Signal Security Checklist

A lot of community organizing happens in unvetted groups on Signal where you don't know how much you can trust everyone in the group. These groups can be infiltrated by right-wing adversaries and law enforcement.

Using a fake name prevents someone from finding your real identity through a Google Search.

Using a photo that isn't your face prevents someone from finding your social profiles based on an image match or facial recognition.

Both steps help defend you against doxxing and online harassment.

The same principle applies even more strongly to social media. If your Instagram, Facebook, or LinkedIn profile pairs your full real name with a clear photo of your face, attackers can easily identify you even if the rest of your profile is private. See Lock down social media for more.

Remind people in your groups to do these things too. Security is a team sport.

If you installed Signal before March 2024 when they introduced usernames, your phone number may still be set to be visible to others.

This protects you from certain attacks. But make sure you always take a close look at the URL that you're being sent to see if it's from a site you feel comfortable opening.

Technical Background: An attack was published in 2025 that allows an attacker to estimate your location within about 250 miles.

By default, Signal calls connect directly between you and the other person. This means the other person's device can see your IP address. With a court order to your internet provider, your IP address can be used to identify you specifically.

Enabling "Always Relay Calls" routes your calls through Signal's servers, hiding your IP address from the other party. (If you already use a VPN, your IP address is already masked.)

The best upgrade everyone can make to their use of Signal is to make sure that disappearing messages are enabled by default. Most activists we talk to haven't enabled this by default. (And most people forget to enable it manually for each new thread.)

This keeps you safe and other people safe. We don't know who's phone will be seized by law enforcement. Even if we believe we're talking about perfectly legal things, the government can find ways to twist our words to attempt to make a case against us for our dissent

There are two things to track related to disappearing messages:

1. First, change your default so any thread you make has this feature enabled.
2. Second, make sure it is enabled for threads that other people start: if someone else starts the thread, it may not have disappearing messages enabled. You may need to enable it.

Choosing your disappearing message time: How long you set your disappearing times depends on the sensitivity of your messages. A question you might ask yourself is "if someone's device was confiscated or hacked, how important is it that these messages are not accessible?"

• For chatting about low-risk things with friends, you might choose 4 weeks.
• For standard political organizing, you might choose 1 week.
• For a higer-risk actions, you might set it to 1 day or 1 hour or 5 minutes, so the messages are gone before the action starts.

If your phone is confiscated, there are two ways the cops can get access to your notification history:

1. They can see the notifications on your home screen without unlocking your phone.
2. If they use hacking tools, they can get access to the log of notifications your phone has received. (Example from the Prairieland case.)

This only applies to incoming messages. And this is a risk even after the message has disappeared from Signal (if you have disappearing messages enabled).

FYI: If you want to clear the notification log that iOS has already stored, the only way to do that is to factory reset your phone and restore it as a new device — not from a backup, as backups include the notification history.

• Screen Lock: If you hand your phone to someone while unlocked, this ensures they must provide the face/fingerprint/PIN unlock again before opening Signal.
• Hide in App Switcher: This will hide your messages when switching between apps.

This prevents the cops from seeing your Signal call history if they confiscate your phone.

If your phone is confiscated by law enforcement, one of the biggest risks is exposing your entire network. Even if people aren't using their real name on their Signal account, there is still a unique ID behind every Signal username. And the cops can use this to correlate someone's identity across many seized devices.

You need to both leave AND delete the group:

• If you only leave the group, old messages stay on your phone as well as the history of who was in the group.
• If you only delete the group, new messages will still come through and the thread re-appears.

Security hygiene tips:

• Set a recurring reminder to clean up your Signal thread every 3 months.
• Make sure you take note of which groups you are leaving and who you can ask to re-add you after the action.

Note: If you find this process very annoying and cumbersome (because it is!), that's another good reason to use a secondary phone for actions. That phone would only ever be in the one or two groups needed to pull off the action that day.

If a highly-motivated attacker is able to find out your phone number, they can attempt to take it over through something called "SIM Swapping" or by calling your service provider and initiating a phone number "port" to a new provider. They could then use your phone number to register a Signal account and start receiving messages meant for you.

These are advanced attacks that don't happen to most folks. Still, it is easy to protect your Signal account.

You can protect yourself by enabling registration lock on Signal. It prevents someone from hijacking your account even if they steal your phone number. No one will be able to register a new Signal account on your number until your account has been inactive for 7 days.

If you forget your PIN, you will have to wait 7 days before you can create a new account (and your contacts will not be recovered). More on PINs & registration lock.

On Android, the default keyboard can log what you type.

Google and Apple haven't made it clear when their AI tools are sending our private information (like Signal messages) off of our device onto their services. If they are sent to their servers, they are at risk of being accessed via a government court order.

Our understanding is that these AI features currently only summarize notifications. But with the way things are going, they might try to be more invasive.

Read our article on Is Apple Intelligence reading my Signal messages?

There have been an increasing number of fake messages from "Signal Support" that are attempting to hijack your account.

Use these examples below to keep an eye out for fake signal messages.

Remember: Signal will never ask you to send them your PIN or verification code. It will only be asked of you when you are installing the app for the first time on a device.

Read more about Signal scams/phishing.

Here are some examples of scam messages:

How long does it take to crack a passcode?

Note: These times only apply to phones. Computers can be cracked much more quickly, and need much stronger passwords.

Sources: The estimates in the table above assume real-world observed attempts/second from police forensic hacking tools. If you need more security, use a 10-digit passcode, which will protect you even under the highest-possible cracking scenarios. See the sources linked in the passcode FAQ here.

Every time a new operating system update comes out, it is fixing security holes. Each update you haven't installed represents a longer list of ways the cops can hack into your device. Think of it as as a big building with more and more doors left unlocked.

If your operating system is not up-to-date, many of the other recommendations in this guide will not protect your data.

Start with your phone. If you're doing something higher risk, make sure to update all your devices.

Caveat: Face and fingerprint unlock let you use stronger passwords without typing them all the time. If you have to choose, it's better to have a longer passcode than to turn off face/fingerprint unlock. If you leave biometrics on, make sure you know how to quickly turn them off if you're heading into a high-risk situation (see tips below).

Spyware is an advanced type of attack, exploiting sophisticated vulnerabilities on our devices. In response, Apple and Google have introduced an advanced security mode that offers enhanced protection against spyware.

On iPhones, it's called Lockdown Mode and on Android, it's called Advanced Protection Program. (You can also enable Advanced Protection Program on just your Google Account even if you don't have an Android phone.)

We have no reports of anyone getting infected with spyware who had Apple's Lockdown Mode enabled. Android's Advanced Protection is more recent and its effectiveness has yet to be tested.

Signal encrypts your messages so only you and the other person can read them. But in theory, a sophisticated attacker could position themselves in between you and your contact, intercepting messages before passing them along. This is called a "man-in-the-middle" attack. Safety numbers let you confirm that your encrypted connection goes directly to your contact with no one sitting in the middle.

Most people don't need to do this. If you're chatting with friends about everyday organizing, Signal's encryption is already doing its job. But if you're communicating about something high-risk (direct actions, sensitive legal matters, jouranlist talking with a source), verifying safety numbers is worth the extra step.

Think of it like a wax seal on an envelope. Encryption is the seal, but a sophisticated attacker could break it, read the contents, and reseal it with their own wax. Verifying safety numbers is how you confirm no one swapped the seal.