Signal drops the phone number requirement with zero-knowledge proof payments

Signal is building a registration system that removes the long-standing phone number requirement for account creation. Instead, new users will make a one-time payment, which generates a zero-knowledge proof credential. Signal's servers verify the credential — confirming the user paid the anti-abuse fee — without learning who made the payment or linking it to any identity, as first reported by About Signal.

The system extends cryptographic technology Signal already deploys for username privacy, using a custom Ristretto 25519 hashing algorithm. Phone numbers have been Signal's primary account identifier since the app launched, and they represent a significant privacy surface: a phone number can be used to identify, locate, and track a user. Removing the requirement is one of the most-requested changes in Signal's history.

How the ZKP system works

When a user pays the one-time fee, the system issues a zero-knowledge proof credential that proves payment occurred without recording who paid. Signal's servers check the credential is valid — and has not been reused — without accessing the underlying payment data. The economic friction is designed to make bulk account creation by spammers and bot farms economically impractical, achieving the same anti-abuse goal as phone verification without the privacy tradeoff.

The Android caveat

The system has one significant limitation on Android: payments route through Google Play Billing, which requires a Google account. ZKP prevents Signal from linking your payment to your identity, but Google directly observes the transaction. Users who want the strongest privacy guarantee will need to pay through a non-Google pathway — which for now means iOS or desktop.

Phone-number-less accounts also cannot migrate to phone-based accounts (or vice versa), and cannot perform certain PNI key operations that affect linked-device flows. Signal has not announced a price for the registration fee; the current source code contains only placeholder amounts.

Why this matters

For journalists, activists, and users in high-surveillance environments, a phone-number-free Signal account eliminates one of the most accessible attack vectors against secure communications. The ZKP approach is technically elegant: it gives Signal the abuse protection of phone verification without Signal — or any third party except Google on Android — ever seeing a link between the payment and the account.

Signal CEO Meredith Whittaker has made privacy-maximizing design a public commitment. The phone-number-free flow, when it ships, will make Signal meaningfully more usable in adversarial environments where phone number exposure is a direct physical risk.