Most email accounts hold more than their owners realize: a website password sent to a colleague, a driver's license photo sent to a landlord, a W-9 with a Social Security number, wiring instructions, a banking login forwarded to whoever needed it. Every one of those messages is still sitting in two inboxes, readable by anyone who breaks into either account, and intruders search for exactly these items.
Internet crime losses reported to the FBI passed $20 billion in 2025, and phishing was the most reported crime. The IDScan.net breach showed what one license scan in the wrong hands can do.
Passwords and documents still have to move. What can change is whether a readable copy stays behind. Signal is the most widely recommended tool for sending them without one, and this article explains what it is, how to set it up on a phone and a computer, how to reach someone on it, and what else it does. The encrypted communications guide covers the broader case for keeping sensitive material out of email and text.
What Signal is
Signal is a free messaging and calling app run by the Signal Foundation, an independent nonprofit. Everything sent through it is end-to-end encrypted, which means a message is scrambled on the sender's device and unscrambled only on the recipient's. Signal's own servers cannot read it, and neither can anyone who intercepts it along the way. In Signal's words, "We can't read your messages or listen to your calls, and no one else can either." There are no ads and no tracking, and the encryption method is published openly so security researchers can inspect it. It runs on iPhone, Android, Windows, Mac and Linux.
Signal looks and behaves like the messaging app already on a phone. The difference is what happens to the message in between. Ordinary text messages and email pass through servers that can store and read them, and a copy sits in an inbox that anyone with the password can open. A Signal message exists only on the devices at either end.
What it does, all encrypted
- Messages. One-to-one chats and group chats, with the same protection either way. Signal keeps no record of who is in a group or what it is called.
- Documents and photos. A PDF, a scan, a spreadsheet, a photo or a video attaches the same way it would in a text message. This is how a tax form or an ID scan should travel.
- Voice and video calls. Calls between two people and group calls are encrypted the same way messages are. A call link can be created and shared so people can join a group call without being added to a chat first.
- The computer, too. Signal Desktop for Windows, Mac and Linux links to the account on the phone. Chats appear on both, and messages sent from the computer carry the same protection.
- Disappearing messages. Any chat can be set so messages delete themselves from every device after a chosen time. For a thread that carries passwords, this keeps the password from sitting in a chat history for years.
- A private number. Signal registers with a phone number, but the number can be hidden from other users and replaced with a username. Only people who already have the number in their contacts will see it.
- Note to Self. A chat with only one participant, useful for parking a password or a document needed on another device later.
- Safety numbers. Each chat has a code the two people can compare, in person or on a call, to confirm no one has slipped in between. Worth doing once for anyone who will exchange sensitive material.
Setting it up on a phone
Setup starts on the phone. Signal Desktop cannot be set up on its own; it links to a phone that already has the app.
- Install the app. Install the free Signal app from the App Store on iPhone or Google Play on Android.
- Verify the phone number. Open the app, accept the terms, and enter the phone's mobile number. Signal sends a verification code by text message. Enter it. Signal never asks for this code in a message, so a request for it from anyone else is a scam.
- Decide about contacts. Grant permission to see contacts if the app should show which of them already use Signal. This step is optional.
- Enter a profile name. This is what other people see, so it should be the name they know.
- Create a Signal PIN. Store it in a password manager. The PIN restores the account and its settings on a new phone.
Signal's support pages note that Android users can now create an account without a phone number for a small one-time charge. For most people the phone-number route is simpler.
Adding a computer
- Download Signal Desktop. Get it from signal.org/download and open it. It shows a square barcode.
- Open Linked Devices on the phone. In Signal on the phone, go to Settings, then Linked Devices, and choose to link a new device.
- Scan the barcode. Point the phone's camera at the barcode on the computer screen and confirm. Chats copy over to the computer.
The phone remains the main device. Signal's support pages say the phone has to come online at least once every 30 days, or the linked computer is disconnected and has to be linked again.
Reaching someone on Signal
There are three ways to start a chat, and the other person decides which ones work for them.
- By phone number. If the number is in the phone's contacts and that person allows it, they appear in Signal's contact list. Tap the name and write.
- By username. A username looks like a name followed by a period and two digits. Tap the pencil or new-chat button, type the username in the search box, and the person appears. Usernames are the way to reach someone who keeps their number private.
- By link or barcode. Any Signal user can share a link that starts with signal.me, or a barcode, and either one opens a chat with them directly. This is the easiest route when the link arrives by email, as long as it is opened on the phone that has Signal installed. On a computer without Signal, the link does nothing.
To share one's own details, open Signal, tap the profile picture, and the profile screen offers a username, a link and a barcode.
What belongs on Signal, and what does not
The test is simple: if a stranger reading the message would be a problem, it goes through Signal. That covers more than most people assume.
- Logins and access. Passwords, verification codes, security questions, Wi-Fi and alarm codes, door codes, and access to any account or system.
- Identity documents. Driver's licenses, passports, Social Security numbers, birth dates paired with names, and photos of any card that carries a number.
- Money. Bank and routing numbers, wiring instructions, credit card details, tax forms, payroll, and images of checks.
- Confidential business information. Client lists, pricing and margins, proposals under negotiation, contracts with account numbers, anything covered by a non-disclosure agreement, and plans that competitors would value.
- People's private details. Employee records, medical information, legal matters, and anything a client or employee shared in confidence.
Ordinary correspondence, scheduling, invoices without account numbers, and the general run of business can stay on email, where searchable history and attachments are an advantage rather than a risk.