Graphite vs Session: A Fair Comparison (2026)

If you're weighing Graphite vs Session, you're already asking the right question: which metadata-free messenger fits how you actually work? Both drop the phone number, both hide your network path, and both keep your identity on your device. Where they differ is in the routing layer, the desktop story, and how plainly each app states its encryption. This guide compares them side by side, honestly.

The short version

Session and Graphite share the same core promise: no phone number, no email, no account on a server that can be subpoenaed. They both hide your IP by routing traffic over an anonymity network. The practical differences come down to four things:

• Routing: Session uses its own onion-routing network. Graphite uses Tor by default, fail-closed — the same anonymity network used by journalists and researchers worldwide.
• Desktop: Graphite ships a native, portable Windows client with Tor bundled. No install, no dependencies, no browser tab.
• Encryption, stated plainly: Graphite documents forward secrecy (Signal-style double ratchet) and a post-quantum layer (ML-KEM-768) up front.
• Calls: Graphite includes encrypted voice and video calls.

Neither of these is a knock on Session — it's a well-regarded app with a clear design. But if you want Tor specifically, a proper desktop app, or plainly stated post-quantum crypto, Graphite is built for that.

What Session gets right

Session's pitch is refreshingly simple: sign up without giving anything away. No SIM, no email, no directory to be looked up in. Instead of an account, you get a random ID; instead of a plaintext server hop, your messages travel through an onion-routed service-node network so the servers passing them along can't see who you are or where you're connecting from. It's open source and has been independently reviewed over the years.

For a lot of people, that combination — no personal identifier plus network-level privacy — is enough. If it works for your threat model and your devices, it works.

We deliberately don't characterise Session's internal cryptography in detail here. Those specifics evolve, and Session's own documentation is the right source. What we can compare cleanly is the model: identity, network, platforms, and calling.

Side-by-side

What matters	Session	Graphite
Phone number to sign up	No	No
Identity	Random account ID	12-word recovery phrase, generated on device
Server-side account	No	No — relay holds no recovery secret, no phone, no email
Hides your IP / network	Yes, onion-routed service network	Yes, Tor by default (fail-closed)
Forward secrecy	See Session's docs	Yes — Signal-style double ratchet
Post-quantum layer	See Session's docs	Yes — ML-KEM-768 (hybrid)
Encrypted voice & video calls	Text-focused	Yes
Native Windows desktop	Electron-based desktop client	Portable .exe with Tor bundled — no install
Android on de-Googled phones	Yes	Yes — sideloadable APK, no Google Play Services needed
Message retention on the relay	Not applicable in the same way	Max 7 days, deleted after delivery
Price	Free	Free (public beta)

The "see Session's docs" cells are intentional — we're not going to paraphrase properties we can't state precisely. On everything else, the pattern is clear.

Where Graphite is different

Tor by default, fail-closed

Session runs its own onion network built around service nodes. Graphite uses Tor — the anonymity network with the largest public network of relays and the most independent scrutiny. Graphite bundles Tor and connects to a hidden service by default. If Tor is unavailable, Graphite fails closed: it does not silently fall back to a clearnet connection. Signalling and messages travel over Tor.

For live calls, real-time media uses peer-to-peer DTLS-SRTP rather than Tor (latency would make Tor unusable for voice), and on mobile those calls are routed so the other person doesn't see your IP.

If you want more background, our Tor messaging explainer walks through how this works.

A real Windows client

If you live on a desktop, this is often the deciding factor. Graphite for Windows is a portable .exe with Tor bundled — download it, run it, and you're connected. There's no installer, no admin rights, no separate Tor setup. You can drop it on a USB stick and take it with you.

Our guide to an encrypted messenger for Windows desktop covers why a native desktop client matters and what to look for.

Encryption, plainly stated

Graphite uses NaCl/libsodium X25519 sealed boxes for envelopes, a Signal-style double ratchet for forward secrecy, and a hybrid post-quantum layer using ML-KEM-768 to hedge against "harvest now, decrypt later" attacks. You don't have to infer any of this — it's stated up front.

Encrypted voice and video, groups, files, on-device search

Session is primarily a text messenger. Graphite adds encrypted 1:1 and group voice/video calls, encrypted group chats and file sharing, and AI-assisted message search that runs entirely on your device — nothing about your messages is uploaded to run search.

A minimal relay

Graphite's relay only ever sees sealed ciphertext. It holds no recovery secret, no phone number, no email, and no plaintext. Messages sit for a maximum of seven days and are deleted after delivery. There's no account object to leak, subpoena, or tie back to you.

Where Session may still fit you better

Be honest with yourself about your priorities:

• You already like Session's network. If the service-node model is what drew you in and you're happy with it, that's a legitimate reason to stay.
• You're purely a mobile, text-only user. Session's text-first design is deliberately minimal, and that simplicity is a feature.
• You want a mature, long-established app. Session has been around for years and has a stable user base.

Choosing the right messenger is about matching the tool to your life, not chasing feature checklists.

Migrating from Session to Graphite

If you decide to switch, the migration is genuinely simple because there's no account to transfer:

1. Download Graphite — grab the Windows .exe or the Android APK from graphite.chat.
2. Generate your 12 words on first launch. Store them somewhere only you can reach. There is no cloud copy — losing them means losing access.
3. Share your public identifier with the people you want to talk to. Verify safety numbers in person or over a channel you already trust.
4. Keep Session installed briefly while you migrate conversations. There's no rush.

That's it. No SIM to swap, no email to confirm, no support ticket needed.

Choosing

If Session appealed to you because it never asked for a phone number and hid your network path, you don't have to give up either to get Tor specifically, a proper Windows desktop app, and plainly stated forward-secret and post-quantum encryption. That's the gap Graphite is built to fill.

Try Graphite free in public beta on Windows, Android, and the web — no phone number, no email, no logs — at graphite.chat.