Signal is building sign-up without a phone number: a paid 'Signal Login' is already in the Android code

Signal is building a way to sign up without a phone number, and the whole thing is sitting in its public source code. Over the past four weeks a Signal developer has pushed a series of commits to the Signal-Android repository under the name "Signal Login": a one-time purchase through Google Play that hands the user an account ID and a 64-character recovery key instead of asking for a number. On 9 September the payment screen itself landed, with the button text "Pay" followed by the price. Signal has not announced the feature, and in the current code it is switched on only for the company's internal builds, so nobody outside can try it yet.

What the code shows, in order

Signal publishes its client and server code, so the feature can be followed commit by commit even without an announcement. The Android work is signed mostly by Greyson Parrelli, a long-time Signal developer; the server work appears in the Signal-Server repository in parallel. The internal flag that enables the flow was moved on 9 September from "staging only" to "internal builds only", which is why users of the public beta, who have had the code on their phones since version 8.26, see nothing.

1. 17 to 19 August: network and settings placeholders for "phonenumberless registration"; the server side gets a test that registers a numberless account with a static credential (18 August).
2. 25 to 26 August: the login screens are scaffolded and 1,632 lines of strings arrive, including "Save as PDF" for the keys and a warning that a lost login cannot be recovered.
3. 2 September: "Add basic ability to register numberless account" and "Add basic ability to login to an existing numberless account"; PIN reminders, registration lock and the phone-number discoverability setting are hidden for these accounts; a password-manager option is added for storing the login.
4. 9 September: "Add ability to pay for a signal login" wires Google Play billing, the receipt credential and the resume-after-failure logic; end-to-end tests for the numberless flows follow the same evening.

How a paid login is meant to stay anonymous

Phone numbers were never about identity for Signal; they were its spam control, because a number costs money and there are only so many of them. The company's CTO, Ehren Kret, said as much at FUTO's "Don't Be Evil" conference when he confirmed that registration without a number was planned "hopefully later on this year" and that the obstacle was abuse, not privacy. A paid login keeps the cost and drops the number. The obvious objection is that a payment identifies you at least as well as a SIM, and the code answers it with the same construction Signal introduced for donation badges in 2021 and reused for paid backups. The app asks Google Play for the purchase, then builds a blinded "receipt credential request"; the Signal server signs it without seeing the account it will be attached to; at registration the app presents the credential as proof that some login was paid for. The repository comment describing the purchase says the record is stored before it is redeemed, "so a failure anywhere after payment leaves something to resume from", and that a redeemed purchase is "consumed" so a person can buy a second login for a second account.

What a numberless account gives up

The strings and the hidden settings describe a different kind of account. There is no PIN-based registration lock, because there is no number to lock; instead the settings gain a card for a second factor, "to protect your account when using your Signal Login on a new device", and the registration call in the code accepts a one-time TOTP code. There is no "who can find me by my number" switch, because discoverability is fixed to off. An earlier commit spotted by the community states that accounts without phone numbers can never gain one and accounts with numbers can never lose theirs, so an existing account cannot simply be unlinked from its SIM; a numberless account is a new account. A username becomes the way people reach you, and the app now shows a confirmation dialog if you try to skip creating one. Above all, the keys are the account: the info screen says plainly that "if you forget your keys, you will not be able to recover your account", and the app makes you re-enter them to prove you saved them. That is the trade the code offers, and it is the same one made by anyone who moves from SMS codes to an authenticator app or a hardware key: no one can reset it for you, which is the point.

Why the number was the problem

Signal has spent years narrowing what a phone number exposes. Phone-number privacy hides it from other users by default, usernames let strangers message you without it, and the server stores contact discovery in a way that is meant to reveal nothing beyond matches. What none of that changes is the moment of registration: an SMS code to a number that, in a growing list of countries, is tied to a passport, a biometric scan or a residence permit at the point of sale. Someone with access to the carrier, or to the person who registered the SIM, knows who holds the account regardless of what the app hides afterwards. A login bought without a number moves that risk from the carrier to the app store. Whether the price will be closer to a dollar or ten is not in the code: the screen loads it from Google Play at runtime, and the design previews use a placeholder. Until Signal flips the flag and publishes the product, the honest summary is that the client, the server and the payment path are written and tested, and the announcement is not.