Comparison
RVNT vs Session
RVNT: A peer-to-peer, post-quantum, end-to-end-encrypted messenger with no phone number and no servers. · Session: A no-phone-number, onion-routed messenger that hides your IP and metadata by default — strong on anonymity, but its currently-shipping protocol still lacks forward secrecy.
Bottom line: Choose Session if you want a proven, audited, widely-used app with strong IP/metadata anonymity that works reliably today and reaches people who are offline — it is the safer pick for most people right now precisely because it is mature and battle-tested. Choose RVNT if you specifically want forward secrecy and post-quantum encryption shipping today, on-device duress protection, and a fully P2P design — but accept that RVNT is young and unaudited, so it is best for users comfortable being early adopters rather than those needing a track record.
Session and RVNT share a privacy-first, no-phone-number philosophy and both onion-route/anonymize by default, but they sit at very different points of maturity. Session wins decisively on track record: it is independently audited (Quarkslab, 2021), runs a large live service-node network that stores-and-forwards your messages while you're offline, and ships stable, polished apps across iOS, Android, and desktop. RVNT is pre-release and unaudited. Where RVNT aims ahead is on the cryptographic spec: RVNT's shipping protocol is hybrid post-quantum (X25519 + ML-KEM-768) with a Double Ratchet for forward secrecy today, whereas Session's currently-deployed protocol still lacks forward secrecy and its post-quantum/PFS upgrade (Protocol V2) is announced but not yet live. RVNT also adds on-device duress defenses (decoy PIN, panic wipe) and a mixnet that Session doesn't match. Note one terminology difference: Session uses its own Tor-like onion network, while RVNT routes over Tor itself by default.
The facts, side by side
| RVNT | Session | |
|---|---|---|
| End-to-end encrypted by default | Yes | Yes |
| Encryption protocol | Hybrid post-quantum X3DH (X25519 + ML-KEM-768) + Double Ratchet, AES-256-GCM | Session Protocol (libsodium: X25519 key exchange + AES-256-GCM AEAD; Ed25519 identity keys) Session migrated off the Signal Protocol to its own libsodium-based Session Protocol. The current shipping protocol notably lacks Perfect Forward Secrecy and cryptographic deniability; PFS is slated to be re-implemented in Protocol V2 (announced Dec 2025), which is not yet released. |
| Post-quantum key exchange | Yes | No Session's currently-shipping protocol (V1) contains NO post-quantum cryptography at all. Per Session's own documentation, V1 encrypts messages with X25519 ECDH + AES-256-GCM and has neither forward secrecy nor any PQ key exchange. Post-quantum (ML-KEM) is a feature of the as-yet-unreleased Session Protocol V2, which is still in design; a detailed spec is only promised for community review in 2026 and is not in the released app. 'partial' wrongly implies an opt-in or shipping PQ capability; the correct tri-state is 'no' (with a factNote that V2 plans to add ML-KEM-based PQ key exchange, targeted for spec release in 2026). This is also consistent with the entry's own oneLiner, which already concedes the currently-shipping protocol lacks forward secrecy. |
| Requires a phone number | No | No |
| Requires an email address | No | No |
| How you’re identified | Local Ed25519 keypair, username claimed by proof-of-work | Random Account ID (Session ID): a 66-character hex string derived from an Ed25519/X25519 keypair generated on-device. Recovery via a 13-word seed phrase. No phone, email, or KYC. The Session ID is the long-term public identifier and is reused across all conversations, which has some metadata/linkability implications compared to per-conversation identifiers. |
| Architecture | peer-to-peer | onion-relay Not pure peer-to-peer and not a single central server. Messages are stored-and-forwarded through a permissionless, blockchain-incentivized network of community-run service nodes, reached via onion routing — closest to an onion-relay model. |
| Metadata protection | Sealed sender + Tor by default + mixnet (cover traffic, fixed-size padding) | Strong: onion-routed by default through a decentralized service-node network (onion requests), hiding sender IP; no central account directory; project states it collects no metadata, geolocation, or device/network data. |
| Routes over Tor by default | Yes | No Session does NOT use Tor. It uses its own Tor-like onion-routing system ('onion requests') over its decentralized Session Network service nodes (formerly the Oxen/Lokinet network). Onion routing IS on by default, but it is a separate network from Tor. |
| Open-source client | Yes | Yes |
| Independently audited | No RVNT is pre-release and has not yet completed a formal third-party security audit — the code is open source so it can be reviewed, but treat it as not-yet-audited. | Yes Audited by Quarkslab in 2021, covering the desktop, Android, and iOS clients. The newer Protocol V2 / post-quantum and PFS work has not yet been independently audited as of early 2026. |
| Jurisdiction / who can be subpoenaed | Peer-to-peer (no central operator to subpoena) There is no company-run server that relays or stores message content, so there is no inbox in a data center to subpoena. A small bootstrap server only holds public prekeys + peer-discovery data. | Switzerland (Session Technology Foundation), relocated from Australia in 2024 The Session Technology Foundation was established in Switzerland in 2024 after the prior Australian steward (OPTF) stepped back, reportedly amid Australian law-enforcement and e-safety pressure on encrypted apps. |
| On-device duress / panic defenses | Yes | No Session offers a screen-lock/PIN and a recovery-password model, but no documented duress-PIN decoy vault or panic-wipe feature comparable to RVNT's. |
| Max attachment size | No limit on a direct link (P2P streaming) No size limit on a direct peer-to-peer connection (segmented streaming with resume-on-disconnect). Transfers that fall back to a relay are currently capped at 256 MB until resumable relay ships. | 10 MB |
| Collects telemetry / analytics | No | No |
The verdict
Choose Session if you want a proven, audited, widely-used app with strong IP/metadata anonymity that works reliably today and reaches people who are offline — it is the safer pick for most people right now precisely because it is mature and battle-tested. Choose RVNT if you specifically want forward secrecy and post-quantum encryption shipping today, on-device duress protection, and a fully P2P design — but accept that RVNT is young and unaudited, so it is best for users comfortable being early adopters rather than those needing a track record.
Frequently asked questions
Is Session more private than RVNT?
It depends on what you mean by private. Session is more proven — it's been independently audited and has IP-hiding onion routing on by default for years. But on the cryptographic protocol itself, RVNT currently goes further: RVNT ships forward secrecy (Double Ratchet) and hybrid post-quantum encryption today, while Session's deployed protocol still lacks forward secrecy and its post-quantum upgrade (Protocol V2) is announced but not yet released. Both avoid phone numbers and central content servers.
Does Session need my phone number?
No. Session requires neither a phone number nor an email. You get a randomly generated Account ID (Session ID) created on your device, with a 13-word recovery phrase to restore it. This is the same no-phone, no-email model RVNT uses.
Does Session route over Tor like RVNT?
Not Tor specifically. Session uses its own Tor-like onion-routing system ('onion requests') across its decentralized service-node network, which is on by default and hides your IP. RVNT routes over the actual Tor network by default and adds a mixnet. Both aim to conceal your IP and metadata; they just use different underlying networks.
Has Session been security audited?
Yes. The Session desktop, Android, and iOS clients were independently audited by Quarkslab in 2021. That's a real advantage over RVNT, which is pre-release and has not yet been independently audited. Note that Session's newer Protocol V2 (forward secrecy and post-quantum) work had not been independently audited as of early 2026.
Comparisons here are kept honest and dated — we name where the other app wins. RVNT is the post-quantum, peer-to-peer option with no phone number and no servers.