Signal launches automatic key verification to secure your chats

What happened: Signal introduces AKV

On August 12, 2026, the Signal team announced the launch of Automatic Key Verification (AKV), a feature that automates the verification of public keys between users. Until now, 'Safety Numbers' required users to compare a string of numbers in person or via an alternative channel to confirm that no intermediary was intercepting messages. With AKV, this process becomes automatic and transparent.

Why it matters: closing the theoretical gap

Since its inception, Signal has been the benchmark for end-to-end encryption, but its model relied on trust in the server for key distribution. A compromised server or a malicious employee could, in theory, replace a public key and perform a man-in-the-middle (MITM) attack. 'Safety Numbers' mitigated this risk, but only if users performed the verification manually, which very few did. AKV eliminates this weak point through a cryptographic transparency ledger that records all key changes, which is independently audited by Cloudflare and Trail of Bits.

Consequences for users and the market

For users, the main advantage is peace of mind: manual contact verification is no longer necessary, and any attempt at key manipulation would be detected by auditors. This reinforces trust in Signal as the most secure option for sensitive communications. For the market, this innovation raises the bar for messaging app security, pressuring competitors like WhatsApp (which already has a similar system with Cloudflare) and Telegram to improve their own guarantees. Furthermore, the independent audit model, with Trail of Bits operating pro bono as a public good, sets a precedent for security collaboration.

What readers should know

• AKV is enabled by default for Signal users, with no configuration required.
• The system is based on a cryptographic ledger that records every key change, protected with Verifiable Random Functions (VRF) and hashing to preserve privacy.
• The auditors (Cloudflare and Trail of Bits) cannot read identifiers in plaintext; they only verify the consistency of the ledger.
• Although AKV reduces the risk of MITM attacks, it is not a silver bullet: users should still be wary of compromised channels and enable additional verification for high-risk contacts.
• Signal has published the technical specification and code so the community can audit the system.

Signal demonstrates that security is not at odds with usability: automating key verification without sacrificing privacy is a milestone that will redefine the standards of encrypted messaging.

Analysis: a step forward with nuances

Signal's initiative is a significant advancement, but it is not without criticism. Some experts point out that key transparency adds a layer of complexity that could introduce new attack vectors, such as network-level ledger manipulation. However, the choice of independent auditors and the publication of the specification mitigate these risks. Furthermore, the collaboration with Cloudflare, which already audits WhatsApp, suggests that the industry is moving toward a common standard for key transparency.

In a historical context, we recall that Signal was a pioneer in end-to-end encryption and the adoption of protocols like the Signal Protocol, which was later adopted by WhatsApp. With AKV, Signal once again leads in security innovation, though it remains to be seen whether other players will follow suit or if decentralized alternatives will emerge that completely eliminate the need to trust a central server.

Recommendations for the reader

If you are a Signal user, you don't need to do anything: automatic verification is already active. For critical contacts (journalists, activists, executives), additional manual verification via 'Safety Numbers' on a secure channel is still recommended. Stay informed about future updates and, above all, understand that no tool is infallible: security also depends on your digital habits.