Signal
Signal lets you exchange encrypted messages, share files and make voice and video calls. It’s made by Signal Messenger, based in the United States.
Criminals have used its name in fake downloads or scams, so get it only from signal.org.
What it is
People use Signal for individual conversations, family group chats and calls. The Mac app links to Signal on your phone, where you must first set up the app.
Your message history is stored on your devices. Signal can use the microphone for calls and voice messages, the camera for video calls, and Screen Recording to share a screen or window.
Signal publishes its source code for inspection by security researchers. It says it has no adverts or trackers and cannot read your messages or listen to your calls because they use end-to-end encryption.
Who makes it
Signal Messenger was established in 2018 and is a subsidiary of the nonprofit Signal Technology Foundation. Its legal name is Signal Messenger, LLC. Its website is signal.org.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
HARD hasn’t yet recorded the signature on a real copy of Signal. Its Mac app shows who signed the copy you have.
Its bundle ID, the name macOS knows it by, is org.whispersystems.signal-desktop or org.whispersystems.signal-desktop-beta. Download it only from signal.org, not from an ad or a link someone sends you.
Fakes. In February 2025, Google reported fake Signal group invitations that tricked people into linking an attacker’s device, allowing it to receive their messages. In October 2025, ESET reported fake Signal upgrade and encryption-plugin websites distributing Android spyware.
What it connects to
In normal use, Signal talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
*.signal.org | Messaging and calls. |
updates.signal.org | Desktop app updates. |
turn3.voip.signal.org | Relaying calls. |
sfu.voip.signal.org | Group calls. |
signal.me | Shared contact links. |
What it can see
macOS asks you before an app can use these. You can change them any time in System Settings → Privacy & Security.
| Permission | What it’s for |
|---|---|
| Camera | Shows your video during calls. |
| Microphone | Records voice messages and carries your voice during calls. |
| Screen Recording | Shares your entire screen or a selected application window during calls. |
| Notifications | Alerts you to incoming messages and calls. |
Security record
Problems with Signal or Signal Messenger in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| A calling flaw could let another participant prevent a hang-up from stopping audio and possibly video; it was fixed in Signal Desktop 8.29.0. | ↗ | |
| Researchers reported a flaw that could let a compromised Signal server insert false messages into some Desktop conversations; Signal adopted a patch that day. | ↗ |
References
- Signal — Home signal.org
- Download Signal for Mac signal.org
- Signal Desktop build configuration github.com
- Signal Beta macOS crash report showing its bundle identifier github.com
- Signal Foundation announcement signal.org
- WIPO decision documenting Signal Messenger’s ownership wipo.int
- Signal Terms of Service and Privacy Policy signal.org
- Signal Permissions and OS Notification Settings support.signal.org
- How do I ensure Signal is up to date? support.signal.org
- Signal Desktop releases github.com
- Firewall and Internet settings support.signal.org
- Signal contact links signal.me
- Google Threat Intelligence — Russia-aligned actors targeting Signal cloud.google.com
- ESET — Spyware campaigns impersonating Signal and ToTok welivesecurity.com
- SK-CERT — Signal calling vulnerability advisory sk-cert.sk
- USENIX — Message Injection Attacks Against Signal usenix.org