Signal has introduced Automatic Key Verification (AKV), a new security feature designed to prevent man-in-the-middle attacks that could compromise encrypted chats. The feature, announced on Tuesday, August 11, 2026, aims to ensure users are communicating with the intended contact by verifying their public encryption keys.
Signal is widely used by individuals who prioritize privacy, such as diplomats, activists, and journalists. Its existing security measures include end-to-end message encryption and "safety numbers," which are cryptographic fingerprints that users can compare to confirm the integrity of their connection. However, a theoretical vulnerability remained where a malicious actor could tamper with Signal's centralized directory of accounts, impersonating a user and redirecting encrypted messages.
AKV addresses this by establishing a new architecture that detects unauthorized changes to public keys. From a user's perspective, activating AKV is straightforward: users can navigate to a contact's profile, access the "View Safety Number" screen, and tap "Verify automatically." A green checkmark will then indicate that the contact's public encryption key aligns with Signal's key transparency system.
Behind the scenes, Signal has developed an open-source key transparency server that functions as a ledger of public keys. Every modification a user makes to their account information, such as changing a phone number or username, creates a new entry in this ledger. An accompanying index allows users to verify information about themselves or their contacts, ensuring it has not been altered by a third party attempting to intercept messages. Signal's system automatically searches this index on behalf of the user to retrieve the most current information.
To further bolster trust, Signal has engaged third-party auditors, Cloudflare and security firm Trail of Bits. Their role is to verify that Signal's key transparency server itself has not been compromised. These auditors check the index for any signs of tampering and, if clear, sign the response to confirm that the keys provided are consistent for both users, thereby mitigating the risk of a man-in-the-middle attack.
The system also incorporates a monitoring component. Users can interact with the ledger in two ways: by looking up another person's address and by looking up their own. The Signal app periodically and automatically checks a user's own ledger entries. Combined with the ability to manually verify a connection's data via the "Verify Automatically" button, this creates a comprehensive detection system. Auditing ensures that both parties are viewing the same data, while monitoring guarantees regular checks for data accuracy.
A key requirement for using AKV to verify another user is having their phone number linked to their Signal account or present in the user's phone address book. Without this, AKV cannot be used for verification. Users who prefer not to involve a third party in their identity verification have the option to disable AKV and can instead rely on traditional safety number or QR code verification methods.
