Signal introduces Automatic Key Verification to detect suspicious encryption key swaps

Signal is rolling out Automatic Key Verification, a new feature designed to enhance the security of end-to-end encrypted conversations. This addition automatically confirms that each user's phone number or username consistently matches the correct encryption key, supplementing the existing manual safety number system and helping detect unexpected key swaps that could enable man-in-the-middle attacks. The process is powered by key transparency, which maintains a cryptographically verifiable log of changes to user identifiers, such as account recreation or updates.

Unlike manual verification, this system works without face-to-face meetings, QR code scanning, or secondary communication channels. Users can initiate automatic verification via a contact's profile, and, when successful, Signal displays a green checkmark with an “Encryption verified” status. The feature leverages checks from the user's app, their connections, and independent review by third-party auditors Cloudflare and Trail of Bits, ensuring that everyone sees a consistent state of the key directory, without exposing plaintext user data.

While the system requires access to the other person's phone number, and doesn't work with username-only connections, it covers cases where contacts are added by phone number, from the address book, or when numbers are made publicly visible. If phone numbers change or are outdated, Signal recommends reverting to manual verification. Key transparency confirms encryption consistency but doesn't really authenticate real-world identity, so extra caution may be needed if an attacker entirely compromises an account.