HOME

TheInfoList



OR:

Signal is an American
open-source Open source is source code that is made freely available for possible modification and redistribution. Products include permission to use and view the source code, design documents, or content of the product. The open source model is a decentrali ...
, encrypted messaging service for
instant messaging Instant messaging (IM) technology is a type of synchronous computer-mediated communication involving the immediate ( real-time) transmission of messages between two or more parties over the Internet or another computer network. Originally involv ...
, voice calls, and
video calls Videotelephony (also known as videoconferencing or video calling) is the use of audio signal, audio and video for simultaneous two-way communication. Today, videotelephony is widespread. There are many terms to refer to videotelephony. ''Vide ...
. The instant messaging function includes sending text, voice notes, images, videos, and other files. Communication may be one-to-one between users or may involve group messaging. The application uses a
centralized computing Centralized computing is computing done at a central location, using terminals that are attached to a central computer. The computer itself may control all the peripherals directly (if they are physically connected to the central computer), or th ...
architecture and is
cross-platform software Within computing, cross-platform software (also called multi-platform software, platform-agnostic software, or platform-independent software) is computer software that is designed to work in several computing platforms. Some cross-platform soft ...
. It is developed by the non-profit Signal Foundation and its subsidiary Signal Messenger LLC. Signal's software is
free and open-source Free and open-source software (FOSS) is software available under a Software license, license that grants users the right to use, modify, and distribute the software modified or not to everyone free of charge. FOSS is an inclusive umbrella term ...
. Its mobile clients, desktop client, and server are all published under the AGPL-3.0-only license. The official Android app generally uses the proprietary Google Play Services, although it is designed to be able to work without them. Signal is also distributed for
iOS Ios, Io or Nio (, ; ; locally Nios, Νιός) is a Greek island in the Cyclades group in the Aegean Sea. Ios is a hilly island with cliffs down to the sea on most sides. It is situated halfway between Naxos and Santorini. It is about long an ...
and desktop programs for
Windows Windows is a Product lining, product line of Proprietary software, proprietary graphical user interface, graphical operating systems developed and marketed by Microsoft. It is grouped into families and subfamilies that cater to particular sec ...
,
macOS macOS, previously OS X and originally Mac OS X, is a Unix, Unix-based operating system developed and marketed by Apple Inc., Apple since 2001. It is the current operating system for Apple's Mac (computer), Mac computers. With ...
, and
Linux Linux ( ) is a family of open source Unix-like operating systems based on the Linux kernel, an kernel (operating system), operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically package manager, pac ...
. Registration for desktop use requires an iOS or Android device. Signal uses mobile
telephone number A telephone number is the address of a Telecommunications, telecommunication endpoint, such as a telephone, in a telephone network, such as the public switched telephone network (PSTN). A telephone number typically consists of a Number, sequ ...
s to register and manage user accounts, though configurable usernames were added in March 2024 to allow users to hide their phone numbers from other users. After removing support for SMS on Android in 2023, the app now secures all communications with
end-to-end encryption End-to-end encryption (E2EE) is a method of implementing a secure communication system where only communicating users can participate. No one else, including the system provider, telecom providers, Internet providers or malicious actors, can ...
. The client software includes mechanisms by which users can independently verify the identity of their contacts and the integrity of the data channel. The
non-profit A nonprofit organization (NPO), also known as a nonbusiness entity, nonprofit institution, not-for-profit organization, or simply a nonprofit, is a non-governmental (private) legal entity organized and operated for a collective, public, or so ...
Signal Foundation was launched in February 2018 with initial funding of $50 million from
WhatsApp WhatsApp (officially WhatsApp Messenger) is an American social media, instant messaging (IM), and voice-over-IP (VoIP) service owned by technology conglomerate Meta. It allows users to send text, voice messages and video messages, make vo ...
co-founder Brian Acton. , the platform had approximately 70 million monthly active users. , it had been downloaded more than 220 million times. Citing in part: *


History


2010–2013: Origins

Signal is the successor of the RedPhone encrypted voice calling app and the TextSecure encrypted texting program. The
beta version The software release life cycle is the process of developing, testing, and distributing a software product (e.g., an operating system). It typically consists of several stages, such as pre-alpha, alpha, beta, and release candidate, before the fi ...
s of RedPhone and TextSecure were first launched in May 2010 by Whisper Systems, a startup company co-founded by security researcher Moxie Marlinspike and roboticist Stuart Anderson. Whisper Systems also produced a firewall and tools for encrypting other forms of data. All of these were proprietary enterprise mobile security software and were only available for Android. In November 2011, Whisper Systems announced that it had been acquired by
Twitter Twitter, officially known as X since 2023, is an American microblogging and social networking service. It is one of the world's largest social media platforms and one of the most-visited websites. Users can share short text messages, image ...
. Neither company disclosed the financial terms of the deal. The acquisition was done "primarily so that Mr. Marlinspike could help the then-startup improve its security". Shortly after the acquisition, Whisper Systems' RedPhone service was made unavailable. Some criticized the removal, arguing that the software was "specifically targeted o helppeople under repressive regimes" and that it left people like the Egyptians in "a dangerous position" during the events of the
Egyptian revolution of 2011 The 2011 Egyptian revolution, also known as the 25 January Revolution (;), began on 25 January 2011 and spread across Egypt. The date was set by various youth groups to coincide with the annual Egyptian "Police holiday" as a statement against ...
. Twitter released TextSecure as
free and open-source software Free and open-source software (FOSS) is software available under a license that grants users the right to use, modify, and distribute the software modified or not to everyone free of charge. FOSS is an inclusive umbrella term encompassing free ...
under the
GPLv3 The GNU General Public Licenses (GNU GPL or simply GPL) are a series of widely used free software licenses, or ''copyleft'' licenses, that guarantee end users the freedom to run, study, share, or modify the software. The GPL was the first ...
license in December 2011. RedPhone was also released under the same license in July 2012. Marlinspike later left Twitter and founded Open Whisper Systems as a collaborative Open Source project for the continued development of TextSecure and RedPhone.


2013–2018: Open Whisper Systems

Open Whisper Systems' website was launched in January 2013. In February 2014, Open Whisper Systems introduced the second version of their TextSecure Protocol (now Signal Protocol), which added end-to-end encrypted group chat and instant messaging capabilities to TextSecure. Toward the end of July 2014, they announced plans to merge the RedPhone and TextSecure applications as Signal. This announcement coincided with the initial release of Signal as a RedPhone counterpart for
iOS Ios, Io or Nio (, ; ; locally Nios, Νιός) is a Greek island in the Cyclades group in the Aegean Sea. Ios is a hilly island with cliffs down to the sea on most sides. It is situated halfway between Naxos and Santorini. It is about long an ...
. The developers said that their next steps would be to provide TextSecure instant messaging capabilities for iOS, unify the RedPhone and TextSecure applications on Android, and launch a
web client On the Web, a user agent is a software agent responsible for retrieving and facilitating end-user interaction with Web content. This includes all web browsers, such as Google Chrome and Safari, some email clients, standalone download managers li ...
. Signal was the first iOS app to enable end-to-end encrypted voice calls for free. TextSecure compatibility was added to the iOS application in March 2015. From its launch in May 2010 until March 2015, the Android version of Signal (then called TextSecure) included support for encrypted SMS/ MMS messaging. From version 2.7.0 onward, the Android application only supported sending and receiving encrypted messages via the data channel. Reasons for this included security flaws of SMS/MMS and problems with the key exchange. Open Whisper Systems' abandonment of SMS/MMS encryption prompted some users to create a fork named Silence (initially called SMSSecure) that is meant solely for the exchange of encrypted SMS and MMS messages. In November 2015, the TextSecure and RedPhone applications on Android were merged to become Signal for Android. A month later, Open Whisper Systems announced Signal Desktop, a Chrome app that could link with a Signal mobile client. At launch, the app could only be linked with the Android version of Signal. On 26 September 2016, Open Whisper Systems announced that Signal Desktop could now be linked with the iOS version of Signal as well. On 31 October 2017, Open Whisper Systems announced that the Chrome app was deprecated. At the same time, they announced the release of a standalone desktop client (based on the
Electron The electron (, or in nuclear reactions) is a subatomic particle with a negative one elementary charge, elementary electric charge. It is a fundamental particle that comprises the ordinary matter that makes up the universe, along with up qua ...
framework) for
Windows Windows is a Product lining, product line of Proprietary software, proprietary graphical user interface, graphical operating systems developed and marketed by Microsoft. It is grouped into families and subfamilies that cater to particular sec ...
,
macOS macOS, previously OS X and originally Mac OS X, is a Unix, Unix-based operating system developed and marketed by Apple Inc., Apple since 2001. It is the current operating system for Apple's Mac (computer), Mac computers. With ...
and certain
Linux distributions A Linux distribution, often abbreviated as distro, is an operating system that includes the Linux kernel for its kernel (operating system), kernel functionality. Although the name does not imply distribution (marketing), product distribution pe ...
. On 4 October 2016, the
American Civil Liberties Union The American Civil Liberties Union (ACLU) is an American nonprofit civil rights organization founded in 1920. ACLU affiliates are active in all 50 states, Washington, D.C., and Puerto Rico. The budget of the ACLU in 2024 was $383 million. T ...
(ACLU) and Open Whisper Systems published a series of documents revealing that OWS had received a
subpoena A subpoena (; also subpœna, supenna or subpena) or witness summons is a writ issued by a government agency, most often a court, to compel testimony by a witness or production of evidence under a penalty for failure. There are two common types of ...
requiring them to provide information associated with two phone numbers for a federal
grand jury A grand jury is a jury empowered by law to conduct legal proceedings, investigate potential criminal conduct, and determine whether criminal charges should be brought. A grand jury may subpoena physical evidence or a person to testify. A grand ju ...
investigation in the first half of 2016. Only one of the two phone numbers was registered on Signal, and because of how the service is designed, OWS was only able to provide "the time the user's account had been created and the last time it had connected to the service". Along with the subpoena, OWS received a
gag order A gag order (also known as a gagging order or suppression order) is an order, typically a legal order by a court or government, restricting information or comment from being made public or passed on to any unauthorized third party. The phrase may ...
requiring OWS not to tell anyone about the subpoena for one year. OWS approached the ACLU, and they were able to lift part of the gag order after challenging it in court. OWS said it was the first time they had received a subpoena, and that they were "committed to treating any future requests the same way". In March 2017, Open Whisper Systems transitioned Signal's calling system from RedPhone to
WebRTC WebRTC (Web Real-Time Communication) is a free and open-source project providing web browsers and mobile applications with real-time communication (RTC) via application programming interfaces (APIs). It allows audio and video communication and ...
, also adding the ability to make video calls with the mobile apps.


Since 2018: Signal Technology Foundation

On 21 February 2018, Moxie Marlinspike and
WhatsApp WhatsApp (officially WhatsApp Messenger) is an American social media, instant messaging (IM), and voice-over-IP (VoIP) service owned by technology conglomerate Meta. It allows users to send text, voice messages and video messages, make vo ...
co-founder Brian Acton announced the formation of the Signal Technology Foundation, a
501(c)(3) nonprofit organization A 501(c)(3) organization is a United States corporation, trust, unincorporated association or other type of organization exempt from federal income tax under section 501(c)(3) of Title 26 of the United States Code. It is one of the 29 types of 5 ...
whose mission is "to support, accelerate, and broaden Signal's mission of making private communication accessible and ubiquitous". Acton started the foundation with $50 million in funding and became the foundation's executive chairman after leaving WhatsApp's parent company Facebook in September 2017. Marlinspike continued as Signal Messenger's first
CEO A chief executive officer (CEO), also known as a chief executive or managing director, is the top-ranking corporate officer charged with the management of an organization, usually a company or a nonprofit organization. CEOs find roles in variou ...
. , Signal ran entirely on donations, as a
nonprofit A nonprofit organization (NPO), also known as a nonbusiness entity, nonprofit institution, not-for-profit organization, or simply a nonprofit, is a non-governmental (private) legal entity organized and operated for a collective, public, or so ...
. Between November 2019 and February 2020, Signal added
iPad The iPad is a brand of tablet computers developed and marketed by Apple Inc., Apple that run the company's mobile operating systems iOS and later iPadOS. The IPad (1st generation), first-generation iPad was introduced on January 27, 2010. ...
support, view-once images and videos, stickers, and reactions. They also announced plans for a new group messaging system and an "experimental method for storing encrypted contacts in the cloud." Signal was reportedly popularized in the United States during the
George Floyd protests The George Floyd protests were a series of protests, riots, and demonstrations against police brutality that began in Minneapolis in the United States on May 26, 2020. The protests and civil unrest began in Minneapolis as Reactions to the mu ...
. Heightened awareness of police monitoring led protesters to use the platform to communicate.
Black Lives Matter Black Lives Matter (BLM) is a Decentralization, decentralized political and social movement that aims to highlight racism, discrimination and Racial inequality in the United States, racial inequality experienced by black people, and to pro ...
organizers had used the platform "for several years". During the first week of June, the encrypted messaging app was downloaded over five times more than it had been during the week prior to the
murder of George Floyd On May 25, 2020, George Floyd, a 46-year-old Black American man, was murdered in Minneapolis by Derek Chauvin, a 44-year-old White police officer. Floyd had been arrested after a store clerk reported that he made a purchase using a c ...
. In June 2020, Signal Foundation announced a new feature that enables users to blur faces in photos, in response to increased federal efforts to monitor protesters. On 7 January 2021, Signal saw a surge in new user registrations, which temporarily overwhelmed Signal's capacity to deliver account verification messages.
CNN Cable News Network (CNN) is a multinational news organization operating, most notably, a website and a TV channel headquartered in Atlanta. Founded in 1980 by American media proprietor Ted Turner and Reese Schonfeld as a 24-hour cable ne ...
and
MacRumors ''MacRumors'' is an American website that reports and aggregates Apple Inc.- and Mac (computer), Mac-related news, rumors, and information. The website is updated on a daily basis with new articles. It also provides a selection of other content ...
linked the surge with a
WhatsApp WhatsApp (officially WhatsApp Messenger) is an American social media, instant messaging (IM), and voice-over-IP (VoIP) service owned by technology conglomerate Meta. It allows users to send text, voice messages and video messages, make vo ...
privacy policy change and a Signal endorsement by
Elon Musk Elon Reeve Musk ( ; born June 28, 1971) is a businessman. He is known for his leadership of Tesla, SpaceX, X (formerly Twitter), and the Department of Government Efficiency (DOGE). Musk has been considered the wealthiest person in th ...
and
Edward Snowden Edward Joseph Snowden (born June 21, 1983) is a former National Security Agency (NSA) intelligence contractor and whistleblower who leaked classified documents revealing the existence of global surveillance programs. Born in 1983 in Elizabeth ...
via Twitter. The surge was also tied to the attack on the
United States Capitol The United States Capitol, often called the Capitol or the Capitol Building, is the Seat of government, seat of the United States Congress, the United States Congress, legislative branch of the Federal government of the United States, federal g ...
. International newspapers reported similar trends in the
United Arab Emirates The United Arab Emirates (UAE), or simply the Emirates, is a country in West Asia, in the Middle East, at the eastern end of the Arabian Peninsula. It is a Federal monarchy, federal elective monarchy made up of Emirates of the United Arab E ...
.
Reuters Reuters ( ) is a news agency owned by Thomson Reuters. It employs around 2,500 journalists and 600 photojournalists in about 200 locations worldwide writing in 16 languages. Reuters is one of the largest news agencies in the world. The agency ...
reported that more than 100,000 people had installed Signal between 7 and 8 January. Between 12 and 14 January 2021, the number of Signal installations listed on Google Play increased from over 10 million to over 50 million. On 15 January 2021, due to the surge of new users, Signal was overwhelmed with the new traffic and was down for all users. On the afternoon of 16 January, Signal announced via Twitter that service had been restored. On 10 January 2022, Moxie Marlinspike announced that he was stepping down from his role as CEO of Signal Messenger. He continues to remain on the Signal Foundation's
board of directors A board of directors is a governing body that supervises the activities of a business, a nonprofit organization, or a government agency. The powers, duties, and responsibilities of a board of directors are determined by government regulatio ...
and Brian Acton has volunteered to serve as interim CEO during the search for a new CEO. In August 2022, Signal notified 1900 users that their data had been affected by the Twilio breach including user phone numbers and SMS verification codes. At least one journalist had his account re-registered to a device he did not control as a result of the attack. In September 2022 Signal Messaging LLC announced that AI researcher and noted critic of big tech Meredith Whittaker would fill the newly created position of President.


Usage

Signal's userbase started in May 2010, when its predecessor TextSecure was launched by Whisper Systems. According to App Annie, Signal had approximately 20 million monthly active users at the end of December 2020. In January 2022, the BBC reported that Signal was used by over 40 million people. In February 2025, Signal had over 7 million
monthly active user Active users is a software performance metric that is commonly used to measure the level of engagement for a particular software product or object, by quantifying the number of active interactions from user (computing), users or visitors within ...
s in the USA according to Similarweb. According to John Ratcliffe, as of 2025 Signal is installed by default on the devices of most CIA employees and its usage is covered by standard onboarding training.


Developers and funding

The development of Signal and its predecessors at Open Whisper Systems was funded by a combination of consulting contracts, donations and
grants Grant or Grants may refer to: People * Grant (given name), including a list of people and fictional characters * Grant (surname), including a list of people and fictional characters ** Ulysses S. Grant (1822–1885), the 18th president of the U ...
. The Freedom of the Press Foundation acted as Signal's fiscal sponsor. Between 2013 and 2016, the project received grants from the
Knight Foundation The John S. and James L. Knight Foundation, also known as the Knight Foundation, is an American non-profit foundation that provides grants for journalism, communities, and the arts. The organization was founded as the Knight Memorial Education ...
, the
Shuttleworth Foundation Shuttleworth may refer to: * Shuttleworth (surname) * Shuttleworth, Greater Manchester (historically in Lancashire), a hamlet at the northeastern extremity of the Metropolitan Borough of Bury, England * Shuttleworth (canvassing) * The Shuttleworth ...
, and almost $3 million from the US government–sponsored Open Technology Fund. Signal is now developed by Signal Messenger LLC, a software company founded by Moxie Marlinspike and Brian Acton in 2018, which is wholly owned by a tax-exempt nonprofit corporation called the Signal Technology Foundation, also created by them in 2018. The Foundation was funded with an initial loan of $50 million from Acton, "to support, accelerate, and broaden Signal's mission of making private communication accessible and ubiquitous". All of the organization's products are published as
free and open-source software Free and open-source software (FOSS) is software available under a license that grants users the right to use, modify, and distribute the software modified or not to everyone free of charge. FOSS is an inclusive umbrella term encompassing free ...
. In November 2023, Meredith Whittaker revealed that she expected the annual cost of running Signal to reach $50 million in 2025, with the current cost estimated around $40 million.


Features

Signal provides one-to-one and group voice and video calls with up to forty participants on iOS, Android, and desktop platforms. The calls are carried via the devices' wired or wireless (carrier or
WiFi Wi-Fi () is a family of wireless network protocols based on the IEEE 802.11 family of standards, which are commonly used for Wireless LAN, local area networking of devices and Internet access, allowing nearby digital devices to exchange data by ...
) data connections. The application can send text messages, documents files, voice notes, pictures,
stickers A sticker is a type of label: a piece of printed paper, Polyvinyl chloride, plastic, vinyl, or other material with temporary or permanent pressure sensitive adhesive on one side. It can be used for decoration or for functional purposes, dependi ...
,
GIF The Graphics Interchange Format (GIF; or , ) is a Raster graphics, bitmap Image file formats, image format that was developed by a team at the online services provider CompuServe led by American computer scientist Steve Wilhite and released ...
s, and video messages. The platform also supports group messaging. All communication sessions between Signal users are automatically end-to-end encrypted (the encryption keys are generated and stored on the devices, and not on servers). To verify that a correspondent is really the person that they claim to be, Signal users can compare key fingerprints (or scan QR codes) out-of-band. The platform employs a trust-on-first-use mechanism to notify the user if a correspondent's key changes. Until 2023, Android users could opt into making Signal the default SMS/MMS application, allowing them to send and receive unencrypted SMS messages in addition to the standard end-to-end encrypted Signal messages. Users could then use the same application to communicate with contacts who do not have Signal. As of October 2022, this feature has been deprecated due to safety and security concerns, and was removed in 2023. TextSecure allowed the user to set a passphrase that encrypted the local message database and the user's encryption keys. This did not encrypt the user's contact database or message timestamps. The Signal applications on Android and iOS can be locked with the phone's pin, passphrase, or biometric authentication. The user can define a "screen lock timeout" interval, where Signal will re-encrypt the messages after a certain amount of time, providing an additional protection mechanism in case the phone is lost or stolen. Signal has a feature for scheduling messages. In addition, timers may be attached to messages to automatically delete the messages from both the sender's and the receivers' devices. The time period for keeping the message may be between five seconds and one week, and begins for each recipient once they have read their copy of the message. The developers stressed that this is meant to be "a collaborative feature for conversations where all participants want to automate minimal data hygiene, not for situations where the recipient is an adversary". Signal's app icon may be changed with a variety of colour themes for customization and to hide the app. The application name can also be customized. Messages can have effects like spoilers and italics, and users can add each other via QR code. Signal excludes users' messages from non-encrypted cloud backups by default. Signal allows users to automatically blur faces of people in photos to protect identities. Signal includes a
cryptocurrency wallet A cryptocurrency wallet is a device, physical medium, program or an online service which stores the Public-key cryptography, public and/or private keys for cryptocurrency transactions. In addition to this basic function of storing the keys, a cr ...
functionality for storing, sending and receiving in-app payments. Apart from certain regions and countries, the feature was enabled globally in November 2021. , the only supported payment method is
MobileCoin MobileCoin, also known as Sentz, is a peer-to-peer cryptocurrency developed by MobileCoin Inc., which was founded in 2017 by Josh Goldbard and Shane Glynn. History MobileCoin, was founded in 2017 by Joshua Goldbard and Shane Glynn. Signal's M ...
. In February 2024, Signal added a username feature to the beta version of the app. This is a privacy feature that allows users to communicate with others without having to share their telephone number.


Limitations

Signal requires that the user provide a telephone number for verification, eliminating the need for user names or passwords and facilitating contact discovery (see below). The number does not have to be the same as on the device's SIM card; it can also be a VoIP number or a landline as long as the user can receive the verification code and have a separate device to set up the software. A number can only be registered on one mobile device at a time. Account registration requires an iOS or Android device. This mandatory connection to a telephone number (a feature Signal shares with
WhatsApp WhatsApp (officially WhatsApp Messenger) is an American social media, instant messaging (IM), and voice-over-IP (VoIP) service owned by technology conglomerate Meta. It allows users to send text, voice messages and video messages, make vo ...
,
KakaoTalk KakaoTalk (), commonly referred to as KaTalk () in South Korea, is an instant messenger and online services platform operated by Kakao Corporation. It was launched in 2010 and the app is available on mobile and desktop platforms. KakaoTalk is ...
, and others) has been criticized as a "major issue" for privacy-conscious users who are not comfortable with giving out their private number. A workaround is to use a secondary phone number. The ability to choose a public, changeable username instead of sharing one's phone number was a widely-requested feature. This feature was added to the beta version of Signal in February 2024. Using phone numbers as identifiers may also create security risks that arise from the possibility of an attacker taking over a phone number. A similar vulnerability was used to attack at least one user in August 2022, though the attack was performed via the provider of Signal's SMS services, not any user's provider. The threat of this attack can be mitigated by enabling Signal's Registration Lock feature, a form of
two-factor authentication Multi-factor authentication (MFA; two-factor authentication, or 2FA) is an electronic authentication method in which a user is granted access to a website or Application software, application only after successfully presenting two or more distin ...
that requires the user to enter a PIN to register the phone number on a new device.


Usability

In July 2016, the
Internet Society The Internet Society (ISOC) is an American non-profit advocacy organization founded in 1992 with local chapters around the world. It has offices in Reston, Virginia, United States, and Geneva, Switzerland. Organization The Internet Society ...
published a user study that assessed the ability of Signal users to detect and deter
man-in-the-middle attack In cryptography and computer security, a man-in-the-middle (MITM) attack, or on-path attack, is a cyberattack where the attacker secretly relays and possibly alters the communications between two parties who believe that they are directly communi ...
s. The study concluded that 21 out of 28 participants failed to correctly compare public key fingerprints in order to verify the identity of other Signal users, and that most of these users believed they had succeeded, while they had actually failed. Four months later, Signal's user interface was updated to make verifying the identity of other Signal users simpler.


Architecture


Encryption protocols

Signal messages are encrypted with the Signal Protocol (formerly known as the TextSecure Protocol). The protocol combines the Double Ratchet Algorithm, prekeys, and an Extended Triple Diffie–Hellman (X3DH) handshake. It uses Curve25519, AES-256, and
HMAC-SHA256 In cryptography, an HMAC (sometimes expanded as either keyed-hash message authentication code or hash-based message authentication code) is a specific type of message authentication code (MAC) involving a cryptographic hash function and a secr ...
as primitives. The protocol provides confidentiality, integrity,
authentication Authentication (from ''authentikos'', "real, genuine", from αὐθέντης ''authentes'', "author") is the act of proving an Logical assertion, assertion, such as the Digital identity, identity of a computer system user. In contrast with iden ...
, participant consistency, destination validation,
forward secrecy In cryptography, forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key-agreement protocols that gives assurances that session keys will not be compromised even if long-term secrets used in the session ke ...
, backward secrecy ( future secrecy), causality preservation, message unlinkability, message repudiation, participation repudiation, and asynchronicity. It does not provide anonymity preservation, and requires servers for the relaying of messages and storing of public key material. The Signal Protocol also supports end-to-end encrypted group chats. The group chat protocol is a combination of a pairwise double ratchet and multicast encryption. In addition to the properties provided by the one-to-one protocol, the group chat protocol provides speaker consistency, out-of-order resilience, dropped message resilience, computational equality, trust equality, subgroup messaging, as well as contractible and expandable membership. In October 2014, researchers from Ruhr University Bochum (RUB) published an analysis of the Signal Protocol. Among other findings, they presented an
unknown key-share attack As defined by , an unknown key-share (UKS) attack on an authenticated key agreement In cryptography, a key-agreement protocol is a protocol whereby two (or more) parties generate a cryptographic Key (cryptography), key as a function of information ...
on the protocol, but in general, they found that it was secure. In October 2016, researchers from UK's
University of Oxford The University of Oxford is a collegiate university, collegiate research university in Oxford, England. There is evidence of teaching as early as 1096, making it the oldest university in the English-speaking world and the List of oldest un ...
,
Queensland University of Technology The Queensland University of Technology (QUT) is a public university, public research university located in the city of Brisbane in Queensland, Australia. It has two major campuses, a modern city campus in Gardens Point, Brisbane, Gardens Point ...
in Australia, and Canada's
McMaster University McMaster University (McMaster or Mac) is a public research university in Hamilton, Ontario, Canada. The main McMaster campus is on of land near the residential neighbourhoods of Ainslie Wood, Ontario, Ainslie Wood and Westdale, Ontario, Westd ...
published a formal analysis of the protocol. They concluded that the protocol was cryptographically sound. In July 2017, researchers from RUB found during another analysis of group messengers a purely theoretic attack against the group protocol of Signal: A user who knows the secret group ID of a group (due to having been a group member previously or stealing it from a member's device) can become a member of the group. Since the group ID cannot be guessed and such member changes are displayed to the remaining members, this attack is likely to be difficult to carry out without being detected. , the Signal Protocol has been implemented into
WhatsApp WhatsApp (officially WhatsApp Messenger) is an American social media, instant messaging (IM), and voice-over-IP (VoIP) service owned by technology conglomerate Meta. It allows users to send text, voice messages and video messages, make vo ...
, Facebook Messenger,
Skype Skype () was a proprietary telecommunications application operated by Skype Technologies, a division of Microsoft, best known for IP-based videotelephony, videoconferencing and voice calls. It also had instant messaging, file transfer, ...
, and Google Allo, making it possible for the conversations of "more than a billion people worldwide" to be end-to-end encrypted. In Google Allo, Skype and Facebook Messenger, conversations are not encrypted with the Signal Protocol by default; they only offer end-to-end encryption in an optional mode. Up until March 2017, Signal's voice calls were encrypted with SRTP and the
ZRTP ZRTP (composed of Z and Real-time Transport Protocol) is a cryptographic key-agreement protocol to negotiate the keys for encryption between two end points in a Voice over IP (VoIP) phone telephony call based on the Real-time Transport Protocol ...
key-agreement protocol, which was developed by Phil Zimmermann. In March 2017, Signal transitioned to a new
WebRTC WebRTC (Web Real-Time Communication) is a free and open-source project providing web browsers and mobile applications with real-time communication (RTC) via application programming interfaces (APIs). It allows audio and video communication and ...
-based calling system that introduced the ability to make video calls. Signal's voice and video calling functionalities use the Signal Protocol channel for authentication instead of ZRTP.


Authentication

To verify that a correspondent is really the person that they claim to be, Signal users can compare key fingerprints (or scan QR codes) out-of-band. The platform employs a trust on first use mechanism in order to notify the user if a correspondent's key changes.


Local storage

After receiving and decrypting messages, the application stored them locally on each device in a
SQLite SQLite ( "S-Q-L-ite", "sequel-ite") is a free and open-source relational database engine written in the C programming language. It is not a standalone app; rather, it is a library that software developers embed in their apps. As such, it ...
database that is encrypted with SQLCipher. The cryptographic key for this database is also stored locally and can be accessed if the device is unlocked. In December 2020, Cellebrite published a blog post announcing that one of their products could now access this key and use it to "decrypt the Signal app". Technology reporters later published articles about how Cellebrite had claimed to have the ability to "break into the Signal app" and "crack Signal's encryption". This latter interpretation was rejected by several experts, as well as representatives from Signal, who said the original post by Cellebrite had been about accessing data on "an unlocked Android phone in their physical possession" and that they "could have just opened the app to look at the messages". Similar extraction tools also exist for iOS devices and Signal Desktop.


Servers

Signal uses infrastructure from large providers like
Amazon Web Services Amazon Web Services, Inc. (AWS) is a subsidiary of Amazon.com, Amazon that provides Software as a service, on-demand cloud computing computing platform, platforms and Application programming interface, APIs to individuals, companies, and gover ...
,
Google Compute Engine Google Compute Engine (GCE) is the infrastructure as a service (IaaS) component of Google Cloud Platform which is built on the global infrastructure that runs Google's search engine, Gmail, YouTube and other services. Google Compute Engine enab ...
and
Microsoft Azure Microsoft Azure, or just Azure ( /ˈæʒər, ˈeɪʒər/ ''AZH-ər, AY-zhər'', UK also /ˈæzjʊər, ˈeɪzjʊər/ ''AZ-ure, AY-zure''), is the cloud computing platform developed by Microsoft. It has management, access and development of ...
around the world. In addition to routing Signal's messages, the servers also facilitate the discovery of contacts who are also registered Signal users and the automatic
exchange Exchange or exchanged may refer to: Arts, entertainment and media Film and television * Exchange (film), or ''Deep Trap'', 2015 South Korean psychological thriller * Exchanged (film), 2019 Peruvian fantasy comedy * Exchange (TV program), 2021 Sou ...
of users' public keys. By default, Signal's voice and video calls are
peer-to-peer Peer-to-peer (P2P) computing or networking is a distributed application architecture that partitions tasks or workloads between peers. Peers are equally privileged, equipotent participants in the network, forming a peer-to-peer network of Node ...
. If the caller is not in the receiver's address book, the call is routed through a server in order to hide the users'
IP address An Internet Protocol address (IP address) is a numerical label such as that is assigned to a device connected to a computer network that uses the Internet Protocol for communication. IP addresses serve two main functions: network interface i ...
es.


Contact discovery

The servers store registered users' phone numbers, public key material and push tokens which are necessary for setting up calls and transmitting messages. In order to determine which contacts are also Signal users, cryptographic hashes of the user's contact numbers are periodically transmitted to the server. The server then checks to see if those match any of the
SHA-256 SHA-2 (Secure Hash Algorithm 2) is a set of cryptographic hash functions designed by the United States National Security Agency (NSA) and first published in 2001. They are built using the Merkle–Damgård construction, from a one-way compressi ...
hashes of registered users and tells the client if any matches are found. The hashed numbers are thereafter discarded from the server. In 2014, Moxie Marlinspike wrote that it is easy to calculate a map of all possible hash inputs to hash outputs and reverse the mapping because of the limited
preimage In mathematics, for a function f: X \to Y, the image of an input value x is the single output value produced by f when passed x. The preimage of an output value y is the set of input values that produce y. More generally, evaluating f at each ...
space (the set of all possible hash inputs) of phone numbers, and that a "practical privacy preserving contact discovery remains an unsolved problem." In September 2017, Signal's developers announced that they were working on a way for the Signal client applications to "efficiently and scalably determine whether the contacts in their address book are Signal users without revealing the contacts in their address book to the Signal service."


Metadata

All client–server communications are protected by TLS. Signal's developers have asserted that their servers do not keep logs about who called whom and when. In June 2016, Marlinspike told '' The Intercept'' that "the closest piece of information to metadata that the Signal server stores is the last time each user connected to the server, and the precision of this information is reduced to the day, rather than the hour, minute, and second". The group messaging mechanism is designed so that the servers do not have access to the membership list, group title, or group icon. Instead, the creation, updating, joining, and leaving of groups is done by the clients, which deliver pairwise messages to the participants in the same way that one-to-one messages are delivered.


Federation

Signal's server architecture was federated between December 2013 and February 2016. In December 2013, it was announced that the messaging protocol Signal uses had successfully been integrated into the Android-based open-source operating system CyanogenMod. Since CyanogenMod 11.0, the client logic was contained in a system app called WhisperPush. According to Signal's developers, the Cyanogen team ran their own Signal messaging server for WhisperPush clients, which federated with the main server, so that both clients could exchange messages with each other. The WhisperPush source code was available under the GPLv3 license. In February 2016, the CyanogenMod team discontinued WhisperPush and recommended that its users switch to Signal. In May 2016, Moxie Marlinspike wrote that federation with the CyanogenMod servers had degraded the user experience and held back development, and that their servers will probably not federate with other servers again. In May 2016, Moxie Marlinspike requested that a third-party client called LibreSignal not use the Signal service or the Signal name. As a result, on 24 May 2016 the LibreSignal project posted that the project was "abandoned". The functionality provided by LibreSignal was subsequently incorporated into Signal by Marlinspike.


Licensing

The complete
source code In computing, source code, or simply code or source, is a plain text computer program written in a programming language. A programmer writes the human readable source code to control the behavior of a computer. Since a computer, at base, only ...
of the Signal clients for Android, iOS and desktop is available on
GitHub GitHub () is a Proprietary software, proprietary developer platform that allows developers to create, store, manage, and share their code. It uses Git to provide distributed version control and GitHub itself provides access control, bug trackin ...
under a
free software license A free-software license is a notice that grants the recipient of a piece of software extensive rights to modify and redistribute that software. These actions are usually prohibited by copyright law, but the rights-holder (usually the author) ...
. This enables interested parties to examine the code and help the developers verify that everything is behaving as expected. It also allows advanced users to compile their own copies of the applications and compare them with the versions that are distributed by Signal Messenger. In March 2016, Moxie Marlinspike wrote that, apart from some shared libraries that are not compiled with the project build due to a lack of Gradle NDK support, Signal for Android is
reproducible Reproducibility, closely related to replicability and repeatability, is a major principle underpinning the scientific method. For the findings of a study to be reproducible means that results obtained by an experiment or an observational study or ...
. Signal's servers are partially open source, but the server software's anti-spam component is proprietary and closed source due to security concerns.


Reception


Security

In October 2014, the
Electronic Frontier Foundation The Electronic Frontier Foundation (EFF) is an American international non-profit digital rights group based in San Francisco, California. It was founded in 1990 to promote Internet civil liberties. It provides funds for legal defense in court, ...
(EFF) included Signal in their updated surveillance self-defense guide. In November 2014, Signal received a perfect score on the EFF's secure messaging scorecard; it received points for having communications encrypted in transit, having communications encrypted with keys the provider does not have access to (
end-to-end encryption End-to-end encryption (E2EE) is a method of implementing a secure communication system where only communicating users can participate. No one else, including the system provider, telecom providers, Internet providers or malicious actors, can ...
), making it possible for users to independently verify their correspondents' identities, having past communications secure if the keys are stolen (
forward secrecy In cryptography, forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key-agreement protocols that gives assurances that session keys will not be compromised even if long-term secrets used in the session ke ...
), having the code open to independent review (
open source Open source is source code that is made freely available for possible modification and redistribution. Products include permission to use and view the source code, design documents, or content of the product. The open source model is a decentrali ...
), having the security designs well-documented, and having a recent independent security audit. At the time, " ChatSecure + Orbot",
Pidgin A pidgin , or pidgin language, is a grammatically simplified form of contact language that develops between two or more groups of people that do not have a language in common: typically, its vocabulary and grammar are limited and often drawn f ...
(with OTR), Silent Phone, and
Telegram Telegraphy is the long-distance transmission of messages where the sender uses symbolic codes, known to the recipient, rather than a physical exchange of an object bearing the message. Thus flag semaphore is a method of telegraphy, whereas pi ...
's optional "secret chats" also received seven out of seven points on the scorecard. Former NSA contractor
Edward Snowden Edward Joseph Snowden (born June 21, 1983) is a former National Security Agency (NSA) intelligence contractor and whistleblower who leaked classified documents revealing the existence of global surveillance programs. Born in 1983 in Elizabeth ...
has endorsed Signal on multiple occasions. In his keynote speech at
SXSW South by Southwest (SXSW) is an annual conglomeration of parallel film, interactive media, and music festivals and Convention (meeting), conferences organized jointly that take place in mid-March in Austin, Texas. It began in 1987 and has conti ...
in March 2014, he praised Signal's predecessors (TextSecure and RedPhone) for their ease of use. In December 2014, leaked slides from an internal NSA presentation dating to June 2012 in which the NSA deemed Signal's encrypted voice calling component (RedPhone) on its own as a "major threat" to its mission of accessing users' private data, and when used in conjunction with other privacy tools such as Cspace,
Tor Tor, TOR or ToR may refer to: Places * Toronto, Canada ** Toronto Raptors * Tor, Pallars, a village in Spain * Tor, former name of Sloviansk, Ukraine, a city * Mount Tor, Tasmania, Australia, an extinct volcano * Tor Bay, Devon, England * Tor ...
, Tails, and
TrueCrypt TrueCrypt is a discontinued source-available freeware utility software, utility used for on-the-fly encryption (OTFE). It can create a virtual encrypted disk within a file, encrypt a Disk partitioning, partition, or encrypt the whole Data storag ...
was ranked as "catastrophic" and led to a "near-total loss/lack of insight to target communications ndpresence". Following the
2016 Democratic National Committee email leak The 2016 Democratic National Committee email leak is a collection of Democratic National Committee (DNC) emails Democratic National Committee cyber attacks, stolen by one or more hackers operating under the pseudonym "Guccifer 2.0" who are allege ...
, it was reported by '' Vanity Fair'' that Marc Elias (the general counsel for
Hillary Clinton Hillary Diane Rodham Clinton ( Rodham; born October 26, 1947) is an American politician, lawyer and diplomat. She was the 67th United States secretary of state in the administration of Barack Obama from 2009 to 2013, a U.S. senator represent ...
's presidential campaign) had instructed DNC staffers to exclusively use Signal when saying anything negative about Republican presidential nominee
Donald Trump Donald John Trump (born June 14, 1946) is an American politician, media personality, and businessman who is the 47th president of the United States. A member of the Republican Party (United States), Republican Party, he served as the 45 ...
. In March 2017, Signal was approved by the sergeant at arms of the U.S. Senate for use by senators and their staff. On 27 September 2019, Natalie Silvanovich, a security engineer working in
Google Google LLC (, ) is an American multinational corporation and technology company focusing on online advertising, search engine technology, cloud computing, computer software, quantum computing, e-commerce, consumer electronics, and artificial ...
's vulnerability research team at
Project Zero Project Zero is a team of security analysts employed by Google tasked with finding Zero-day (computing), zero-day vulnerabilities. It was announced on 15 July 2014. History After finding a number of flaws in software used by many end-users whi ...
, disclosed how a bug in the Android Signal client could let an attacker spy on a user without their knowledge. The bug allowed an attacker to phone a target device, mute the call, and the call would complete – keeping the audio open but without the owner being aware of that (however they would still be aware of a ring and / or a vibration from the initial call). The bug was fixed the same day that it was reported and patched in release 4.47.7 of the app for Android. In February 2020, the
European Commission The European Commission (EC) is the primary Executive (government), executive arm of the European Union (EU). It operates as a cabinet government, with a number of European Commissioner, members of the Commission (directorial system, informall ...
recommended that its staff use Signal. Following the
George Floyd protests The George Floyd protests were a series of protests, riots, and demonstrations against police brutality that began in Minneapolis in the United States on May 26, 2020. The protests and civil unrest began in Minneapolis as Reactions to the mu ...
, which began in May 2020, Signal was downloaded 121,000 times in the U.S. between 25 May and 4 June. In July 2020, Signal became the most downloaded app in
Hong Kong Hong Kong)., Legally Hong Kong, China in international treaties and organizations. is a special administrative region of China. With 7.5 million residents in a territory, Hong Kong is the fourth most densely populated region in the wor ...
on both the Apple App Store and the Google Play Store after the passage of the Hong Kong national security law. , Signal is a contact method for securely providing tips to major news outlets such as ''
The Washington Post ''The Washington Post'', locally known as ''The'' ''Post'' and, informally, ''WaPo'' or ''WP'', is an American daily newspaper published in Washington, D.C., the national capital. It is the most widely circulated newspaper in the Washington m ...
'', ''
The Guardian ''The Guardian'' is a British daily newspaper. It was founded in Manchester in 1821 as ''The Manchester Guardian'' and changed its name in 1959, followed by a move to London. Along with its sister paper, ''The Guardian Weekly'', ''The Guardi ...
'', ''
The New York Times ''The New York Times'' (''NYT'') is an American daily newspaper based in New York City. ''The New York Times'' covers domestic, national, and international news, and publishes opinion pieces, investigative reports, and reviews. As one of ...
'', and ''
The Wall Street Journal ''The Wall Street Journal'' (''WSJ''), also referred to simply as the ''Journal,'' is an American newspaper based in New York City. The newspaper provides extensive coverage of news, especially business and finance. It operates on a subscriptio ...
''. The spyware companies Candiru and FinFisher claim the ability to extract messages from Signal when installed on a phone using their spyware. Some forks of Signal attempt to combat this by encrypting data at rest. On 9 August 2022, Ismail Sabri Yaakob, the
Prime Minister of Malaysia The prime minister of Malaysia (; ) is the head of government of Malaysia. The prime minister directs the executive branch of the Government of Malaysia, federal government. The Yang di-Pertuan Agong appoints the prime minister who is a membe ...
, reported that his Signal account was "hacked" and infiltrated by a third party, sending out messages and impersonating the politician. No details were disclosed regarding the method used to gain access to the account.


In-app payments

In April 2021, Signal announced the addition of a
cryptocurrency wallet A cryptocurrency wallet is a device, physical medium, program or an online service which stores the Public-key cryptography, public and/or private keys for cryptocurrency transactions. In addition to this basic function of storing the keys, a cr ...
feature that would allow users to send and receive payments in
MobileCoin MobileCoin, also known as Sentz, is a peer-to-peer cryptocurrency developed by MobileCoin Inc., which was founded in 2017 by Josh Goldbard and Shane Glynn. History MobileCoin, was founded in 2017 by Joshua Goldbard and Shane Glynn. Signal's M ...
. This received criticism from security expert
Bruce Schneier Bruce Schneier (; born January 15, 1963) is an American cryptographer, computer security professional, privacy specialist, and writer. Schneier is an Adjunct Lecturer in Public Policy at the Harvard Kennedy School and a Fellow at the Berkman ...
, who had previously praised the software. Schneier stated that this would bloat the client and attract unwanted attention from the authorities. The wallet functionality was initially only available in certain countries, but was later enabled globally in November 2021.


Blocking

In December 2016,
Egypt Egypt ( , ), officially the Arab Republic of Egypt, is a country spanning the Northeast Africa, northeast corner of Africa and Western Asia, southwest corner of Asia via the Sinai Peninsula. It is bordered by the Mediterranean Sea to northe ...
blocked access to Signal. In response, Signal's developers added domain fronting to their service. This allows Signal users in a specific country to circumvent censorship by making it look like they are connecting to a different internet-based service. , Signal's domain fronting is enabled by default in Egypt, United Arab Emirates, UAE, Oman, Qatar, Iran, Cuba, Pakistan and Uzbekistan. , Signal was blocked in Iran. Signal's domain fronting feature relies on the Google App Engine (GAE) service. This does not work in Iran because Google has blocked Iranian access to GAE in order to comply with U.S. sanctions. In early 2018, Google App Engine made an internal change to stop domain fronting for all countries. Due to this issue, Signal made a public change to use Amazon CloudFront for domain fronting. However, Amazon Web Services, AWS also announced that they would be making changes to their service to prevent domain fronting. As a result, Signal said that they would start investigating new methods/approaches. Signal switched from AWS back to Google in April 2019. In January 2021, Iran removed the app from app stores, and blocked Signal. Signal was later blocked by China in March 2021, followed by its removal from the App Store in China on 19 April 2024. On August 9, 2024, Signal was blocked in Russia. Roskomnadzor claimed that this was due to "violations of the law on combating terrorism and extremism". Around the same, Signal was also blocked in Venezuela following the contested 2024 Venezuelan presidential election, 2024 presidential election and subsequent protests.


Audience


Use by activists

In 2020, the app was used for coordination and communication by protesters during the
George Floyd protests The George Floyd protests were a series of protests, riots, and demonstrations against police brutality that began in Minneapolis in the United States on May 26, 2020. The protests and civil unrest began in Minneapolis as Reactions to the mu ...
as they relied on the app's end-to-end encryption to share information securely. In March 2021, the United Nations recommended Myanmar residents use Signal and Proton Mail to pass and preserve evidence of human rights violations committed during the 2021 Myanmar coup d'état, 2021 coup.


Controversial use

Signal's terms of service states that the product may not be used to violate the law. According to a former employee, Signal's leadership at the time told him they would say something "if and when people start abusing Signal or doing things that we think are terrible". In January 2021, the position of Signal's leadership was to take a "hands-off approach to moderation" as the company's employees are not able to read user messages and the Signal Foundation does not "want to be a media company". In 2016, authorities in India arrested members of a suspected ISIS-affiliated terrorist cell that communicated via Signal. Radical right (United States), Radical right-wing militias and white nationalists use Signal for organizing their actions, including the Unite the Right II rally in 2018. The claim that Signal is used to fund terrorist or criminal activities is the justification for Turkey to criminalize the app for the general population, which Abdullah Bozkurt claims is a way the "government abuses its counterterrorism laws to punish critics, opponents and dissidents."


Use by Trump administration

In March 2025, it was revealed that senior members of the Second Trump administration, Trump administration—including vice president JD Vance, secretary of state Marco Rubio, and defense secretary Pete Hegseth—were using Signal to discuss sensitive information, including details of March 2025 United States attacks in Yemen, military attack plans in Yemen. The existence of the chat was disclosed by ''The Atlantic'' editor-in-chief Jeffrey Goldberg, who was accidentally added to the chat. Brian Hughes of the United States National Security Council, National Security Council later confirmed the authenticity of Goldberg's account.


See also

* Comparison of cross-platform instant messaging clients * Comparison of VoIP software * Internet privacy * List of video telecommunication services and product brands * Secure communication


Notes


References


Bibliography

* * * * *


External links

* {{Instant messaging 2014 software Cross-platform software Cryptographic software End-to-end encryption Free and open-source Android software Free instant messaging clients Free security software Free software programmed in Java (programming language) Free VoIP software Instant messaging clients programmed in Java Internet privacy software IOS software Secure communication