By Matt Busel, who built the apps, crates and game he writes about · every number links to its source and every dataset is downloadable (methods) · corrections · featured in Kirino, gamebiz, This Week in Rust, New Mobile Life, By-Press
Rust mobile apps: React Native is 50% C/C++. Signal's core is 0%
On this page · 10 sections
- Key numbers
- The apps that get hacked for a living already picked Rust
- The "safe" cross-platform frameworks are built on C++
- Google's Android team already ran the experiment
- By the numbers: React Native still wins the downloads 23 to 1
- Rust mobile is growing faster than Rust itself
- Who wins, who loses
- The pattern, step by step
- What this means for you
- Sources
Short answer: Rust mobile apps are already in your pocket, you just never see them. Signal, Firefox, Bitwarden and the new Element X chat apps all run a Rust core under a thin Swift or Kotlin skin, and Google says Android's Rust has 1000x lower memory safety bug density than its C and C++. Meanwhile the frameworks most apps are actually built on are not the safe choice they look like: we pulled GitHub's language stats today and 50.1% of React Native's own repo is C, C++ and Objective-C. Our read: the "Rust for mobile" fight is already won at the core. The UI layer is the only thing left, and it is moving faster than Rust itself.
TL;DR: React Native pulled 53.9 million npm downloads in the last month, 23x what uniffi, Mozilla's Rust-to-Swift-and-Kotlin bridge, did on crates.io (2.3 million). But the Rust mobile plumbing is growing faster than Rust as a whole: uniffi, ndk and android-activity are each up about 57-58% over 90 days against 33% for serde, and the Rust UI kits Slint (+165%) and Crux (+191%) are running even hotter. If you are starting an app in 2026, put your logic, crypto and sync in Rust and keep your UI native; the apps that care most about getting hacked already did.
Key numbers
| What | Number | Source, checked Oct 25 2026 |
|---|---|---|
| React Native repo written in C, C++, Objective-C | 50.1% of bytes | GitHub languages API |
| Flutter repo written in C, C++, Objective-C | 20.1% of bytes | GitHub languages API |
| Signal's libsignal written in Rust (C/C++: 0%) | 62.7% | GitHub languages API |
| Android memory safety bug density, Rust vs C/C++ | 1000x lower | Google Security Blog, Nov 13 2025 |
| Android vulnerabilities that were memory safety bugs | 76% (2019) to 24% (2024), under 20% (2025) | Google Security Blog |
| react-native npm downloads, last month | 53,920,393 | npm |
| uniffi crates.io downloads, last 30 days | 2,304,639 (+58% in 90 days) | crates.io |
| flutter_rust_bridge pub.dev downloads, 30 days | 604,837 | pub.dev |
| serde (baseline for all of Rust), 90-day growth | +32.7% | crates.io |
The apps that get hacked for a living already picked Rust
The top post on r/rust today is a simple wish: "I want more mobile apps to be developed in Rust", sitting at 365 upvotes. Fair wish. But the funny part is how many of the apps on that person's phone already are.
We pulled the language breakdown GitHub reports for the shared code behind four apps that live or die on security. Signal's libsignal, Signal's shared crypto library, is 62.7% Rust, with Swift, Java and TypeScript wrappers making up most of the rest and 0% C or C++.
Mozilla's application-services, the sync, logins and storage layer Firefox shares across Android and iOS, is 89.1% Rust. Bitwarden's sdk-internal is 95.6% Rust. And the matrix-rust-sdk is 99.8% Rust.
That last one is the tell. Element X, the new Matrix chat client, ships an iOS app that is 99.9% Swift and an Android app that is 98.8% Kotlin. All the hard stuff (encryption, sync, the network) lives in the Rust SDK underneath. The native code is the paint.
The "safe" cross-platform frameworks are built on C++
Here is the part nobody in the Flutter vs React Native flame wars brings up. Both frameworks sell you a managed, memory-safe language on top (Dart, JavaScript). Underneath, they are C++ engines.
GitHub's language API counts 50.1% of the bytes in facebook/react-native as C, C++, Objective-C or Objective-C++ (C++ alone is 34.8%, Kotlin 22.5%, JavaScript just 19.3%). Meta's flagship "write it in JavaScript" framework has more C++ in it than JavaScript.
flutter/flutter, which now holds the engine too, is 74.7% Dart and 20.1% C, C++ and Objective-C. That is the code that parses your images, lays out your text and talks to the GPU, which is exactly where memory bugs like to live.
To be fair to both: a language share is not a bug count, and Meta and Google run huge fuzzing and review programs on that C++. But that is the point Google's own Android team keeps making. Fuzzing and mitigations treat the symptom. The language is the cause.
Google's Android team already ran the experiment
The best data on Rust in mobile does not come from a Rust fan. It comes from Google, which started pushing new Android platform code into memory-safe languages around 2019.
In September 2024, Jeff Vander Stoep and Alex Rebert wrote that memory safety issues fell from 76% of Android vulnerabilities in 2019 to 24% in 2024, against a 70% industry norm. In November 2025, Vander Stoep reported the share fell below 20% for the first time.
The same post puts numbers on the part that should matter to every app team, speed. Compared with C++ in Android, Rust shows a 1000x lower memory safety vulnerability density, a rollback rate about 4x lower for medium and large changes, about 20% fewer revisions per change, and about 25% less time in code review.
Google is also taking Rust into its own apps, not just the OS. Its post names Nearby Presence, already running inside Google Play Services, and the MLS protocol for encrypted RCS, slated for Google Messages.
So here is the irony we cannot get over. Google's Android team published hard data that Rust is safer and faster to ship. Google's Flutter team ships an engine that is one-fifth C and C++. Same company, two answers, and the one with the data is not the one with 180,370 GitHub stars.
By the numbers: React Native still wins the downloads 23 to 1
None of that means Rust is winning the app UI. It is not, and pretending otherwise is copium.
In the last month, react-native pulled 53.9 million npm downloads, Expo 39.5 million and Ionic's Capacitor 19.6 million. The biggest Rust mobile bridge, uniffi, did 2.3 million on crates.io in its last 30 days. flutter_rust_bridge did 604,837 on pub.dev.
Plain-English note on these numbers: a "download" on any package registry is mostly CI servers rebuilding projects, not humans. npm and crates.io count differently, and the windows differ by two days (npm Sep 23 to Oct 22, crates.io Sep 25 to Oct 24). Treat 23 to 1 as an order of magnitude, not a scoreboard.
One stat flipped our expectations. flutter_rust_bridge's 604,837 pub.dev downloads are more than half of provider (1,158,349), one of the most-used Flutter packages there is. A lot of Flutter apps quietly have a Rust engine room already.
Rust mobile is growing faster than Rust itself
Raw size is the past. Growth is the future, so we pulled 90 days of daily crates.io downloads for every Rust-on-mobile crate we could name and compared the last 30 days with the 30 days ending Aug 26.
The baseline matters: all of crates.io swings with the calendar, so we used serde, which nearly every Rust project pulls, as the tide. serde grew 32.7% (tokio 34.4%, libc 30.1%, syn 44.6%).
The mobile plumbing beat it. uniffi grew 58.0%, ndk 56.6% and android-activity 58.4%. The Rust UI kits ran hotter: Slint +164.8%, egui +105.7% and Red Badger's Crux, built exactly for "Rust core, native shell" apps, +191.4% from a small base.
The one laggard is the funniest. flutter_rust_bridge on crates.io grew just 15.5%, half the serde tide. Our bet: teams that start with Rust are skipping the Dart middleman and going straight to uniffi or Crux with native UI.
Who wins, who loses
Winners: Mozilla, whose uniffi has become the default bridge (243 crates on crates.io depend on it). Signal, Bitwarden and Matrix, who get one audited core for every platform. Tauri, whose crate is up 60.2% and whose repo sits at 112,181 stars, close behind React Native's 126,781.
Losers: anyone selling "one codebase" as if the codebase you share should be the UI. The UI is the part users feel and the part each platform keeps changing. The logic is the part attackers hit. Share the second, not the first.
Still undecided: pure Rust UI on phones. Dioxus has 39,489 stars and 461 crates depending on it, Makepad has 7,218, and the Robius crew is building a Matrix client in it. Nobody has proven yet that a pure Rust UI can feel native on iOS. But the growth curve says somebody is about to try very hard.
The pattern, step by step
If you want what Signal and Element have, this is the shape, in plain terms:
- Write the core in Rust: networking, storage, sync, crypto, parsing, business rules. No UI.
- Expose it with uniffi, which generates Swift and Kotlin bindings from one interface definition (a "binding" is the glue code that lets Swift call a Rust function).
- Cross-compile with cargo-ndk for Android and the Apple targets for iOS, then ship it as an Android library and an XCFramework.
- Build the UI in SwiftUI and Jetpack Compose, the real native toolkits, so the app feels right on each phone.
- Already on Flutter? flutter_rust_bridge gets you the same Rust core without a rewrite. Already on React Native? Its new architecture can call native modules, which can be your uniffi output.
Step 3 is where most teams quit, because the first cross-compile for Android and iOS is a wall of linker errors. It is worth pushing through once. After that, every platform gets the same tested code for free.
What this means for you
If you are starting an app now, do not ask "Rust or React Native". Ask "what is the part I can never afford to get wrong", put that in Rust, and keep the UI in whatever ships fastest for you. That is the play Google, Mozilla, Signal and Bitwarden already made, and the numbers above say the rest of the ecosystem is growing about 1.8x faster than Rust overall.
Stuck on that first Android or iOS build of your Rust core? Our $99 Rust build fix gets your crate cross-compiling for Android and iOS, fixed within 24 hours or a full refund.
More from us: every Rust piece, the Rust hub and crates we track, why Rust is the language AI will be written in, and the redis-rs 2.0 speed tax. The raw data for this piece is below, free to download.
Sources
- r/rust, "I want more mobile apps to be developed in Rust", Oct 25 2026
- Google Security Blog, Jeff Vander Stoep, "Rust in Android: move fast and fix things", Nov 13 2025
- Google Security Blog, Jeff Vander Stoep and Alex Rebert, "Eliminating Memory Safety Vulnerabilities at the Source", Sep 2024
- GitHub REST API, repo and languages endpoints for facebook/react-native, flutter/flutter, signalapp/libsignal, mozilla/application-services, bitwarden/sdk-internal, matrix-org/matrix-rust-sdk, element-hq/element-x-ios, element-hq/element-x-android, tauri-apps/tauri, DioxusLabs/dioxus, slint-ui/slint, makepad/makepad, mozilla/uniffi-rs, redbadger/crux, our pull Oct 25 2026
- crates.io API, downloads, daily downloads and reverse dependencies for 20 crates plus serde, syn, tokio and libc, our pull Oct 25 2026
- npm downloads API, react-native, expo, @capacitor/core, Sep 23 to Oct 22 2026
- pub.dev, 30-day downloads for flutter_rust_bridge and provider, Oct 25 2026
First published here on tensorust.com on Oct 25, 2026. Related: Rust articles, Rust hub, Crates we track, Rust is the language AI will be written in, redis-rs 2.0 speed tax.
Up next
More on RustPick a UUIDv7 library that keeps order: 10 tested, .NET fails 50%We tested 10 UUIDv7 libraries with 1M IDs each and a clock jump. .NET put 50% out of order, uuid6 ran 16.6 min ahead. The 2 that passed, plus free data.Read it next →Cite this
Free to cite and reuse under CC BY 4.0 with a link back. How it was collected: methods. Spotted an error? Corrections.
Did this answer your question?
Get the next one by email.
What my AI agents tried this week, with the real numbers: what worked, what flopped, what made money. One email when there is something worth reading.
No spam, never sold. Every email has a one-click unsubscribe.
What are people saying about this? Read and post on The Floor →
More: the author, related reading, share this, a free game
Try it yourself · Rust dev?
Check a crate before you depend on it
Release health, reverse deps, real downloads and the alternatives for 1000 crates.
In The Manual: on this topic
Explainers answer one question, short answer first. Guides walk you through it step by step.
- Explainer · Money and the economyGumroad fees, explained with real numbers
- Guide · Shipping and sellingHow to handle 64-bit IDs in JSON with JavaScript BigInt
- Explainer · iPhone appsGuideline 4.3(a) design spam, explained
- Explainer · Shipping and sellingSnowflake ID vs UUID: which should you use?
Read next
Free tool: iPhone app cost calculator → Pick an app type and features, get an honest budget range.
- Dev · Oct 25, 2026 · 8 min readredis-rs 2.0 fixes a 68% speed tax. 59% of Rust won't get it
- Dev · Oct 23, 2026 · 13 min readPick a UUIDv7 library that keeps order: 10 tested, .NET fails 50%
- AI · Oct 25, 2026 · 10 min readAI sandbox escapes: OpenAI wrote 8 of the 17,204 commits in the walls