End-to-end encryption
End-to-end encryption means that messages are encrypted on your device before they leave it, and decrypted only on the recipient’s device. Signal’s servers relay the encrypted data but never have access to the keys needed to read it. When you send a message, Signal encrypts it using your recipient’s public key — a piece of cryptographic material they generated when they registered. Only their private key, which never leaves their device, can decrypt it. Even if someone gained full access to Signal’s servers, they would find only ciphertext they cannot read.The Signal Protocol
Signal uses the Signal Protocol, an open standard that combines two cryptographic techniques to provide exceptionally strong guarantees.Extended Triple Diffie-Hellman (X3DH)
When you start a new conversation, your devices perform an X3DH key agreement. Each side contributes several Diffie-Hellman key pairs — including a long-term identity key, a medium-term signed pre-key, and a set of one-time pre-keys — to derive a shared secret that neither side ever transmits directly. The server stores only pre-key material; the resulting secret is computed independently on each device and never touches Signal’s infrastructure.Double Ratchet algorithm
Once a session is established, Signal uses the Double Ratchet algorithm to derive a new encryption key for every single message. The algorithm combines two ratcheting mechanisms:- A symmetric-key ratchet that advances with each message.
- A Diffie-Hellman ratchet that periodically introduces fresh key material derived from newly generated key pairs.
Post-quantum protection
Signal also uses PQXDH — an extension of X3DH that incorporates a post-quantum key encapsulation mechanism (CRYSTALS-Kyber). This protects your conversations against an adversary who records encrypted traffic today and attempts to decrypt it in the future using a quantum computer.Forward secrecy
Forward secrecy means that compromising your long-term keys today does not expose past messages. Because the Double Ratchet generates fresh keys for every message and immediately discards old ones, there is no single key that unlocks a conversation’s history. Even if your device is seized, messages already deleted are gone cryptographically.Sealed sender
Normally, an encrypted message still reveals metadata — who sent it and to whom. Signal’s sealed sender feature hides the sender’s identity from Signal’s servers. When you send a message, Signal wraps your sender certificate (a short-lived credential that proves your identity to the recipient) inside the encrypted envelope. Signal’s servers see only the destination, not the source. The recipient’s device verifies the certificate after decryption. The certificate type depends on your phone number sharing settings. If you have phone number sharing disabled, Signal uses an ACI-only certificate that contains your account identifier but not your phone number, preventing your number from being disclosed even in the certificate.Sealed sender applies to all individual and group messages sent over Signal’s infrastructure. It does not change what the recipient can see — they still know who sent the message.
Safety numbers
Every Signal conversation has a safety number: a 60-digit code derived from both participants’ public identity keys. If the safety number matches on both devices, you can be confident you are talking to the right person and not a third party who has inserted themselves into the conversation.How to verify a contact’s safety number
1
Open the conversation
Tap the contact’s name or avatar at the top of the chat screen to open their profile.
2
View safety number
Tap View safety number. Signal displays a 60-digit number and a scannable QR code.
3
Compare with your contact
Compare the number with your contact in person, by phone, or through another trusted channel. Alternatively, each of you can scan the other’s QR code to verify automatically.
4
Mark as verified
If the numbers match, tap Mark as verified. Signal will alert you if the safety number ever changes, which can indicate a device change or, in rare cases, a key substitution attack.
Automatic verification
Signal can automatically verify safety numbers for contacts you communicate with, using cryptographic attestation from Signal’s key transparency infrastructure. You can enable or disable automatic verification in Settings → Privacy → Advanced → Automatic identity verification.Open source transparency
Signal’s client code for Android, iOS, and Desktop, as well as the server code, is publicly available on GitHub. The Signal Protocol libraries used for encryption are also open source and have been independently audited by security researchers. Anyone can inspect the implementation to confirm that Signal does what it says.Signal Protocol library
The open-source library that implements X3DH, Double Ratchet, and sealed sender.
Signal Android source
The full Android client source code, including encryption and key management.