Encrypted Text Messaging: SMS, RCS, and Secure Apps

The short answer: standard SMS text messages are not encrypted end to end. An SMS may be protected on the radio link between your phone and the nearest tower, but as it travels through carrier networks and messaging infrastructure it can exist in readable form, accessible to carriers and, under legal process, to others. RCS and consumer apps such as Signal and iMessage offer stronger protection in specific configurations. Understanding exactly what each channel protects, and what it does not, is the foundation of any sensible messaging policy.

This guide compares the encryption status of SMS, RCS, and secure messaging apps in plain language, then explains what organizations that text the public should actually do about it.

What Encryption Means in Messaging

Two different protections get lumped under the word "encrypted," and the difference is everything:

Encryption in transit scrambles a message while it moves between two points, for example between your phone and a cell tower, or between two servers. The systems at each hop can still read the message; only eavesdroppers on the wire are shut out.
End-to-end encryption scrambles a message on the sender's device and only the recipient's device can unscramble it. No intermediary, not the app maker, not the carrier, not a server operator, can read the content in the middle.

A channel can have the first without the second. SMS is the textbook example.

SMS: Not Encrypted on the Carrier Network

SMS was designed in the 1980s as a signaling byproduct, decades before modern security expectations. Its protections are thin:

The radio link may be encrypted. The over-the-air hop between a handset and the tower typically uses cellular encryption, though older network generations used ciphers that are now considered weak.
The core network is not end-to-end protected. Once inside carrier infrastructure, messages traverse signaling systems (including the legacy SS7 network) and can be stored and processed in readable form. Carriers can access message content, and lawful intercept frameworks require that they be able to produce it under valid legal process.
Interconnection is a weak point. Messages crossing between carriers, aggregators, and international gateways pass through systems of varying security, and SS7 vulnerabilities have been publicly documented for years.

None of this means SMS is useless; it means SMS should be treated as a channel where content confidentiality cannot be guaranteed. That single assumption drives every recommendation later in this article. It is also why security professionals have pushed to move one-time passcodes and account recovery away from SMS where higher-assurance options exist.

RCS: Better, but It Depends on the Configuration

Rich Communication Services (RCS) is the successor protocol to SMS, adding typing indicators, high-resolution media, and better group messaging. Its encryption story is more complicated than a yes or no:

The base RCS standard does not require end-to-end encryption. Baseline RCS traffic is encrypted in transit between clients and servers, but servers in the middle can process content.
Some implementations layer end-to-end encryption on top. Google's messaging client added end-to-end encryption for eligible RCS conversations between supported clients, and the industry has been working through the GSMA to standardize end-to-end encryption for cross-platform RCS.
Fallback erases the gains. When one party's device, carrier, or app does not support the encrypted mode, conversations silently fall back to unencrypted RCS or to plain SMS. The sender often cannot tell in advance.

The practical takeaway: RCS can be end-to-end encrypted in specific app-to-app configurations, but no organization should assume a message it sends will travel encrypted end to end, because delivery paths and fallback behavior are outside the sender's control. For a fuller comparison of the two protocols from an organizational standpoint, see our guide to RCS vs. SMS for organizations.

Secure Messaging Apps: Where End-to-End Encryption Lives

Consumer messaging apps are where end-to-end encryption is the norm rather than the exception. As a general industry fact:

Signal applies end-to-end encryption to all messages and calls by default, using the open-source Signal Protocol that independent researchers have reviewed extensively.
iMessage end-to-end encrypts messages between Apple devices (the blue-bubble conversations). When an iPhone user texts an Android user over SMS, that green-bubble traffic is ordinary unencrypted SMS.
WhatsApp also applies end-to-end encryption by default using the Signal Protocol.

These apps achieve strong confidentiality because both endpoints run the same software and exchange cryptographic keys directly. That is precisely the property SMS lacks: SMS must work on every handset ever made, over every carrier, with no shared app on both ends. The universality that makes SMS reach everyone is the same property that prevents it from being end-to-end encrypted.

For organizations, however, secure apps have a reach problem. You cannot require every parent, patient, donor, or resident to install a specific app. This is why organizational messaging strategy is not "switch to Signal" but "use SMS wisely."

Comparison at a Glance

Channel	Encrypted in transit	End-to-end encrypted	Reaches every phone
SMS	Partially (radio link; not across the core network)	No	Yes
RCS (baseline)	Yes (client to server)	No	No (support varies)
RCS (supported app-to-app modes)	Yes	Yes, in eligible configurations with silent fallback risk	No
Signal / WhatsApp	Yes	Yes, by default	No (app required)
iMessage (Apple to Apple)	Yes	Yes	No (Apple devices only)

What Organizations Should Do Instead

If your organization texts the public, the answer to "SMS is not end-to-end encrypted" is not to abandon texting. It is to design around the limitation:

Keep sensitive content out of the message body. Treat every SMS as potentially readable in the middle. Appointment reminders, deadlines, links, and confirmations work well; diagnoses, account numbers, and case details do not belong in a text.
Use the notification-plus-portal pattern. Send a neutral text ("You have a new message from your care team") that directs the recipient to authenticate into a secure portal where the sensitive content lives behind encryption and access controls. The text carries no confidential payload; the portal does the confidential work.
Match the channel to the regulation. Healthcare organizations operating under HIPAA (45 CFR Parts 160/164) must apply the Security Rule's risk analysis to any channel carrying electronic protected health information, and HHS guidance permits texting patients who have been warned of the risks and prefer it, with safeguards and documentation. Our companion piece on secure texting in healthcare covers that framework in depth.
Demand platform-level safeguards. The platform side of the conversation is fully controllable even when the carrier network is not: encryption of data at rest and in transit on the platform, role-based access controls, audit logs, session timeouts, and a signed BAA included where HIPAA applies. FRANSiS documents its safeguards on its security page.
Write it down. A short messaging policy stating what may and may not be sent by SMS, who approves templates, and how consent and opt-outs are handled turns good intentions into consistent practice.
Train staff on the boundary. Most messaging exposure comes not from interception but from someone pasting sensitive details into a text because it was convenient. A one-page rule sheet with examples of acceptable and unacceptable message content prevents the vast majority of incidents, and periodic template reviews catch drift before it becomes habit.

Frequently Asked Questions

Are text messages encrypted?

Standard SMS messages are not end-to-end encrypted. The radio link between a phone and the tower is typically encrypted, but messages can exist in readable form inside carrier networks and messaging infrastructure. RCS and apps like Signal or iMessage provide stronger protection in specific configurations.

Is RCS end-to-end encrypted?

Not universally. The baseline RCS standard encrypts traffic in transit but not end to end. Some app-to-app configurations add end-to-end encryption between supported clients, and cross-platform standardization has been underway, but conversations silently fall back to unencrypted RCS or SMS when either side lacks support.

Which messaging apps use end-to-end encryption?

As a general industry matter, Signal and WhatsApp apply end-to-end encryption to messages by default, and iMessage end-to-end encrypts conversations between Apple devices. When any of these fall back to SMS, that fallback traffic is not end-to-end encrypted.

Can organizations send encrypted texts to customers or patients?

Not over standard SMS, because SMS cannot deliver end-to-end encryption to an ordinary phone number. Organizations instead keep sensitive content out of message bodies and use texts to direct recipients into secure, authenticated portals where confidential information is protected by encryption and access controls.

Is it safe to text patients under HIPAA if SMS is not encrypted?

It can be done in a compliant way with the right framework. HIPAA (45 CFR Parts 160/164) requires a risk analysis and safeguards; HHS guidance permits texting patients who have been informed of the risks and prefer text, with documentation. Most covered entities minimize protected health information in message bodies and use a platform that supports HIPAA compliance with a signed BAA included.

Text Confidently Without Compromising Security

FRANSiS gives nonprofits, healthcare organizations, schools, and government agencies a texting platform built around the notification-plus-portal model: platform-level encryption safeguards, access controls, audit trails, a signed BAA included where HIPAA applies, and an AI Powered Helper that keeps conversations helpful without putting sensitive data in the message body. Contact us to see how it works.