Signal adopts zero-knowledge registration

Signal adopts zero-knowledge registration | Nahraf

Introduction

On September 14, 2026, Signal posted on Hacker News that registration without a phone number will use zero‑knowledge proofs. The announcement arrived just as the industry is wrestling with the privacy fallout of SMS‑based OTPs and the rising demand for frictionless onboarding. In less than 48 hours the headline was trending on Twitter, Reddit, and developer forums, sparking a debate that goes beyond a single app: Can we finally ditch phone numbers as the default identity anchor?

"If Signal can make ZK‑based registration practical, the whole ecosystem will have to rethink the OTP model."

This post dives deep into the technical underpinnings, the developer implications, and the broader privacy trend that Signal is now leading.

Why Phone Numbers Became a Bottleneck

Phone numbers have been the de‑facto identifier for mobile apps since the early 2010s. They offer:

Universal reach – almost every user has a SIM.

Built‑in SMS OTP – a quick way to prove possession.

But the model shows serious cracks:

Privacy erosion – Phone numbers are personally identifiable information (PII) that can be harvested for tracking.

Accessibility gaps – Users in regions with poor cellular coverage or those who prefer VoIP services are left out.

Security weaknesses – SIM‑swap attacks have exploded, costing millions in fraud.

Developers have been looking for alternatives: email‑based magic links, social logins, and hardware tokens. Yet each carries trade‑offs in usability or privacy. Signal’s ZK approach promises to keep the best of both worlds.

Zero‑Knowledge Proofs 101

A zero‑knowledge proof (ZKP) lets a prover convince a verifier that a statement is true without revealing the underlying data. In authentication terms, a user can prove they own a secret (e.g., a private key) without sending the secret itself.

Key properties:

Completeness – If the statement is true, an honest prover can convince the verifier.

Soundness – A dishonest prover cannot convince the verifier of a false statement.

Zero‑knowledge – The verifier learns nothing beyond the truth of the statement.

Modern ZK constructions (e.g., zk‑SNARKs, Bulletproofs) have become fast enough for mobile devices, with verification times measured in milliseconds.

How Signal Implements ZK Registration

Signal’s blog post outlines a three‑step flow:

Key Generation – The app creates an Ed25519 key pair on the device.

Proof Creation – Using a lightweight zk‑SNARK, the app generates a proof that the public key corresponds to a secret that the user controls, and that the user has not previously registered the same key.

Server Verification – Signal’s backend verifies the proof without ever seeing the secret key or the user’s phone number.

The proof includes a nullifier – a one‑time identifier that prevents double‑registration while preserving anonymity. If a user tries to register again with the same key, the server detects the repeated nullifier and rejects the attempt.

Comparison Table

Feature	SMS OTP	Email Magic Link	ZK Registration
User friction	Medium (enter code)	Low (click link)	Low (single tap)
PII exposure	Phone number	Email address	None (key only)
Vulnerability to SIM‑swap	High	None	None
Server load	Low (SMS gateway)	Medium (email service)	Low (cryptographic verification)
Regret risk (user can delete)	Medium	High (email persists)	High (key can be revoked)

Real‑World Impact for Developers

1. Simpler Privacy Compliance

Regulations like GDPR and CCPA treat phone numbers as sensitive data. By eliminating the need to store them, developers can reduce compliance overhead and lower the risk of data‑breach penalties.

2. New SDK Design Patterns

Signal is releasing an open‑source SDK that abstracts the ZK flow into a single register() call. This encourages other apps to adopt the same pattern without deep cryptographic expertise.

3. Interoperability with Existing Auth Systems

The nullifier can be mapped to traditional user IDs, allowing seamless integration with existing user databases. Developers can keep their legacy user tables while offering a privacy‑first signup path.

4. Edge Cases and Migration

For apps that already rely on phone numbers for contact sync, a hybrid approach is possible: keep the phone number as an optional field for users who want it, but default to ZK registration for everyone else.

Risks and Open Questions

Proof Size – Even lightweight zk‑SNARKs generate proofs of a few kilobytes. On low‑bandwidth connections this could add latency.

Key Recovery – If a user loses their device, they also lose the private key. Signal must provide a secure recovery flow that does not re‑introduce PII.

Regulatory Acceptance – Some jurisdictions still require a phone number for certain services (e.g., banking). ZK registration may not be sufficient in those contexts.

Adversarial Proof Generation – While ZK constructions are mathematically sound, implementation bugs could open attack vectors. Auditing the SDK will be crucial.

The Bigger Trend in Privacy‑First Auth

Signal is not alone. Recent developments include:

Twitter’s “email‑only” login experiment – aiming to reduce reliance on phone numbers.

Apple’s Passkeys – a FIDO‑based system that also avoids passwords and phone numbers.

OpenID Connect extensions that support ZK‑based claims.

Collectively, these moves signal a shift from identity as a phone number to identity as a cryptographic credential. Developers who adapt now will be positioned to build the next generation of privacy‑preserving services.

Conclusion

Signal’s zero‑knowledge registration is more than a headline; it is a proof‑of‑concept that the industry can move beyond SMS OTPs without sacrificing security or user experience. For developers, the takeaway is clear:

Start experimenting with ZK SDKs now.

Re‑evaluate any data collection that isn’t strictly necessary.

Prepare for a future where the primary user identifier is a public key, not a phone number.

If the community embraces this change, we could see a cascade of privacy‑first products, reduced data‑breach surface, and a healthier relationship between users and the services they trust.

Feel free to share your thoughts on Twitter with #SignalZK and join the conversation on Hacker News.

Blog AI Assistant

more_articles()

Chrome Finally Ships JPEG XL: Why This Matters for Every Web Developer

Signal Goes Phone-Free: Zero-Knowledge Proofs Could Redefine User Registration