← Privacy Guides

Communications

Signal: settings worth changing

Signal encrypts your messages end to end by default. These settings protect the account, the phone screen and your phone number.

  • Low threat
  • Time 15 minutes
  • Difficulty Easy
  • Last verified

What this protects, and what it doesn't

Protects

  • Your account against someone who re-registers your phone number on another phone (for example after a SIM swap).
  • Your conversations against an unnoticed change of keys: verified safety numbers show when a contact's keys change.
  • Your phone number from people who only know your username.
  • Old messages: disappearing messages limit how much history stays on a phone that is later lost or taken.
  • Message content shown on the lock screen and in the app switcher.

Does not protect

  • A phone that is compromised by malware, or unlocked in someone else's hands. They read what you read.
  • The other person. They can screenshot, photograph the screen, forward or show your messages. Disappearing messages do not stop that.
  • All metadata. Signal is designed to keep little, but your phone, your carrier and the networks you use still see that you use Signal and when.
  • Linked computers: a desktop linked to your account can read your new messages. If it is compromised, so are your chats.

Prerequisites

  • Signal installed and registered on your phone.
  • A screen lock on the phone itself (PIN, passphrase or biometrics).
  • A password manager for the Signal PIN and the backup recovery key.

Step by step

  1. Set a strong Signal PIN and turn on Registration Lock

    Your Signal PIN protects data that Signal can recover for you (profile, settings, blocked contacts). Registration Lock also requires that PIN before anyone can register your phone number on a new phone. This blocks most account takeovers through a stolen SMS code.

    • Turn it on in Settings, then Account, then Registration Lock. You can change the PIN under Settings, then Account, then Change your PIN.
    • Use an alphanumeric PIN and store it in your password manager.
    • Signal cannot reset your PIN. If you forget it while Registration Lock is on, you can be locked out of the account for up to 7 days.

  2. Verify safety numbers with the people who matter

    Each one-to-one chat has a safety number. If you compare it with your contact, you know nobody is sitting in the middle.

    • Open the chat, tap the contact's name for chat settings, then View Safety Number.
    • Best: meet in person and scan each other's QR code. Then tap Mark as verified. Verification is per side, so the other person must do it too.
    • If a verified contact's safety number changes, Signal warns you. The usual reason is a new phone or a reinstall. Check with them through another channel before you send anything sensitive.

    Newer Signal versions may also show “Encryption verified” from automatic key verification. That checks the keys, not the person behind them.

  3. Set a default timer for disappearing messages

    Go to Settings, then Privacy, then Default timer for new chats, and choose a duration (custom timers go up to 4 weeks). This applies to chats you start from now on. Existing chats keep their own setting, which you can change in each chat's settings under Disappearing messages.

    Disappearing messages limit what is left on lost or seized phones. They are not a defence against the person you are writing to: anyone can photograph a screen.

  4. Hide your phone number and use a username

    Under Settings, then Privacy, then Phone Number, there are two settings:

    • Who can see my number: set it to Nobody. Since February 2024 the default already hides your number from people who do not have it saved.
    • Who can find me by my number: set it to Nobody if you do not want people who have your number to find you on Signal. This setting is still Everybody by default.

    Then create a username under Settings, then Profile. A username must end with two or more digits. Give people the username, or your QR code or link (under Profile, then QR Code or Link), instead of your number. You can reset the link at any time.

  5. Lock Signal and hide it from the app switcher

    • Screen Lock locks Signal itself behind your phone's PIN or biometrics after a timeout you choose. It is separate from the Signal PIN. It is in Settings, then Privacy.
    • Screen Security (Android), called Hide Screen in App Switcher on iPhone, is also in Settings, then Privacy. It hides chats in the app switcher and blocks screenshots on your own phone, but not on anyone else's.
    • On Windows 11, Signal Desktop blocks screenshots by default so that Microsoft Recall cannot store your chats. Leave that on.

  6. Keep message text off the lock screen

    In Settings, then Notifications, set Show to No name or message (on iPhone: No Name or Content), or at least Name only. Also check your phone's own lock-screen notification settings, which can show content even when the app is set to hide it.

  7. Review linked devices

    Open Settings, then Linked Devices. Every desktop or tablet listed there can read your new messages. Remove anything you do not recognise or no longer use. If in doubt, remove them all and link again the ones you need.

    Signal's support pages warn about phishing that tricks people into scanning a “link device” QR code. Only scan a linking code that your own computer shows you.

  8. Decide how you back up, and guard the recovery key

    Without a backup, a new or reset phone starts with no chat history. Signal offers end-to-end encrypted Secure Backups (in Settings, then Backups). The free tier keeps your text messages and the last 45 days of media. Signal also supports on-device backups.

    • Setup gives you a 64-character recovery key. Store it in your password manager. Signal never sees it, and if you lose it the backup is gone.
    • The recovery key is not your Signal PIN. Keep both.
    • Think about whether you want a backup at all. A backup is one more copy of your history that someone with the key could read.

Common mistakes

  • Leaving Registration Lock off, so that a stolen SMS code is enough to take over the account.
  • Ignoring safety number change warnings for the contacts who matter most.
  • Treating disappearing messages as protection against the person you write to.
  • Forgetting an old linked laptop that still receives every new message.
  • Storing the backup recovery key and the Signal PIN only on the phone they protect.

Going further

At Medium or High threat levels: verify safety numbers in person with everyone sensitive, keep short default timers, avoid linking desktops you do not fully control, and harden the phone itself (see the full-disk encryption guide). Give contacts a username instead of a phone number, and set Who can find me by my number to Nobody.