Encryption
Direct messages use X3DH and the Double Ratchet, with AES-256-GCM content encryption and a 60-digit safety number for verification.
This page states the design and its limits. The limits are stated because a security claim without its exceptions is not a security claim.
The design
- Key agreement
- X3DH. Each device holds an Ed25519 identity key that signs its prekeys, and an X25519 key for Diffie-Hellman.
- Session
- The Double Ratchet, as specified by Signal. A DH ratchet rotates root keys each round trip; two symmetric chains rotate a message key per message.
- Content
- AES-256-GCM, with a fresh key per message.
- Groups
- Sender keys. Each member has one ratcheted, signed sender key per group; a group message is encrypted once and the key is distributed over the pairwise sessions.
The properties this buys are forward secrecy, meaning old keys cannot decrypt new messages, and post-compromise security, meaning a session heals after a fresh key exchange.
Verifying a contact
Every conversation has a 60-digit safety number, displayed in blocks of five and identical on both sides. Compare it in person or over another channel. If it matches, no one is between you.
The number changes when a participant adds or reinstalls a device. That is expected, and it is exactly the event worth re-checking.
The limits
- Group threads are end-to-end encrypted up to 256 members. Above that size a thread is not end-to-end encrypted.
- Encryption covers content. The fact that a conversation exists, and when, is still visible to the service.
- Anyone in a thread can screenshot, copy or forward what you send. Encryption is not a promise about the other person.