes less than a minute. Then I email the encrypted backup file to myself via Tuta, where I have enough storage space and everything is end-to-end encrypted.
After Threema Libre has been installed on Pixel 8 Pro and the data backup has been imported without errors, I delete Threema ID and the chats on Pixel 7 Pro, then the app itself (may only be installed on one device).

31.01.2024: I realised that the Threema app must be the cause of higher energy consumption compared to my Pixel 7 Pro. One last backup, then I delete Threema Libre from the Pixel 8 Pro.
Use Threema again on my Pixel 7 Pro: Because the update to the new Libre version (5.2.3l) is already a week overdue, I install the shop version (5.2.3) this time. Two advantages:
1. new versions promptly directly from the Threema server.
2. updates are announced in the app and will be installed directly after confirmation.

Telephony

28.11.2022: 1. voice call via Threema. 50 minutes of mediocre quality with three dropped calls. I imagined it would be better, but it could be due to the mobile network. Today the internet connection is worse than usual.

03.12.2022: 2. voice call via Threema: around 10 minutes with echoes, many drop-outs and a complete interruption of the call make a longer conversation completely impossible. Fortunately, I was able to make a call via Session for 2 hours directly beforehand with almost no interference. Session apparently copes better than Threema with the currently poor internet connection due to construction work on mobile network. Or the interference got worse and we were still lucky with the first call.

30.12.2022: 3. voice call via Threema: crystal-clear connection from the first moment without any interference – call interrupted after 1:12 h. My contact calls back immediately; we talk undisturbed for another 15 minutes. The call interruption was probably due to Telefónica on my side. Perhaps the upgrade of the base stations with 5G is not quite finished yet or the base station actually responsible for me was overloaded and the nearest one has once again stepped in as a substitute …

17.01.2023: 4. voice call via Threema: 1:25 h long without interruption in good quality. Super on my side, but not as excellent for my counterpart, but good.

27.01.2023: 5. voice call via Threema: 2:12 h uninterrupted in great quality – after one hour two short word interruptions, otherwise trouble-free.

08.02.2023: 6. voice call via Threema: 18 minutes: abandoned after 13 minutes in poor quality, ended after another 5 minutes.

In the meantime, I have made many more Threema calls (also with Pixel 7 Pro and Pixel 8 Pro). All of them were trouble-free in HD quality (with verified contact, i.e. not via Threema's server, but directly from app to app via the internet, technical term: peer-to-peer).

Pros

  • Security and Privacy by Design
  • End-to-end encryption throughout
  • since 27.12.2022 PFS also for chat messages (Threema's version is called Ibex)
  • high level of metadata sparseness
  • Open Source and external audits (see Reference)
  • no proprietary software library from Google or other third parties (Libre version)
  • anonymous use, no central user account required
  • if you grant access to the address book in order to automatically enter the Threema IDs of your address book contacts into Threema, the contact data will only be transmitted in one-way encryption and will not be stored on any data medium at any time
  • strong encryption on the device
  • chats, contact lists and groups are managed exclusively decentrally on the participating devices, no storage on a server. In this respect, Threema differs significantly from conventional messengers
  • Backup function available
  • comfortable typing on large keyboard with Threema Desktop/Web

Cons

  • centralised server – total failure of the service in the event of a fault
  • utmost caution is advised when contacting, as the name given may be false
    (Threema ID is not the public key; extra matching required for security)
  • FAQ urgently needs to be updated (topics with deficits: Backup and Moving)
  • Apple's new software policies make Threema Desktop/Web quasi unusable
  • when changing systems (Android OS <-> Apple iOS) loss of chat history
  • only the client software is open source, not the software on the server

Conclusion

I have never regretted switching from Signal to Threema!
I've been using Threema for three years and am very satisfied.

Under Android OS, data backups can be started directly from the app. You can choose between a complete backup with media (photos, videos, etc.) or a faster, data-saving backup without media.
Under iOS, complete backups are always created by creating an encrypted iPhone backup.
In this way, Threema serves each target group differently, but optimally.
Tinkerers and individualists tend to use Android and want full control, while most Apple users like it comfortable and simple.

Threema makes optimal use of Apple's quick-start function for moving from the old to a new iPhone. Perfect & easy 1:1 copy. Thumbs up!

Unfortunately, Apple has tightened its software guidelines to the detriment of users: until now, you could leave your smartphone somewhere (or leave the device in your backpack to acclimatise when coming in from the cold) and start Threema's desktop or web version on your PC and be accessible (provided you had previously linked it).
Now, to use Threema Desktop/Web, you have to unlock the smartphone and run the Threema client in the foreground!
This also increases the energy consumption of the smartphone.
In principle, I think this protective function is very good, because no one can be spied on unnoticed. But Apple has completely overshot the mark here or has only realised the idea half-heartedly.
Users should be able to give an app permission to synchronise with an external app in the background when the screen is locked, as the Threema client for Threema Desktop/Web requires.

Security experts recommend Threema as a secure messenger.

Important Tips

Android OS

  • keep Threema's e-mail with the licence key from the purchase in the shop safe!
  • keep all passwords and IDs safe, use a password safe, e.g. KeePassDX or Bitwarden
  • regular complete data backup, simply while the battery is charging via USB cable
  • never configure a memory card as internal memory extension – very high risk of data loss!
  • do not save incoming pictures and videos and outgoing camera pictures in Android's gallery

Apple iOS/iPadOS

  • keep all passwords and IDs safe, use a password safe, e.g. Strongbox or Bitwarden
  • regular complete data backup, simply while the battery is charging via USB cable
  • do not save incoming pictures and videos and outgoing camera pictures in Android's gallery

General

  • data security stands and falls with the master password of the password safe!

Alternatives

  • Session has a very robust decentralised server infrastructure
  • SimpleX Chat combines all advantages of Threema + Session

Reference

Threema: Which operating systems and devices are supported

P. Gerhart, P. Rösler & D. Schröder: Security of Ibex (PDF)

heise.de: iMessage: Better rewrite code completely (German)

Mark Williams: Secure Messaging Apps Comparison (Table & Blog)

Mike Kuketz: Messenger: Threema client now open source (German)

Cure53: Pentest- & Audit-Report Threema Mobile Apps (PDF)

TWiT Tech Podcast: Threema Goes Open-Source

Keyword list: Advantages, Alternatives, Android, Apple iOS, Apps, Blog, Chat, Client, Conclusion, Cons, Download, E-Mail, End-to-end-Encryption, End-to-end encryption, F-Droid, FAQ, Fairphone 3, Groups, Help, History, IT, Internet, Memory Card, Mobile Apps, Network, Open Source, PC, PDF, PFS, Pixel 7 Pro, Pixel 8 Pro, Privacy, Pros, SIM, Server, Service, Smartphone, Smartphones, Software, Storage, Telephony, Threema, Tips, Tricks, Tutanota, USB, Update, User, Who, iPhone, public key, report

Last edited: