MOUNTAIN VIEW, May 15 — Every Signal account will soon get a new long-term identity key four times a year. The Signal Foundation shipped a coordinated update for its mobile and desktop apps on Thursday that rotates those keys automatically, the foundation told Consumer Tech Wire, narrowing how long a stolen key could stay useful to an attacker.

In brief

  • Identity keys now rotate every 90 days on every account, automatically.
  • Safety numbers you have verified stay verified; you should not see a wave of “safety number changed” warnings.
  • Android 7.42 and iOS 7.42 shipped Thursday; desktop follows Friday; the command-line client signal-cli gets the change later in May.
  • A full technical paper, with a formal security argument and a reference to an independent review, is due next week.

Which keys rotated before, and which did not

Signal already changes the keys that encrypt individual messages constantly. Under the Double Ratchet construction, which has defined the Signal Protocol since 2013, a fresh key protects each message, so a key exposed today does not unlock yesterday’s messages.

The identity key was the exception. It is the longer-lived key that authenticates a user’s device pair from one session to the next, and it is what sits behind the safety-number check careful users perform by hand. Until this update, it changed only when someone reinstalled the app. That meant a single compromise of the identity key — through a seized device, malware or a supply-chain attack — could stay exploitable for as long as that installation lasted.

Asha Lindqvist-Park, a cryptographer in Stanford’s Applied Cryptography Group, said the gap had been well known in the research community.

“This is the change the academic literature has been asking Signal to make for at least seven years,” Lindqvist-Park said in an interview. “The Double Ratchet gives you forward secrecy on message keys, which is excellent. But the long-term identity key was the protocol’s bottleneck on post-compromise recovery. A quarterly rotation cadence is conservative — it’s not the daily rotation some of us would have argued for in a clean-sheet design — but it’s the operationally realistic choice given the safety-number surface.”

Why your safety numbers will not change

The engineering problem was not rotating the key; it was rotating it without alarming everyone. Signal said it has built a cryptographic link between each identity key and the one that replaces it, so the chain of verification carries over. A contact whose safety number you confirmed in 2023 will still show as verified after the rotation.

The foundation compared the approach to rotating a TLS certificate while keeping the same Common Name. It rests on a hash-chain commitment that anyone can audit independently from the protocol’s public state.

According to Lindqvist-Park, that is the piece that made the change shippable. A simple rotation would have flooded every conversation with “safety number changed” notices. Historically, warnings like that push Signal users toward one of two bad habits: re-verifying without actually checking, or turning the warning off altogether. Either one would have drained the verification flow of its security value.

When you get it

Rotation starts the first time you open Signal after installing the update, then repeats every 90 days. The Android and iOS releases arrived Thursday under version 7.42, the desktop client Friday. People who use signal-cli will receive the change in a follow-up release later in May. No setting needs to be changed.

What comes next

The foundation said it will publish the complete technical description of the construction on its engineering blog next week. That write-up is to include the formal post-compromise-security argument and a reference to the independent third-party review Signal commissioned earlier this year — the document security researchers will read most closely.

Encryption-by-default has been a theme of the year on this beat: Ring made end-to-end video encryption the default for new customers, and Proton launched an end-to-end encrypted calendar across its suite. For the tracking side of personal privacy, see our report on the state of browser fingerprinting in 2026.

Ronan Whitfield-Asari reported this story. Follow the Privacy & Security desk for more.