Signal has rolled out a new security feature called Automatic Key Verification, designed to enhance the integrity of encrypted conversations and protect against man-in-the-middle attacks. The feature, announced on August 12, 2026, is part of a broader "key transparency" system.
This new system leverages independent third-party auditors, specifically Cloudflare and Trail of Bits, to verify the integrity of Signal conversations. The mechanism is intended to provide the same level of assurance as manually verifying safety numbers, but without requiring in-person meetings or secondary communication channels.
According to Signal software engineer Katherine Yen, the system works through a series of verifications performed by the user, their Signal connections, and the third-party auditors. This collective verification process ensures that the association between a phone number or username and its public encryption key is globally consistent and transparent across the Signal ecosystem. This consistency helps to prevent scenarios where a key might be illicitly swapped without the owner's knowledge, such as if a malicious actor were to compromise Signal and associate a different key with a user's connection.
Users can activate Automatic Key Verification by navigating to Settings, then Privacy, then Advanced, and toggling on the feature. Additionally, when on the safety number verification screen, users can click "Verify Automatically" to check the public key of the Signal contacts they are chatting with. A successful verification will display a green checkmark and an "Encryption verified" message within the app.
For users who prefer not to rely on Signal or the independent auditors, the automatic key verification feature can be disabled in the privacy settings, allowing them to continue using manual safety number verification. Signal stated that key transparency offers an easy-to-use method to confirm a crucial aspect of messaging security, complementing their existing safety number system.
This new feature follows other security enhancements introduced by Signal in May, which included new warning messages and in-app confirmations. These earlier safeguards were designed to give users more time to assess the safety of external requests, counteracting phishing and social engineering attempts. Those measures were prompted by attacks attributed to Russian state-sponsored hackers, who reportedly targeted high-profile users with fraudulent "Signal Support" alerts. These attackers exploited Signal's Linked Device feature to gain unauthorized access to target accounts, chats, and contact lists, as confirmed by reports from the FBI, German authorities, and the Dutch government.
In June, the U.S. Department of State announced rewards of up to $10 million for information leading to the identification or location of members of the UNC5792 and UNC4221 hacker groups. These groups have been linked to widespread phishing campaigns specifically targeting Signal users. The FBI has also previously reported that Russian hackers are targeting Signal backup recovery keys.
