MacSouverain

FREN
radar

iOS 26.5 finally encrypts RCS iPhone-Android (but Signal still leads)

Apple enables end-to-end encryption on RCS messages with iOS 26.5, using the MLS protocol. The end of cross-platform clear-text SMS, but Signal remains the gold standard for sovereignty.

Apple finally enables end-to-end encryption for RCS messages with iOS 26.5. Your iPhone-Android exchanges are no longer in clear SMS, but the protocol still falls short of Signal for sensitive matters.

The Deal

Apple confirmed on May 4, 2026, that iOS 26.5 (release candidate available, stable public expected around May 11-12) integrates end-to-end encryption for RCS messages exchanged between iPhone and Android. In practice, when you send a message from your iPhone to your friend’s Samsung, the content will be encrypted E2EE according to the Universal Profile 3.0 profile, published by the GSMA in March 2025, which relies on the MLS (Messaging Layer Security) protocol, an audited IETF standard, the same foundation used for the future interoperable encryption of Matrix and other messaging platforms.

Note: Apple specifies that the feature remains in beta even in iOS 26.5 stable, and it depends on operator support on both sides (iPhone and Android on RCS UP 3.0 compatible operators). A lock icon in Messages will indicate when the channel is actually encrypted, and a toggle has been added in Settings > Messages.

This ends a long-standing anomaly: cross-platform exchanges went through SMS/MMS, thus in plaintext, interceptable by any operator or state actor along the way. Google pushed RCS since 2019, Apple dragged its feet. The timing is no coincidence: pressure from the GSMA, operators, and repeated public criticism about the security of cross-platform SMS seems to have sped up Cupertino’s schedule.

Why It Matters to You

If you use iMessage between Apple devices, nothing changes: your channel remains E2EE as before. The real gain is for exchanges with the Android ecosystem, which represents 70% of the global market. Until now, these conversations fell into SMS (plaintext) or MMS (destructive compression, zero encryption). With RCS E2EE, you finally get decent protection by default.

But let’s keep a cool head. RCS encryption relies on operators’ and Google’s (which provides Jibe, the dominant RCS backend) infrastructure. Keys transit through their servers during session establishment. It’s not like Signal, where you control the entire chain. For sensitive conversations (lawyer, doctor, journalistic source, confidential business deal), Signal remains the gold standard: audited protocol, minimal servers, reduced metadata, open-source code.

The other thing to watch: Apple hasn’t confirmed if iCloud backups of RCS conversations will be encrypted E2EE. Without Advanced Data Protection enabled, your RCS messages could end up in plaintext on Apple’s servers, nullifying the benefit of transit encryption.

What You Do Now

1. Enable Advanced Data Protection on your iCloud account (Settings > Apple Account > iCloud > Advanced Data Protection). Without it, your backups remain accessible to Apple and judicial requests. Note: ADP covers Messages backups, but not iCloud Mail, Contacts, and Calendar, which remain outside E2EE by design.

2. For really sensitive conversations, stick with Signal. RCS encryption is progress for everyday use, not a replacement for the sovereign gold standard.

3. Check if your Android contacts have RCS enabled. The reliable indicator of effective encryption will be the dedicated lock icon in Messages (announced by Apple), not the bubble color (green = SMS/RCS, blue = iMessage, unrelated to E2EE). An Android on an operator that doesn’t support RCS UP 3.0 takes you back to clear SMS.

4. Update to iOS 26.5 once the stable release is out to enjoy the encryption. Betas are nice for testing, but not for your daily driver.

Sources