Most messaging apps, including SMS, standard iMessage, WhatsApp, and Telegram, either don't offer end-to-end encryption, make it optional, or offer it in a way that still exposes significant data to the company. Signal was built from the ground up with end-to-end encryption as the default, non-negotiable foundation.

The Signal Protocol, the cryptographic system underlying Signal, has been independently audited and is now used by WhatsApp, Google Messages, and others. Signal itself is non-profit, open source, and funded by donations rather than advertising. Its business model doesn't depend on your data.

• Keeping message content private from Signal, your phone carrier, and anyone intercepting traffic, only the sender and recipient can read messages
• Protecting voice and video calls with end-to-end encryption
• Disappearing messages, messages can be set to delete automatically after a defined period on both devices
• Note to Self, an encrypted private notepad only you can access
• Hiding message previews from the lock screen and app switcher
• Screen security, preventing screenshots from being taken of Signal conversations
• Sealed sender, hides your identity from Signal's servers even when sending, so Signal can't see who messaged whom

It does not make you anonymous. Signal requires a phone number to register. Signal can see that you have an account. If your phone number is connected to your real identity, that connection exists.

It does not fully hide metadata. Signal knows which accounts exist and when they were last active. While it's designed to minimise metadata, and has demonstrated this in court proceedings, it's not zero.

It does not protect messages on an unlocked device. If someone has access to your phone while it's unlocked, they can read your Signal messages. Encryption protects data in transit and at rest, not from someone with physical access to your screen.

It does not protect deleted messages from forensic recovery on some devices. Disappearing messages help, but device forensics is a different threat model.

It requires both parties to use Signal. If the person you're messaging isn't on Signal, your conversation isn't end-to-end encrypted.

Signal requires a phone number. This is a privacy limitation for people who want to communicate without revealing a phone number at all. A dedicated SIM or VoIP number can reduce this exposure, but it doesn't eliminate it.

Backup options are limited compared to other apps, by design. Signal doesn't want your message history stored in a cloud backup that someone else might access. This means switching phones or losing your device can mean losing your message history.

Signal has occasionally faced criticism for moving slowly on features like multi-device support or username-based accounts. Some of these have improved over time.

Download Signal from the official site, signal.org or through your device's app store.

Enable disappearing messages as a default for sensitive conversations. Set a time period that fits, shorter is more private.

Enable screen lock so the app requires authentication to open.

Turn on the registration lock (Settings → Account → Registration Lock) to prevent someone from re-registering your phone number on Signal if they get access to it.

Verify safety numbers with contacts you care most about protecting. Signal gives each conversation a unique safety number. If you verify these match in person or through another channel, you've confirmed you're talking to the right person and not an intercepted connection.

The Signal Protocol. Signal uses a combination of several cryptographic primitives, the X3DH (Extended Triple Diffie-Hellman) key agreement for establishing sessions, and the Double Ratchet algorithm for deriving new encryption keys per message. This means that even if a key is somehow compromised, it only affects a narrow window of messages, not everything past and future.

Forward secrecy. Each message in Signal is encrypted with keys that are discarded after use. If a key were ever compromised, it couldn't decrypt earlier messages. This property is called forward secrecy.

Post-quantum cryptography. Signal has introduced PQXDH, a post-quantum variant of its key agreement protocol, to protect against future quantum computing attacks. Encrypted messages captured today couldn't be decrypted later even if quantum computing advances break current algorithms.

Sealed sender. Signal uses a technique that hides your identity even from its own servers when you send a message. The server sees that a message arrived for a recipient, but not who sent it.

Open source and audited. Signal's apps and protocol are open source. The protocol has been formally analysed by academic cryptographers and the implementation has been independently audited.

• Encryption, the technology Signal is built on
• Metadata, what even Signal can't fully hide
• Session, a Signal alternative that doesn't require a phone number
• Threat modeling, helps decide what level of messaging security you actually need