OSHI vs Session — Anonymous Messengers Compared
OSHI and Session are natural rivals: both are open-source, both reject the phone-number model, and both are designed for people who want to communicate without revealing who they are. If you have already decided you want anonymity, this is the comparison that matters most.
Session takes an onion-routing approach: it forked from Signal, assigns you a random Session ID instead of a phone number, and bounces your messages through a decentralized network of service nodes to obscure metadata — conceptually similar to Tor. OSHI also drops the phone number, but its distinctive strength is working with no internet at all via a Bluetooth and WiFi mesh, alongside Tor routing and, for large attachments, a content-addressed store on its own server. Both have real merits; the right choice depends on whether your priority is metadata-resistant internet routing or true offline resilience.
Feature comparison: OSHI vs Session
| Feature | OSHI | Session |
|---|---|---|
| E2EE protocol | X25519 + AES-256-GCM, Signal-protocol style. Double Ratchet in the v3 session format only — the older v2 format does not ratchet and most of the installed base is still on v2 (status). Adds X-Wing (ML-KEM-768 + X25519) hybrid post-quantum key agreement where both ends support it | End-to-end encrypted (Session Protocol; forked from Signal, Double Ratchet and forward secrecy removed in 2023, per Session's own documentation) |
| Works offline / mesh | Yes — BLE + WiFi mesh, multi-hop relay | No — routes over internet via onion network |
| Needs phone number | No | No |
| Metadata collected | No phone number and no server-side contact graph. On the internet path the relay sees sender and recipient public keys, timestamps and message sizes; it cannot read messages. On the mesh path there is no server at all | Onion routing over a decentralized service-node network; no phone number |
| Open source | Yes (MIT) | Yes (GPLv3) |
| Independent audits | Not publicly audited yet | Yes — third-party audited |
| On-device AI | Yes — on-device translation, correction, tone | No |
| Censorship resistance | Yes — offline mesh + Tor + optional disguised relay transport (iOS/Android); no guarantee against a determined censor | Onion routing |
| Platforms | iOS (App Store), Android (Google Play or APK), Windows & Linux (desktop beta, direct download) | iOS, Android, Windows, macOS, Linux |
| Price | Free | Free |
| Decentralized / self-hostable | Partly — the mesh needs no server at all; the internet relay and attachment store are run by the project | Decentralized service-node network |
Where Session genuinely wins
Session deserves credit as a serious, metadata-focused messenger. Its onion-routing network means no central server ever sees both who you are and who you are talking to, and because it uses a decentralized set of service nodes, there is no single company operating the infrastructure. It requires no phone number, has been through third-party security review, and offers clean cross-platform clients including desktop. For a threat model centred on "hide my metadata from the network while I use the internet," Session is a well-designed, mature option.
Forward secrecy: where both apps actually stand
An honest comparison has to mention a real change on Session's side: in 2023 Session moved away from Signal's Double Ratchet, dropping forward secrecy in favour of its own "Session Protocol." Session documents this itself and argues it suits its store-and-forward, multi-device onion network; messages remain end-to-end encrypted. It is a deliberate design decision that some privacy researchers have debated, and it is worth understanding rather than glossing over.
It would be easy, and wrong, to end that paragraph by claiming OSHI simply has what Session gave up. OSHI runs two session formats. The newer v3 format performs the Diffie–Hellman ratchet; the older v2 format does not, and most of the OSHI installed base is still on v2. So OSHI has implemented forward secrecy, but it is not yet a property you can assume for a given OSHI conversation. A v3 responder bug that started the sending chain at 32 zero bytes was fixed on 8 September 2026 and ships in 1.0.44; the initiator's first message on the responder-first path derives from the X3DH output alone, before any ratchet step, which is inherent to the construction. The full status is here. The difference between the two products is that Session removed the mechanism by design, while OSHI is mid-migration — a real difference, but not the clean win the old version of this page implied.
Where OSHI is different
The clearest divergence is offline capability. Session needs the internet to reach its service-node network; if the internet is down or blocked at the access layer, Session cannot deliver. OSHI can fall back to a device-to-device mesh over Bluetooth and WiFi, relaying through nearby phones with no infrastructure whatsoever — the scenario Session structurally cannot cover. OSHI also adds an optional disguised relay transport that makes its encrypted relay traffic look like ordinary web requests (not a guarantee against a determined censor), and on-device AI for translation and writing. Session, conversely, has a more mature and specifically metadata-oriented onion network and a completed public audit, which OSHI does not yet have.
Who each app suits
Choose Session if your priority is metadata-resistant messaging over the internet with a decentralized, audited onion network, and you are comfortable with its post-2023 protocol choices.
Choose OSHI if you want the same no-phone-number pseudonymity but also need to keep communicating when the internet is unavailable or censored, and want extras like on-device AI and an optional disguised relay transport — accepting that OSHI has no public audit and that forward secrecy is not yet universal across its installed base. Both are open source, so you can verify either one's behaviour directly.
Frequently asked questions
Do OSHI and Session both work without a phone number?
Yes. Neither OSHI nor Session requires a phone number. Session uses a random Session ID; OSHI uses its own identity system with no SIM tie.
What is the main difference between OSHI and Session?
Session routes over a decentralized onion network on the internet, while OSHI can additionally work fully offline over a Bluetooth and WiFi mesh. Session has a completed public audit; OSHI has not been publicly audited yet.
Does Session still use the Signal Protocol?
Not since 2023. Session replaced the Signal Double Ratchet with its own Session Protocol, which removed forward secrecy; Session documents this itself, and messages remain end-to-end encrypted. OSHI implements a Double-Ratchet-style design, but only in its v3 session format — its older v2 format does not ratchet and most OSHI users are still on v2, so forward secrecy is not yet universal there either.
Which is better for internet shutdowns?
OSHI, because it can relay messages device-to-device over a mesh with no internet at all. Session depends on reaching its service-node network over the internet.
Keep exploring
All OSHI Features Mesh networking guide End-to-end encryption OSHI vs Briar OSHI vs Signal All comparisonsTry OSHI free
Encrypted messaging with no phone number, offline mesh, and on-device AI. Open source and Swiss.