Can I trust Rakuten Viber Messenger?
This app did not meet one of the trust checks that applied to it, with no red flags.
- Best for
- Encrypted calls and messaging with on-device storage
- Avoid if
- Ad-free messaging or calls preferred
- What it means for you
- Message content is not stored on Viber's servers, and media files are encrypted on the device. Calls are end-to-end encrypted. The build includes code to send usage and device data to advertising and analytics services including Adjust, Firebase, Braze, Mixpanel, Facebook Audience Network, and real-time ad bidding platforms.
- Main concern
- Message history, CDR & payment data in 14+ unencrypted SQLite stores exposed via backup
- The developer's description
- Viber is a messaging app with voice/video calls, end-to-end encrypted chats, and group messaging. Ad-supported with optional contact and location features.
- Third-party services
- 16
- Findings rated low or higher
- 3
Open on the App StoreOpens the app's listing on the App Store in a new tab.
Full findings
Open this scan in your dashboardThe account that ran this scan sees every finding and the Rescan button there.
Trust checks
Secure by Design
StrongStrong security foundation
Why this result
This check looks for security issues at high severity or above in the code of this build, and none were recorded. Its scope covers stored credentials, how the app protects data on the device, and how it protects data in transit.
The app's transport security configuration globally disables Apple's mandatory HTTPS enforcement, allowing sticker catalog content and call invitation links to be served over unencrypted connections that a network attacker on the same Wi-Fi segment can intercept and modify. Certificate pinning is absent from all sensitive endpoints, including the payment portal and Rakuten identity service, leaving those connections exposed to any certificate authority the device trusts. On the positive side, media attachments are encrypted with authenticated AES-GCM before being written to disk, audio and video calls use DTLS-SRTP end-to-end encryption, Apple App Attest is active in production, HTTPS trust evaluation is properly applied to all production endpoints, and no hardcoded credentials or critical vulnerabilities were identified.
Data Minimization
StrongTracking done right
Why this result
The check looks at analytics and attribution code for companies other than the developer: the data it reads, the companies named in code as recipients, and whether a consent step runs before that code. In this build, either no such code was recorded, or a consent step runs before it and the app's own disclosures describe the collection.
Before the operating system's official tracking permission prompt appears, the app presents a custom screen designed to encourage users to grant advertising tracking access. Eight analytics and advertising SDKs are integrated, including attribution, product analytics, and multiple ad delivery services. The app does implement a consent system with eight separate opt-out categories covering analytics, interest-based advertising, location-based advertising, and personalization, along with TCF v2 vendor list support and dedicated GDPR and CCPA opt-out flows, a more granular approach than most apps offer. The exact sequence in which those SDKs initialize relative to the user's permission decision is not confirmed.
Manifest Mismatch
One criterion not metDisclosure incomplete or contradicted
Why this result
The check compares the app's privacy disclosures against what the code does, and at least one claim did not match in this build. Mismatches of this kind include a data category collected but not disclosed, a recipient the disclosure omits, and an identifier attached to data the disclosure describes as anonymous.
User Control
StrongNo lock-in
Why this result
The check looks for a way to export the data an account has accumulated and a way to delete the account itself. In this build, either both were found, or the app has no account of its own and keeps its data on the device. For an app without an account, the developer has no server-side copy to export or delete, and deleting the app removes the data in its own storage.
No proprietary data formats that would prevent message content from being moved elsewhere, no artificial barriers to account management, and no obstacles to switching messaging services were identified. Message content is stored with end-to-end encryption on the device, and the backup and restore feature routes backup metadata through the user's own Apple account rather than a proprietary silo.
Strengths
- Media attachments encrypted with AES-GCM before local storage — photos and files on disk are not readable even if a backup is extracted
- Voice and video calls protected by DTLS-SRTP end-to-end encryption at the media layer
- Chat message content not stored on Viber's servers — iCloud backup contains only metadata, not message content
- The build includes code to make data available only to Viber's own first-party extensions via Team ID-gated Keychain and App Groups, with no cross-developer data leakage
- Apple App Attest deployed in production for cryptographic device integrity verification
- Granular GDPR/CCPA consent with 8 opt-out categories and TCF v2 vendor list updated 2026-07-23
What the app contains
16 services
Third-party services the scan names in the build:
- Adjust
- Firebase Analytics
- Firebase Crashlytics
- Firebase Remote Config
- Braze
- Mixpanel
- Facebook Audience Network
- Google AdMob
- Vungle/Liftoff
- Rakuten RMP (OpenRTB)
- AppHarbrSDK (GeoEdge)
- Snap Camera Kit
- Snap Login Kit
- Stripe
- PayneticsCard
- OMSDK_Viber (IAB OpenMeasurement)
Libraries
| Library | Version | Advisory |
|---|---|---|
| AdjustSigSdk | 1.0 | none confirmed |
| AhoCorasick | 1.0 | none confirmed |
| AppHarbrSDK | 1.33.1 | none confirmed |
| BrazeKit | 13.3.0 | none confirmed |
| BrazeUI | 13.3.0 | none confirmed |
| GRDB | 4.8.1 | none confirmed |
| Mantle | 1.0 | none confirmed |
| MarkdownKit | 1.0 | none confirmed |
| Nuke | 1.0 | none confirmed |
| OMSDK_Viber | 1.6.6 | none confirmed |
Show all 75 librariesShow fewer
Changes since the previous scan
- Version 28.5.0 (build 28.5.0.8), score 61.
- Score 70 before, 61 after.
- Version 27.5.0 (Build 27.5.0.4) before, 28.5.0 (build 28.5.0.8) after.
- Score change since version 27.5.0 (Build 27.5.0.4): -9 points.
- Since the previous scan: 18 findings added, 7 removed.
- Version 27.5.0 (Build 27.5.0.4), score 70.
- First public scan of this app.
Method and limits
Static analysis: the decompiled code, manifest and resources of this build, read file by file. Network traffic at run time is established by a capture of the running app.
- Scan date
- 13 August 2026
Corrections
No correction is published for this app.
Developer response
No response is published for this app.
Report an error Opens an email to [email protected] that names this app and this scan.