Personal Tech Columnist Geoffrey Fowler enlisted master hacker Marc Rogers at the RSA security conference, to help test Whisper, Secret and, popular apps that let people share anonymously with the world.

A secret is hard to keep on a smartphone.


"I hope my feelings don't get the best of me tomorrow," wrote someone on Whisper 15 miles away from me in San Francisco. Online confession isn't just a niche: Secret has become the go-to source for Silicon Valley gossip, and Whisper is popular with students and soldiers in Afghanistan alike. claims more than 100 million registered users globally.

As we bare our souls, the question is: Can apps keep our secrets anonymous? And when it comes to matters of bullying or self-harm, should they?

To find out, I asked for help from a hacker who happens to be a father of three. Marc Rogers is head of security for DefCon, the large hacker conference, and is a researcher at mobile security firm Lookout.

What we found was that none of the apps can guarantee anonymity. Instead, there are trade-offs in privacy and safety. It can be hard to know which apps to trust, but there are three factors to keep in mind: what information you're comfortable sharing, which company might best protect your data, and which acts the most responsibly when users are in trouble.

On the left, Secret, on the right, Whisper -- apps that allow users to post messages anonymously. Wlson Rothman/The Wall Street Journal

Apps in the Know

Mr. Rogers says he wouldn't use any of these apps to broadcast serious secrets. Identity is hard to mask on a computer, but smartphones hold even more personal data—location, phone number, contacts and more.

All that data help these apps carry your secrets to relevant people, online friends or nameless supporters who may be nearby. But make no mistake: Though all three apps peddle anonymity, they collect enough information to build profiles about each user.

You sign into each app differently, sometimes with a login and password, or automatically with your phone serving as a unique, but anonymous, identifier. The apps allow people to share sentiments that aren't supposed to be traced back to them.

Only Whisper doesn't know who I am—no email, no phone number, no unique username or password—but it knows where I've been (if I opt in) and how to reach me. I posted, "I got a burrito instead of going to the gym," with a photo of my dinner. The app noted my phone's location. A stranger in my vicinity consoled me with the message, "Food over everything. Always."

Secret went a step further with my confession, tapping my location and contacts to share it anonymously with people I know. (My buddies on Secret only saw that a "friend" posted it.) If my confession was popular, measured in heart-shaped approvals, Secret might have shared it with friends of friends. That meant Secret had my email and lots of identifying information from my phone. Says co-founder David Byttow: "Anonymous does not mean 'untraceable.' Anonymous means 'without name,' which is exactly in line with the product."'s question-and-answer app didn't use my phone's location or contact data, though it does ask users to create an optional account with their email or Facebook login, and collect an Internet protocol address. I posed my confession anonymously to people I follow inside the service. (At the moment, the iPhone app won't publish anonymous questions, and wouldn't confirm if that is a permanent change.)

Protecting Your Data

So what happens if the apps are hacked? All three companies say they go to great lengths for security. Mr. Rogers says they've generally gone further than most apps to protect data.

Secret, which has the most identifying data, keeps secrets separate from user profiles. Decoding who created a specific post requires the company's two founders to both unlock virtual keys at the same time.

Mr. Rogers looked under the hood of the apps to see if they take an important, but often overlooked, step to protect users: encrypting data as it passes over the Internet. and Secret encrypt everything, Whisper encrypts sensitive information but not all data.

Hackers, including Mr. Rogers, haven't yet come forward with any major vulnerabilities in these three apps like the one found in the dating site Tinder last week, which could have let someone pinpoint user locations. (Tinder says it's fixed now.) Still, it isn't a question of whether apps have vulnerabilities, but rather when they'll emerge. "How these companies handle those vulnerabilities will be the most important thing," says Mr. Rogers.

Of the three, Secret has the best formal system to handle the inevitable: a "bug bounty" program to encourage people to responsibly disclose issues. It also had the most clearly written privacy and security policy.

Keeping Things Safe

Bullies have long hidden under the Internet's cloak, and secret apps make being mean even easier. Dealing with those issues means bringing in outsiders to review secrets, and sometimes disclosing users to authorities.

Secret does the least, relying on members to flag inappropriate content. In the app's first few weeks, I've seen plenty of posts with gossip, sometimes with people I know named. The company says it would comply with law-enforcement requests, but that hasn't come up yet. ramped up filtering efforts recently. It employs human moderators to review sensitive content.

Whisper has a team of moderators and bans posts that name names (except for celebrities). If someone mentions suicide, Whisper hides the post and sends its author suggestions about where they might get help. Whisper also seeks out authorities when content suggests potential child abuse. If you're a parent, Whisper's approach seems most reasonable.

But Jim Steyer, CEO of child advocacy group Common Sense Media, doesn't think any of the apps are doing enough. "These are the platforms through which some of the worst cyberbullying is happening," he says.

The reality is that nobody can promise untraceable secrets from an app. But most people aren't confessing gravely serious things. At their best, these apps allow lonely or scared people to see they're not alone. I was moved to see plenty of secret-sharers offering support to one another.

It's important for everyone to understand what might be recorded, and to weigh the consequences if their secrets fell into the wrong hands.

—Write to Geoffrey A. Fowler at and on Twitter at @geoffreyfowler.