What makes a messaging app secure
A truly secure messaging app should offer end-to-end encryption by default, be open source so independent experts can audit it, collect as little metadata as possible, and have a transparent privacy policy. It should not keep your messages on its servers after delivery.
Signal: the benchmark
Signal is widely regarded as the most secure messaging app. It encrypts all messages and calls end to end, is fully open source, and collects the bare minimum of metadata. Edward Snowden and many security experts recommend it.
WhatsApp: popular but controversial
WhatsApp uses the Signal protocol for encryption, which is a plus. But it belongs to Meta (Facebook), and it collects extensive metadata about your contacts and activity and shares it with its parent company for targeted advertising. For maximum privacy, Signal is still the better choice.
Telegram: beware of common misconceptions
Telegram does not offer end-to-end encryption by default. Only "secret chats" are end-to-end encrypted, and they are available on mobile only. Regular and group chats use client-server encryption, which means Telegram can technically access your messages.
Other privacy-friendly alternatives
Threema offers end-to-end encryption and does not require a phone number. Wire is open source and offers good security with business features. Element (built on Matrix) is decentralized and fully open source, and you can even host your own server.