Is Signal safe?
Signal's encryption holds up. People get hurt through weak settings, scams, and their own phones.
Yes. Signal end-to-end encrypts every message, call, group, and profile by default, and when US courts have subpoenaed it, the only account data it could hand over was when a number registered and when it last connected. It is run by a nonprofit, the code is open source, and it carries no ads. The risks sit outside the encryption: a weak or missing Signal PIN, a phished verification code, a malicious "link device" QR code, and anyone who can unlock your phone.
What Signal protects
Everything you send in Signal is end-to-end encrypted with the Signal Protocol: messages, voice and video calls, attachments, group chats, your profile name, and your avatar. Signal's servers pass the encrypted data along but cannot read it.
Signal keeps upgrading the protocol. In September 2023 it added PQXDH, a layer meant to protect new chats against a future quantum computer. In October 2025 it added the Sparse Post Quantum Ratchet (SPQR), which extends that protection to the ongoing conversation instead of only the first handshake.
Signal publishes the subpoenas and warrants it receives, and since 2016 its answer has been the same: the only data it can produce is the date and time an account registered and the last date it connected. It cannot hand over messages, contacts, groups, or call logs because it never had them.
What Signal does not protect
Encryption protects data on the way between phones. It does nothing once the data is on a phone. If someone can unlock your phone, or has put spyware on it, they can read your Signal chats the same way you do.
Know these other limits before you trust it with anything sensitive:
- You still need a phone number to sign up on the normal app. Signal now hides that number by default from anyone who does not already have it saved in their contacts, and an Android beta lets you register without a number for a one-time $2.99 fee, but the standard route uses your number.
- Disappearing messages clean up your own history. Signal's own help page says they are not meant for chats where the other person is your adversary, since anyone can photograph a screen.
- Signal does no identity checks on profile names, so anyone can call themselves your exchange, your bank, or your friend.
- Linked devices see everything. In February 2025, Google's threat intelligence team documented Russian state groups tricking targets into scanning malicious QR codes that quietly linked an attacker's device to the victim's account.
Who owns the Signal app
The Signal Technology Foundation, a US 501(c)(3) nonprofit, owns Signal, and Signal Messenger LLC operates the app and service. WhatsApp co-founder Brian Acton created the foundation, which started with an initial $50 million in funding and was announced in February 2018.
Donations pay for its servers and development. There are no ads, and Signal's terms say it does not sell, rent, or monetize your personal data or content. The app and server code are published on GitHub, so anyone can check what the apps do.
How to set up Signal properly
The defaults are good. These settings close the gaps that get people robbed or impersonated.
- 1Install Signal only from signal.org, the App Store, or Google Play. Register with your number and type the SMS code into the app. Signal will never ask you for that code anywhere else.
- 2Set a strong Signal PIN when prompted. Signal lets you use letters as well as numbers and has no length limit, so make it long and store it in your password manager. Signal cannot reset it for you.
- 3Turn on registration lock: Settings > Account > Registration Lock. With it on, someone who takes over your phone number still cannot register your Signal account without your PIN, until the lock expires after 7 days without Signal activity.
- 4Hide your number: Settings > Privacy > Phone Number. Set "Who can see my number" to Nobody. If you also want strangers who have your number to be unable to find you, set "Who can find me by my number" to Nobody and create a username to share instead.
- 5Set a default disappearing message timer for new chats: Settings > Privacy > Default timer for new chats. A week or four weeks keeps old conversations from piling up on your phone.
- 6Verify safety numbers with the people you talk to about anything sensitive. Open the chat settings, tap View Safety Number, and scan each other's QR code in person. If the number later changes unexpectedly, ask why before you keep talking.
- 7Check Settings > Linked devices now and again. Remove any device you can't place, and if in doubt, remove every device and relink the ones you use.
- 8If you want backups, turn on Signal Secure Backups (Settings > Backups). They are end-to-end encrypted with a 64-character recovery key that Signal never sees. Text history and the last 45 days of media are free, and storing up to 100 GB of media costs $1.99 a month.
Signal app scams and how to spot them
Most Signal "hacks" are people being talked into handing over a code. Signal staff never start a chat with you. Announcements arrive in one view-only official chat with a banner that says it is the only official chat from Signal. Anyone else claiming to be Signal Support is a scammer.
| Scam | What it looks like | What to do |
|---|---|---|
| Fake Signal support | A message request from "Signal Security" saying your account will be locked unless you confirm a code. | Report and block. Signal never asks for your verification code, PIN, or recovery key. |
| Malicious QR code | A "group invite" or "security alert" that asks you to scan a code. | Only scan link-device codes you generated yourself on your own computer or tablet. |
| Investment pitch | A stranger with a trading or mining "opportunity" and screenshots of big returns. | Decline the message request. Nobody legitimate cold-messages you to manage your bitcoin. |
| Friend impersonation | A new account using a friend's name and photo, asking for money or a code. | Confirm through another channel. Check the safety number and whether you share any groups. |
Bitcoin scams follow the same scripts on every app. My Bitcoin scams guide covers the patterns in more detail.
Why bitcoiners should turn on registration lock
The attack that drains exchange accounts, a SIM swap, hands the thief your phone number and every SMS code sent to it. Without registration lock, that is enough to re-register your Signal account on their phone and start messaging your contacts as you. With the lock on, they also need your Signal PIN, unless your account has sat inactive for 7 days. Treat Signal like any other app on an internet-connected phone, too: never put a seed phrase in a chat, not even in Note to Self, and keep the words offline on paper or metal.
Frequently asked questions
Is the Signal app safe to use?
Yes. Messages, calls, and profiles are end-to-end encrypted by default, the code is open source, and court records Signal has published show it can only produce an account's registration date and last connection date. Set a Signal PIN, turn on registration lock, and keep your phone locked.
Who owns the Signal app?
The Signal Technology Foundation, a US 501(c)(3) nonprofit, owns it, and Signal Messenger LLC operates the service. Signal is funded by donations and carries no ads.
Can police read Signal messages?
Not from Signal's servers. Signal does not have your message content, so a subpoena gets only your registration date and last connection date. Anyone who gets your unlocked phone can still read whatever is stored on it, which is one reason to use disappearing messages.
Does Signal need a phone number?
The standard app does. Signal hides your number by default from anyone who does not already have it saved, and lets you connect through a username instead. An Android beta lets you register without a number for a one-time $2.99 fee, using an account ID and recovery key that Signal cannot restore if you lose them.
Does Signal support ever message you?
No. Signal staff never start a two-way chat, call, or text. The only official chat is view-only and labeled as such. Anyone messaging you as Signal Support or Signal Security is running a scam.