Sealbox
Português ⇄ Get notified at launch

Is Signal app safe? What it covers, what the phone decides

How safe is Signal? That question holds two: whether your messages are protected on their way, and whether they are protected on the phone that keeps them afterwards. Signal's help center answers the first; the second depends on the state of the phone, which Apple documents.

Signal says its conversations are always end-to-end encrypted, so only your intended recipients can read or hear them. That is a statement about the trip between devices. What stays on the phone after a message arrives is a different layer, set by iOS data protection and by where an app keeps its keys. This page does not say what any extraction tool can read, and it does not say Signal is insecure.

Signal end to end encryption: what it covers for Signal encrypted messages

Signal's help center puts it this way: "Signal conversations are always end-to-end encrypted, which means that they can only be read or heard by your intended recipients." It adds that privacy "isn’t an optional mode" and that the complete source code for the Signal clients and server is on GitHub, so interested parties can examine it for security and correctness.

Those sentences describe Signal encrypted messages on their trip between devices. Once a message arrives it sits on a phone, where a different mechanism protects it. So "is Signal secure?" has a second half, about the phone, and the rest of this page is about it.

The state of the phone decides when a class key is available

Apple's Platform Security guide, published in December 2024, before iOS 26, which Apple shipped on 15 September 2025, says of its data protection classes: "Each class uses different policies to determine when the data is accessible." Two classes matter here.

Apple's keychain page says its classes "have behaviors equivalent to file Data Protection classes but use distinct keys and functions", and pairs "When unlocked" with the first class and "After first unlock" with the second. This page draws no conclusion from these definitions about what any tool can read.

Where the Signal app keeps its database key

Signal's iOS source is public. In the file that opens its local database (commit b6beaf01, 29 October 2026), a comment above the code that reads or creates the database key says: "Because we use kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly, the keychain will be inaccessible after device restart until device is unlocked for the first time. If the app receives a push notification, we won't be able to access the keychain to process that notification, so we should just terminate by throwing an uncaught exception."

So Signal protects its local database with a key, and that key is kept under the keychain class kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly. Apple's table lists kSecAttrAccessibleAfterFirstUnlock; this page does not read what the ThisDeviceOnly suffix adds. In the same commit, SSKKeychainStorage.swift, line 70, is where the keychain write sets kSecAttrAccessible to kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly. The comment describes what happens after a restart when a push notification arrives. This page does not say that any tool can read that key from any phone: that depends on the phone model, the iOS version, the tool and the state of the phone, and it is not measured here.

What a phone-extraction tool is, in Signal's own words

Cellebrite is the vendor Signal wrote about in a 2021 blog post. Signal's description: "Cellebrite makes software to automate physically extracting and indexing data from mobile devices." And: "anything involving Cellebrite starts with someone else physically holding your device in their hands. Cellebrite does not do any kind of data interception or remote surveillance."

On what "Signal support" meant, the post says that "all it really meant was that they had added support to Physical Analyzer for the file formats used by Signal. This enables Physical Analyzer to display the Signal data that was extracted from an unlocked device in the Cellebrite user’s physical possession." That is Signal's account of one vendor's products, written then. The post does not say whether a locked device can be extracted, and Apple's classes describe the system's policy: this page measures no tool. Tools, phones and iOS change, so read it as what Signal said at the time.

Where Sealbox fits, and where it stops

Sealbox is an iPhone app (iOS 26+ at launch) and not an alternative to Signal: it adds to any channel, Signal included, and in the site's words, "Different layer, different job; they compose." You compose it "before it touches any messaging app", so the channel only ever carries ciphertext, and the keys are released only to your live, currently-enrolled biometrics; a passcode is not enough. On a lost phone, even one already unlocked once, the content stays sealed, "an engineering guarantee with no known public bypass, not a formal proof", and one more layer is yours to add: "a strong alphanumeric device passcode is what still stands if the chip itself is ever broken".

The limits. It protects only what you compose in it "before it touches any messaging app"; the chats you already have are not covered. The rest, in the site's words:

Related reading:

Sources

Frequently asked questions

Is Signal app safe?

Not in one word. "Is Signal safe?" has two halves. Signal says its conversations are always end-to-end encrypted, readable only by your intended recipients, and that covers the trip between devices. What the phone keeps after a message arrives is a separate layer. It depends on the phone's state and on where the app keeps its keys, and this page measures no tool.

Is Signal secure, and what does its end to end encryption cover?

The trip between devices. Signal's help center says its conversations are always end-to-end encrypted, and that end-to-end encryption is what covers the trip between devices. After a message arrives, iOS data protection applies, and Signal's source shows its database key under the keychain class kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly, with a comment describing what happens after a restart when a push notification arrives.

Can Cellebrite open Signal?

This page cannot say, and the sources it reads do not either: it depends on the model, the iOS version, the tool and the phone's state. What Signal wrote in 2021 is that Cellebrite's "Signal support" meant displaying Signal data extracted from an unlocked device in the physical possession of the tool's user; the post does not say whether a locked device can be extracted.

Does Sealbox replace Signal?

No. Signal's end-to-end encryption covers the conversation in transit; Sealbox seals the text itself, before any channel carries it. They are different layers, and the block you seal can travel through Signal. Sealbox runs only on iPhone, and the other person needs it too.

Get notified at launch

No form, no list, no tracker — it's just email. If the button doesn't open your mail app, write to support@sealbox.io with the subject "Notify me".

Coming to the App Store · iOS 26+