Digital Identity in Messaging: Phone Numbers, Usernames, or Random IDs?

Digital identity is established the moment someone creates an account on a messaging platform.

Those messaging apps or communication platforms need a way to let people in and use their services, starting from registration to chatting, calling, voice noting, and interacting.

The service needs an identifier to register accounts, distinguish them from one another, and enable communication.

That identifier might be a phone number, a username chosen by the user, or a randomly assigned ID.

This being the first door requires stronger security and privacy because any compromise can be an exposure and risk point, revealing a great deal of private and sensitive data about its users.

These approaches have different implications for privacy and account security. For an encrypted messaging app, digital identity determines how an account can be found, what information is associated with it, and how easily that identity can be connected to a person outside the platform.

A 2025 study by researchers at the University of Vienna and SBA Research demonstrated the scale of information that can be exposed through account discovery. By querying WhatsApp’s contact discovery system, the researchers identified more than 3.5 billion active accounts across 245 countries, sending over 100 million phone-number queries per hour.

The information they could access included phone numbers, public keys, timestamps, and publicly available profile details. They could also infer information such as operating systems, account age, and the number of linked devices. The research found millions of active accounts in countries where WhatsApp was restricted. It also established that nearly half of the phone numbers in a dataset of approximately 500 million records scraped from Facebook in 2018 were still associated with active WhatsApp accounts.

Meta subsequently introduced measures to address the weakness. The researchers did not access private messages, and the findings did not demonstrate a failure of WhatsApp’s end-to-end encryption. They demonstrated how much account information can be exposed through contact discovery, even when message contents remain protected. (Source: University of Vienna research)

This is why the digital identity layer of a messaging service deserves attention alongside its encryption. End-to-end encryption protects message contents against access by parties who do not possess the necessary keys.

It does not, by itself, prevent account enumeration, conceal the identifier used to find an account, or stop that identifier from being connected to information held elsewhere. An encrypted messaging app can protect conversations while still exposing information through the way its accounts are registered and discovered.

Each chat application needs a way to register and locate its users. The choice of identifier shapes the digital identity attached to an account: what information it reveals, what the service collects during registration, and how easily other people can discover it.

Phone-number registration makes contact discovery effortless. A messaging service can compare the numbers in a user’s address book against its registered accounts, allowing people to find existing contacts without exchanging another identifier. For a chat application, this removes the need for users to share a separate username or account ID.

That convenience also makes the phone number a point of exposure. If a service reveals whether a submitted number belongs to a registered user, attackers may automate queries across large sets of candidate numbers. The WhatsApp research shows how extensive this exposure can become when contact-discovery controls are insufficient.

A phone number can also connect a messaging account to information outside the service even if it is an encrypted messaging app. It may be used for banking, account recovery, social media, and business communication. Attackers who obtain it can use it to identify potential targets, conduct phishing through calls or text messages, or impersonate trusted organisations and contacts. Caller ID spoofing can make a call appear to come from a familiar number without the attacker controlling the actual phone line.

SIM swapping presents a separate threat. An attacker may persuade a mobile carrier to transfer a victim’s number to a SIM card under their control. If an account relies on SMS for verification or recovery, the attacker may receive the codes needed to attempt access.

The FBI’s Internet Crime Complaint Center recorded 1,611 SIM-swapping complaints in 2021, with adjusted losses exceeding $68 million. Between January 2018 and December 2020, it recorded 320 complaints with approximately $12 million in adjusted losses. (Source: FBI IC3 advisory on SIM swapping)

Also, hashing does not automatically remove the discovery risk. Phone numbers follow predictable structures and have a limited range of possible values. An attacker can generate candidate numbers, hash them, and compare the results against stored hashes. Where a system relies on predictable, unsalted hashes and permits large-scale comparisons, the original numbers may be recovered without breaking the hash function. Threema’s cryptography whitepaper discusses this limitation in the context of phone-number matching. (Source: Threema Cryptography Whitepaper)

A username allows users to establish a contact identity without disclosing the phone number tied to their personal or professional life. For a chat application, this changes how people find one another: contacts can exchange usernames instead of sharing telephone numbers.

However, using a username does not necessarily mean registering without personal information. A service may allow username-based contact while still requiring a phone number or email address during signup. The identifier visible to other users changes, but the information collected by the platform does not necessarily change with it.

This matters when assessing the privacy of an encrypted messaging app. A phone number hidden from contacts may still be held by the service and remain subject to its data collection, storage, and retention practices.

The username changes the public-facing part of a user’s digital identity, but it does not automatically change the registration information behind the account.

Usernames can also create connections between accounts when people reuse the same handle across public profiles, forums, and messaging services. A username that is already associated with someone’s public identity can make their messaging account easier to recognise or link to other online activity.

The protection a username provides therefore depends on two things: what other users can discover and what personal information the service requires to create the account.

A randomly assigned ID gives an account an identifier created by the service rather than one taken from an existing phone number or chosen as a public username. It allows the platform to identify and locate an account without requiring a telephone number as its primary identifier.

xPal, an encrypted messaging app, uses this model. Users register with a screen name and a four- or six-digit PIN, then receive a unique nine-digit xID. A phone number, email address, or real name is not required for registration.

This changes the information needed to establish a messaging identity. The xID does not inherently reveal a telephone number, and the service does not need to match a user’s address book against phone-number registrations to locate accounts. Users exchange their xIDs through the sharing methods supported by xPal rather than relying on automatic phone-number discovery.

A random ID does not make an account impossible to identify. Users can reveal their identity in conversations, publish their xID alongside their real name, or share identifying information through other channels. An identifier is also not an authentication credential: knowing someone’s xID does not, by itself, establish permission to access their account.

Account recovery requires a separate arrangement because an ID that is not tied to a phone number cannot be recovered through SMS verification to that number. xPal provides an Access ID that users can set up in advance. There is also a security question or phrase for PIN recovery. Without a recovery method, a forgotten PIN may leave the user unable to regain access to the account.

A randomly assigned ID reduces the personal information required to establish an account, but users still need to protect their credentials and configure recovery options carefully.

Phone numbers, usernames, and randomly assigned IDs determine how a messaging account is created and discovered. Each model carries different dependencies. Phone numbers offer convenient contact discovery but connect accounts to telecommunications infrastructure and identifiers used across other services. Usernames give people another way to connect without sharing their numbers, although registration may still require personal details. Random IDs remove the need to use a phone number as the account identifier, but require users to manage contact exchange and account recovery differently.

For anyone choosing an encrypted messaging app or evaluating a chat application, these details deserve attention alongside encryption protocols and security features. Digital identity affects what information a service collects, what other people can discover, and how much of a person’s existing identity becomes attached to the account. It is part of the system’s security design.