Signal is a secure, free, and open source messaging application that uses end-to-end encryption to securely send and receive all kinds of communications with other Signal users. Using the Internet for all encrypted communication, Signal comes highly recommended by some of the top privacy and security advocates.
In this Signal review, we’ll look at the capabilities, usability, and security that Signal offers. We’ll also talk about how the design of the service provides extremely strong protection for your privacy. Signal is truly impressive, so let’s cut the chatter and dig in to the review.
Signal Pros and Cons
+ Pros
- End-to-end (E2E) encryption
- Encryption algorithms: Signal protocol, with Perfect Forward Secrecy (PFS) for text messages, voice messages, and video calls
- Open source software
- Disappearing messages (aka self-destructing messages)
- Published transparency reports
- Logs minimum amount of data
- Does not log IP Addresses
- Free
– Cons
- Requires a telephone number to sign up
- Occasional problems with sending and receiving
Now we’ll briefly cover the main features of Signal encrypted messenger.
Feature summary
Here are some key features to consider when deciding whether the Signal app is right for you:
- Signal is generally considered the most secure messaging app in existence.
- 100% open source code. The code is available on GitHub.
- The Signal Messaging Protocol was independently audited in 2016.
- The service is fully GDPR compliant.
- Clients for Android, iOS, Mac OS, Windows, Linux.
Company information
In 2013, Moxie Marlinspike (real name Matthew Rosenfeld) founded Open Whisper Systems to develop the Signal app and protocol. In 2018, Marlinspike and Brian Acton founded Signal Messenger, LLC, to take over the development of both the Signal app and the Signal Protocol.
Signal Messenger, LLC is funded by the Signal Technology Foundation (aka Signal Foundation), a 501(c)(3) non-profit organization. All products of the Signal Foundation are published as free and open-source software.
Where is your Signal data stored?
When you use Signal, your data is stored in encrypted form on your devices. The only information that is stored on the Signal servers for each account is the phone number you registered with, the date and time you joined the service, and the date you last logged on. As Signal points out,
Notably, things we don’t have stored include anything about a user’s contacts (such as the contacts themselves, a hash of the contacts, any other derivative contact information), anything about a user’s groups (such as how many groups a user is in, which groups a user is in, the membership lists of a user’s groups), or any records of who a user has been communicating with.
All message contents are end-to-end encrypted, so we don’t have that information either.
This is great for your privacy, since no one can get any more information than that without physical access to your device or those of the people you communicate with.
This is different from apps like Wire messenger, which stores info about your contacts on central servers. However, it does mean that if you want to keep copies of your messages, you will need to configure Signal to back them up and restore them on your device.
Follow this link for instructions on using Signal backup and restore.
Third-party testing and audits of Signal
Even when a product is 100% open source like Signal, you don’t really know how good it is until someone checks it out. Here are some published findings by experts you can review to see how good Signal really is.
Signal security audits
A formal security analysis of the Signal protocol was conducted in 2016. According to that analysis, conducted by researchers from Germany, Switzerland, the United States, and Canada, there were no major flaws in the design. It showed that the protocol was cryptographically sound.
This analysis has been updated several times since, without changing the researcher’s conclusion that the protocol is sound. The last update was published in July, 2019.
Note: In September, 2019, a bug in the user interface of the Android version of the Signal app was discovered that could have allowed an attacker to eavesdrop on Signal users.
According to Vice.com, the bug was fixed the same day it was reported. This incident shows both the responsiveness of the Signal team, and the importance of keeping your copy of the Signal app and desktop updated.
Signal hands-on testing
For purposes of this Signal review, I tested out the mobile app for Android, along with the Linux desktop app.
Note: Signal is different than many other secure messaging apps in that you need to install and register it on a mobile phone before you can use it anywhere else. Therefore, I’ll address the mobile (Android) app first.
Installing Signal on an Android phone
Installing Signal on an Android phone involves downloading the app from Google Play and registering your phone using your telephone number. Some people object to registering using a phone number instead of an email address or anonymous username.
But registering with your phone number lets Signal connect easily to your phone’s contact list. Another benefit to this approach is that it lets Signal replace your phone’s built-in messaging app on Android devices.
Note: You can download an Android Signal APK here, and install the app that way, but Signal recommends against it unless you are an advanced user with special needs that would justify doing so.
Once you finish installing and registering your account, the Signal app will use your Internet connection to securely communicate with other Signal users by text, voice, video, group messaging, even file sharing, all using the secure Signal protocol.
Note: If you replace Android’s messaging app with Signal, you will need to distinguish between Signal users and non-users before sending messages. That’s because Signal cannot send encrypted SMS or MMS messages, meaning messages to non-Signal users will not be secure. Signal notifies you whenever you are messaging someone with a Signal account, and will offer you an easy way to invite non-users to join Signal when you connect to them.
Working with Signal
When you open Signal app you’ll see a list of your current phone contacts who are Signal users. The interface itself is clean and includes a wealth of information about the status of your contacts and your communications with them:
Tap the listing for a particular contact to open it. You’ll see the full thread of your conversation with that contact, the same as you would with any other messaging app.
But Signal has a number of features that can enhance your privacy, adjust the user interface, or just have fun adding things like animated stickers. Here are some of those features:
- Secure connection indicators – For iOS and Desktop Signal apps, all communications are always secure. For the Android app, the text input field for a conversation will show the words, “Signal message” and the Send icon will be blue and include an image of a closed lock when the connection is secure.
- Message reaction emojis – Quickly reply to messages with emoji reactions.
- View-once media – On mobile devices you can configure individual photos and videos to disappear after they have been viewed once.
- Group chats – Stay connected with your family and other groups of people.
- Insights – For Android users, a system that shows you what percentage of your Signal messages were sent encrypted.
- Disappearing messages – Set messages to disappear from both your and the recipient’s devices after a set amount of time has elapsed.
- Safety Numbers – Verify that you are communicating with the device you expect to be talking to by comparing safety numbers.
- Encrypted stickers – Add some fun without compromising your security.
Not only are the Signal mobile apps good looking and feature packed, they are also well made. Reviews are also good with Signal receiving ratings of 4.8 out of 5 stars at the Apple app store and 4.5 out of 5 stars at the Google Play store.
Signal Desktop clients
Signal officially supports the following desktop platforms:
- Windows
- Mac OS
- Linux (64 bit and 32 bit)
Installing Signal Desktop for Windows or Signal Desktop for MacOS is just like installing any other app. It only takes a moment to download, and seconds to install.
Installing Signal Desktop for Linux isn’t a particularly user-friendly process. You need to be able to do a bit of work on the Linux command line, but after a couple of steps you’ll have Signal Desktop for Linux installed and ready to run.
Because your phone number is the only way Signal can identify you, you need to link your account to Signal Desktop. Launching Signal Desktop for the first time displays a QR code you can use to make the connection It will look something like this:
Follow the directions on the bottom of this window to connect Signal Desktop to your mobile device and sync your data between the two.
Once the desktop is synched to your mobile phone, you’ll see that clean Signal interface along with your contacts.
I’ll leave it up to you to explore what else the Signal Desktop can do besides displaying those fun stickers!
Support
Signal Support is a searchable collection of around 70 articles addressing the most common questions and topics a Signal user might want information on.
For cases where this isn’t enough, you can hit the Contact Us link at the top of the page to submit a help ticket.
How secure and private is Signal
When it comes to security, the Signal messaging protocol is generally considered to be the most secure messaging protocol available. It is so good that many other messaging products, including Facebook Messenger, Skype, and WhatsApp, claim to have adopted the protocol for use in their own products.
When it comes to privacy, Signal is also a winner. As we discussed earlier, Signal only records three bits of information about their users. This is far less information than other services collect.
And you can take the privacy protections even one step further. This article has detailed instructions for registering a Signal account without disclosing your personal phone number.
Transparency reports
Signal has published only one transparency report, which you can see here. The report, from October 2016, is incredibly detailed, even including transcripts of the subpoena used, and all the additional communication that passed back and forth.
It would be great to see more transparency reports, on a regular schedule, like we see with other services. For example, we noted regular transparency updates in our ProtonVPN review. As another example, Surfshark has a warrant canary that is updated daily.
Signal business features
Unlike other messaging services, such as Wire, Signal offers only a single, free version. There are no pricing tiers, no extra-cost features, and no business-specific features. This is consistent with the idea behind the product, which is to become the most secure messaging app available. Nothing more, nothing less.
Signal prices
The Signal pricing model is about as complicated as the list of Signal business features. The price for everything they publish is zero.
Everything is free and open source software.
While you can use everything from Signal free of charge, the Signal Technology Foundation is an independent 501c3 nonprofit. They are committed to developing open source privacy technology that is desperately needed in this world of endless surveillance. You can make a contribution to the organization by visiting this page, and following the directions you find there.
Conclusion: Consider using Signal today
Signal is clearly one of the leading secure messaging apps available today. While some people dislike the requirement to register with a phone number, the design of the whole system is such that it is hard to see this as a major problem. I have no qualms about recommending Signal to anyone investigating encrypted messaging services for personal use.
It is also a great alternative to WhatsApp that people are flocking to in 2021 as privacy concerns mount with WhatsApp and Facebook.
But you don’t need to take my advice on this. Users are flooding into the Signal camp from all directions. According to this February 2020 article at The Verge, The European Union has told its staff to switch to Signal for all its public instant messaging.
And let’s not forget these endorsements from big-name privacy and security advocates:
The most recent “big name” recommendation for Signal came from Elon Musk in response to the latest WhatsApp privacy issues.
What else is there to say?
Is Signal right for you?
It is hard for me to imagine someone reading this post for whom Signal would not be the right secure messaging app. And remember: If the need to register with a phone number really bothers you, read this article for alternatives to giving Signal your personal phone number.
One other reason not to try Signal: if most of the people you need secure messaging for are already using another secure messaging service like Wire or Telegram, it might make sense to join them there instead of trying to get them to all move to Signal.
Beyond those cases, I believe that anyone looking for a secure messaging service should try Signal now.
For alternatives, check out our roundup of the best encrypted messaging apps, or the other reviews below.
This Signal Messenger review was last updated April 27, 2024.
None of these “private” are in any shape or form actually private. Asking for a phone number? No privacy. Personnel, servers, and infrastructure located in the U.S., the inventor of Global Surveillance? Worst possible privacy.
A real private messenger will have the following characteristics:
-Head office will be located outside the U.S., in Switzerland in Europe or in some tax haven island in the Pacific.
-Signup with email; no harvesting of contacts
-CEO and Board of directors commit publishing online any attempts by the U.S. government to interfere, pressure, hack, or otherwise interfere with the course of business.
But be careful because Uncle Sam doesn’t no for an answer. I expect this upstart service to last a couple of months only, the time required for the NSA to find a way to infiltrate and destroy the servers.
It’s interesting that Bill’s review of Telegram mentions there are better privacy options, but he overlooks that Signal, just like Telegram, also demands a real mobile number for registration. Unless you’re up for paying for a premium virtual number service, the free options won’t cut it. This key point should definitely be highlighted in his review.
Also interesting that he mentioned Session’s problematic Australian jurisdiction and subsequent Five Eyes membership several times in that review, but fails to mention Signal’s equally problematic US jurisdiction and Five Eyes membership.
Good catch!
All tech reviewers are biased towards Signal. That is quite suspiciouos
Also Signal is making millions via US government open source funding
It is strange that Signal is being promoted everywhere and not Threema
Here is a BIG BIG downside of Signal.
Apart from getting the announcement “(contact) is on Signal” there are some basic flaws and they are the default settings. Why the hell would you want to have your contacts gone through or the number show by default (at the time etc) but the biggest failure is pinging and storage of your old details ie.
What you do is this: Grab someones number, stick it into Google Contacts. … Wait.
Then up comes their signal, telegram, whatsapp, Google Duo, and then sometimes their old Signal photo appears – like Telegram people might think they;’ve changed or deleted their photo and it’s still around.
yea, nah. ..
Hi there,
Thanks for this great review of Signal!
There seems to be a small detail that might need updating. Signal actually discontinued SMS/MMS support a while back, so it currently focuses solely on secure messaging.
Just a thought, perhaps including screenshots of the current version of Signal app would help reflect this change?
Overall, this is a fantastic review that highlights Signal’s strengths. Thanks for helping others stay secure!
How secure is the disappearing messages feature? Is it possible to recover messages that have disappeared beyond the time period?
I am poor man pleas help.me
This is excellent! Now Signal’s encryption can resist efforts that involve using supercomputers to break the app’s encryption. If you don’t use Signal, please consider doing so.
https://arstechnica.com/security/2023/09/signal-preps-its-encryption-engine-for-the-quantum-doomsday-inevitability/
WARNING! Seriously flawed backup capabilities can be a big issue if your messages are important. I got a new iPhone and made a complete data transfer from the old one. When I opened Signal on my new phone I realized that all my chats were gone. Turns out Signal does not support transfer between devices. I panicked since I have supercritical information in some of my chats. To my big relief, I discovered that the old conversations are of course also locally stored on my laptop. So….obviously I want to protect these with a backup. Again, turns out that this is not an option. No backup can be made. Then surely a conversation can be exported? Again; there is no export option of any kind. Print the conversation to a printer or a PDF? No such luck, no print function.
This means that my data is under the mercy of my hard disk and WILL be lost with it the day it fails or is lost for any reason. Total deal breaker here. Absolutely mind-boggling failure of data safety, which is exactly what Signal has as the primary sales pitch. I guess with safety they mean no one can read your conversations, not even you.
any person with half functional brain does not use or put their “super critical information” chats online.
An online chat may very well constitute super-critical information. Have you been living under a rock or is your brain only half functional?
you have just described yourself.please take your meds.
You can make screen shots of your messages and save or print the images. Not ideal but a way to copy,
Best regards
Im sangal
Sven Sir please can you tell what is the problem with using WhatsApp? There is end to end encryption and there are also no advertisement.
Please tell.
@DuskyHusky WhatsApp is owned by Facebook and they have the encryption keys to use in order to mine people’s data and snoop into their conversations anytime. If you use WhatsApp, I suggest you dump it for Signal.
so, if Facebook wants to mine my stuff anytime, it’s frowned on. but with your sneaky, illegal installation of the hidden equipment on my phone is AoKAy??
@Joel, daNEIL LOL see above. Signal’s encryption has been updated to even make it nearly impossible for supercomputers to break. Far from being “sneaky” or “illegal.”
Who is financing signal? I get it is a non profit but who is financing this non profit?
Anyone with a heart for integrity (includes security) will be happy to refrain from using software with connections to W Gates (Windows, WhatsApp, LinkedIn), Zuckerberg (Facebook) and Google. This is not so much, these days, a technical issue as an ethical one.
I refuse to use apps that have to be sourced from Google PlayStore. That includes my bank’s mobile app. Alternatives can be found!
Clues may be obtained from Psalm 37, parallel reading can be done on non-MSM blogs, especially those monitoring activity at Gitmp.
Meta Data
Is Signal for you?
Ask yourself a simple question. If you lose your iPhone (or it’s beyond repair), will you be ok losing all your message history in there? If it’s not ok, stay away.
I know many who switched to Signal, only to switch back after learning a painful lesson of losing all the precious chat history (particularly with the one you wouldn’t able to chat any more …)
Sorry, S. W., you are wrong. I have my Signal account duplicated on my computer. Losing the phone would lose nothing.
“Signal just killed off the one reason I had that I could possibly get people to use Signal”. Scary line. Now that Wickr Me has been taken over by Mephisto, is Signal gone too?
But this particular piece of news was nothing to worry about. Removing SMS is a good choice. You may accidentally use it, if it’s there. People who use SMS are hopelessly naive per default. Even if the message content is encrypted, all the metadata will give away too much about you and your communication.
Signal’s own messaging has metadata too, but — I hope this is still true — it’s less convenient for regimes to get it from Signal than from the local telecom oligopoly corporation (nowadays I count Western states as “regimes” as well).
If they are using Signal, and so is everyone else I get, then that is more security. So it isn’t about just using SMS. The problem is most will not want to take the extra time setting up a more secure SMS.
Therefore, I am using a general SMS to talk to all, but Sessions for privacy and security.
By making this move, Signal is trying to go head to head against systems like Sessions. Right away they are lost.
Sessions has the same security as Signal, so nothing new. But Sessions doesn’t require a phone number. I can use screen names, I am not bound by Google notifications.
As for the countries, they are both bad (US vs. AU) so the extra privacy Sessions offers takes it over the top.
So now I have to try to get people to a system that will take more to set it up but if they don’t want to add a SECOND messenger, then it is either I communicate with them SMS or I don’t.
I was using Simple Messenger but it started to get bogged down and now I am using Textra.
A few additional words about Signal:
The main developer (Moxie), was harassed at airports, when Signal was Textsecure and even put on a no fly list, presumably for failure to cooperate with authorities. Then ‘all of a sudden’, several things happened: Textsecure morphed into Signal and SMS encryption was dropped. At the same time, not only problems at airports stopped, but Moxie received a multi-million $$ infusion from a US government affiliated entity + lucrative contracts with Whats up and Facebook. You don’t get that by chance. You don’t get off no fly list without a reason.
So, in my view, Signal development has been compromised for years.
Additionally, Signal recently dropped SMS feature altogether citing the main reason, as SMS were insecure. Dah, it became insecure, when they dropped SMS encryption.
Well, signal just killed off the one reason I had that I could possibly get people to use Signal.
RIP Signal. I have already switched to Simple Tools SMS messenger. I am also still using Sessions.
https://signal.org/blog/sms-removal-android/
Sven,
Forgot to ask, does this affect your openiin of Signal?
Yes, I will probably have Session and Threema as the top messengers, but we’ll see with the next update.
OK. Thanks.
I have been using Sessions and love it.
but for general SMS, Simple Message is really good. off FDroid.
Signal, in a back door attack, had a few users hacked.
https://optf.ngo/signal-mobile-numbers-and-the-twilio-hack/
Disappearing messages can be seen as both an advantage and a disadvantage. Therefore, this function should be considered neutrally?
Here are more cons:
[https://www.freie-messenger.de/en/warumnicht]
When looking at/evaluating a messenger, one should not only look at the issue of security as the sole criterion. There is also freedom, independence, data protection, privacy, sustainability, … Not everyone understands the same under “security” and there is also so-called pseudo-security:
[https://www.freie-messenger.de/en/begriffe/pseudosicherheit/]
Messenger quick overview (PDF downloadable in multiple languages):
[https://www.freie-messenger.de/en/systemvergleich]
Thoughts on “Alternatives to WhatsApp”:
[https://www.freie-messenger.de/en/messenger/gedanken]
And lastly, a unique overview of messenger comparisons:
[https://www.freie-messenger.de/systemvergleich/externe_vergleiche/]
Unfortunatley Back Restore doesnt work!!??!! Just lost over 2 gigs of backups when phone died and I had to use another.
Had backed up and created backup file. Had checked the 30-char code i had worked.
However, when you try to restore the data it just doesnt work. No error, no crash, it just doesnt work. Steer clear!!!
I learned that Elon Musk also recommends Signal.
Now, this makes me suspicious. I would say Snowden is trustworthy, but Musk is not.
[https://www.econotimes.com/WhatsApp-alternative-Elon-Musk-and-Edward-Snowden-recommend-Signal-following-policy-changes-on-Facebook-owned-messaging-app-1599847]
This is classic ad hominem. Elon might be terrible, but he can still be right about something.
recent app download comments (1-22-22) for Signal app on GoOgle NotPlayNice Store states that Signal has been compromised, no longer e2e, no longer private, back door leak to Signal reps to allow government overreach and intrusion.
{{{{{sigh}}}}}
chairman of the board Katherine Maher is responsible. Signal hired Maher who is a social justice warrior type. You know, the ones always babbling about fascism. Yeah, her.
https://www.city-journal.org/article/signals-katherine-maher-problem
Well, watching a video from an interview of a gentleman charged in the 6th of the year fiasco in which he reported that B B somehow breached sgnl? if so, it would not surprise me. Just amazing our own tnemnrevog is eavs drpg on its own….. No account a b i l i t y. I thought the ctzens were in charge and B B works for us. LOL
Hello! Would you like to check on Olvid? Ditched Signal to Olvid, but it is still new and lack of peer review.
https://olvid.io/en/
@magic8 their mobile clients were recently open sourced, which is good, but not their server. I suggest you consider going back to Signal.
https://github.com/olvid-io
What about Berty?
Signal CEO and founder Moxie Marlinspike announced today that he is stepping down and WhasApp Executive Chairman Brian Acton will take the helm until a replacement is found.
https://thehackernews.com/2022/01/signal-ceo-resigns-whatsapp-co-founder.html
“Executive chairman and WhatsApp co-founder Brian Acton, who famously urged users to #DeleteFacebook in March 2018 and founded the Signal Foundation along with Marlinspike after he walked away from the social media giant in 2017 over a conflict with Facebook’s plans to monetize WhatsApp, will serve as the interim CEO while the search for a replacement is on.”
Brian Acton left Whatsapp and co-founded the Signal Foundation
That’s guilt by association – no way. Anyone associated from the DNA of FB and Whatsapp means they bring to the party all their dirty laundry.