How Secure Is WhatsApp’s Disappearing Messages Feature?

Poof, it's gone... Or maybe not

Key Takeaways

  • Users of the WhatsApp messaging service will now have the option to make their missives self-destruct. 
  • The disappearing message option matches similar features on apps such as Signal. 
  • Don’t rely on the disappearing messages to be completely private, experts say.
Disappearing messages on WhatsApp
WhatsApp 

The new disappearing message feature that WhatsApp is rolling out this month may not be completely secure, experts say. 

When the new option is enabled, messages will automatically be deleted after 7 days. It’s an attempt to match similar self-destructing message abilities in apps like Signal or Snapchat. But experts say, don’t think your private notes are necessarily gone forever. 

"You shouldn't rely on Disappearing Messages as being private," Matt Boddy, CTO, and Co-Founder of Traced Mobile Security said in an email interview. "Yes, it can add a degree of privacy to your messages, but they certainly aren't completely private. For example, the recipient could take a screenshot, copy, or forward the message before it disappears."

"Also, by default, media from WhatsApp messages are stored on a user's phone, including those from a Disappearing Message. Each user would have to change this setting to stop auto-downloading from WhatsApp." 

Disappearing Soon on a Screen Near You

Enabling the new feature is easy. Just tap the chat name at the top of the screen and scroll down to a new option for disappearing messages. Turning on this option doesn’t delete older messages, and either member of a chat can control the setting but in a group chat only administrators have control.

According to a FAQ post, the new feature will also delete any photos or videos after seven days. The disappearing message feature will be rolled out to all WhatsApp users this month, the company said. 

One possible use for the new feature is that "when journalists, activists, protesters, or other at-risk individuals are arrested by overreaching governments, there is an increased chance that sensitive private content will have been erased by the time police manage to access the contents of a device," Ray Walsh, Digital Privacy Expert at ProPrivacy, said in an email interview. 

Manhattan skyline in New York City and sky background with bubble chat icon overlays.
Prasit photo / Getty Images 

However, you’ll have to trust that WhatsApp is really deleting messages, says security expert Pieter VanIperen. "But then remind yourself that when you’re on the internet, it’s never gone forever," he said in an email interview.

"Because those messages still have a trail, can still be forwarded, copied, accidentally archived, and media auto-downloaded to your phone. On top of that, inexperienced users could use that feature to send sensitive information like a social security number or credit card information thinking it’s safe because the message disappears." 

More Secure Options Are Available

The new feature "seems to be focused only on the user experience, meaning that it wouldn't change the way WhatsApp is handling user data on their side," Michael Huth, Co-Founder, and CTO of XAIN and a professor researching cybersecurity at Imperial College London, said in an email interview.

"At first glance, it offers users a shiny new feature—which at closer look has its downsides, too—but it doesn’t solve the more serious problem of Facebook’s privacy-invading methods. Therefore, I still strongly recommend using other more secure messaging services such as Signal or Threema."

Disappearing messages offers less flexibility than its competitors, Huth points out. For example, there is no way to change the length of time messages are stored.

WhatsApp said on its blog that "we’re starting with seven days because we think it offers peace of mind that conversations aren’t permanent while remaining practical so you don’t forget what you were chatting about. The shopping list or store address you received a few days ago will be there while you need it, and then disappear after you don’t."

"But then remind yourself that when you’re on the internet, it’s never gone forever."

Compared with other end-to-end encrypted messaging apps, WhatsApp still doesn't measure up, Caleb Chen, the editor of Privacy News Online, said in an email interview. "Namely, the inability to set how long disappearing messages last for is disappointing but even beyond that, WhatsApp's parent company Facebook actively uses metadata from WhatsApp users for information gathering purposes—something that isn't done nearly as intensively by competitors," he added. 

For those who want to keep prying eyes off their correspondences, the new WhatsApp disappearing message ability is worth checking out. Just don't trust your darkest secrets with it.