Signal

Signal is the messenger of the non-profit Signal Technology Foundation. Its README: “Signal is a simple, powerful, and secure messenger that uses your phone’s data connection (WiFi/4G/5G) to communicate securely.” Its store listing: “Everything you send and receive in Signal is end-to-end encrypted.” You register with a phone number, and can then share a username instead of it. Signal is also testing registration without a number, for a fee (see below).

The website build

Signal publishes its app on Google Play and on a page on signal.org titled “Website distribution build”; its GitHub releases carry another APK, a separate build from the website file. That page puts the download under “Danger zone”: “Advanced users with special needs can download the Signal APK directly. Most users should not do this under normal circumstances.” The project explains why it exists: “For people without access to the Play Store, we provide a version of our app via our website. Unlike our Play Store build, the website APK is a larger “universal” APK so that it’s easy to install on a wide variety of devices.”

It has the same package name as the Google Play version. Signal doesn’t say whether one installs over the other.

Registering without a phone number (beta)

Signal is testing a way to create an account without a phone number, called Signal Login. Its support article, “Phone Numberless Registration for Android beta”, last updated on 8 October 2026: “The latest Signal beta update for Android introduces an optional way to create a Signal account. Signal Login lets you create and use a Signal account without a phone number. Instead, you make a small one-time purchase, and Signal gives you a set of cryptographic keys that serve as your account identity going forward.” Its steps begin “Launch Signal beta version 8.28 or later”, and the fee, $2.99, is paid with Apple Pay or Google Pay. You get a 32-character account ID and a 64-character recovery key: “If you lose both of these keys, Signal has no way to recover your account for you.” Without a username, “other users won’t be able to find or contact you on Signal.”

The code of 8.33.2, the version on signal.org that we host, has this feature switched on, with a “Register without number” button on the phone-number screen. Signal, though, still presents it as a beta feature, and we haven’t checked whether it works in this website build. In the code, buying a Signal Login goes through Google Play billing, which needs Google Play services and a Google account in the Play Store; signing back in with an existing account ID and key involves no payment.

Updates and expiry

This build manages its own updates, which the Play version leaves to Google Play. From the code of this version: every six hours it reads Signal’s update file at updates.signal.org; when there is a newer version, it downloads it over Wi-Fi only, without a progress notification, checks the file’s SHA-256 against the update file, and then asks you to tap to install. There is no setting to turn this off.

Like every Signal build, it expires 90 days after the last source commit embedded in it, or earlier if Signal says so; it then stops sending and receiving messages until you update. A notice warns you in the days before.

Google components

Both builds include Google’s push service, Firebase Cloud Messaging, with its analytics parts excluded, and Google Maps for sharing a location. Without Google Play services, Signal gets messages in other, less efficient ways, as described in the questions below.

What goes online

• Signal’s servers, for messages, calls, contacts and the update check.
• Link previews, which your phone fetches directly from the website you link to. They are optional: Settings › Chats › Generate link previews.
• GIF search, through Signal’s own proxy to GIPHY.
• DNS: your phone’s resolver first, then Cloudflare’s 1.1.1.1, then addresses built into the app.
• Censorship circumvention, routed through Google and Fastly, is on by default only for phone numbers from nine countries; Brazil isn’t one of them. Accounts without a phone number never use it. Since 8.31, while it is on, downloads of attachments and storage requests go directly to Signal’s servers when the chat connection itself works directly.
• Google for push notifications and maps, as above.

About this file

• This is the file signal.org offers for download, byte for byte: version 8.33.2. It matches the SHA-256 hash in Signal’s update file, and it is signed with both certificates whose fingerprints the download page publishes: a 4096-bit one for Android 13 and later and the original 1024-bit one for older versions.
• Signal’s 8.33 release note highlights a redesigned keyboard for emoji, stickers and animated GIFs. The 8.33.2 patch specifically fixes a crash when opening a conversation in single-pane mode; the registration without a number described above stays switched on.
• The 115.0 MB file runs on Android 6.0 and later, on ARM and x86, 32- and 64-bit, and declares 77 permissions: contacts, the camera and microphone, location for sharing it, photos and videos, notifications, calls through Android’s phone interface, battery-optimisation and exact-alarm permissions, installing its own updates, Google’s push service, and 17 for unread badges on various launchers.
• Signal is licensed under the AGPL-3.0; Google’s push-service, maps and billing libraries in it are not open source. It bundles emoji images in Apple’s style and several fonts, for which the project gives no licence or origin.
• The app is translated into Brazilian Portuguese: Signal Settings › Appearance › Language.
• The screenshots are Signal’s own promotional images from its Google Play listing.

CPU types in this build: arm64-v8a (64-bit ARM, almost every phone since 2017); armeabi-v7a (32-bit ARM, older and budget phones); x86 (32-bit Intel, emulators); x86_64 (64-bit Intel, emulators and Chromebooks).