Every encrypted app faces the same question: how do you make sure the party you are talking to is who you think, and not an intermediary who has put themselves in the middle? The old answer was the “safety number”: a string you compare with your friend face to face, or over another channel you trust. Very few people ever did.
The new idea
A public log recording every binding between a phone number or username and its public key. The app searches that log on your behalf, and returns a green mark saying the encryption has been verified.
And the search does not read the whole log: it uses a binary search, more like a book’s index, so about thirty lookups are enough in a log of a billion entries.
Who vouches for the log
User data inside the log is cryptographically obscured: identifiers pass through a verifiable random function. Two independent parties sign every entry — Cloudflare and Trail of Bits — so no single party can secretly keep two different versions of the directory.
What you do
- Open the contact’s profile, then “View safety number”, then “Verify automatically”.
- The app checks your log periodically without being asked.
- To switch it off: Privacy, then Advanced settings, then automatic key verification. The manual safety number keeps working.
The limits, which the company stated itself
- It needs the phone number: someone you know only by username cannot be verified automatically.
- It stops at a number change: if your friend changes their number, your device can no longer tell that apart from server interference, so the feature falls away.
- It does not prove a person’s identity: the log binds the key to the number, not the number to its owner. If someone took over an entire account, automatic verification would stay green.
Which is why the alert when a safety number changes remains a necessary step rather than a redundant one.
Photo: a padlock on a door. By Mark Fischer, CC BY-SA 2.0 via Flickr.
Source: the official Signal blog, post of 11 August 2026.
Kuwait One, once a week.
The most useful stories we published this week, in your inbox.
No spam. Unsubscribe anytime.
