Signet
Both phones need Signet 0.4.0 or later to pair. Backups made with 0.4.0 need 0.4.0 or later to restore. Update only from the store you installed Signet from.
New: safer in-person pairing (one phone taps Start, the other Join), 8-word check for long-distance pairing, and backups in two parts you keep apart: a PACKAGE file and 8 words. Signet's language can be set apart from the phone's (Android 13+). Plus fixes to verify, restore, the clipboard and large text.
Each paired contact generates a rotating 4-word phrase that only the real person's phone can produce. You ask her to read her phrase aloud; you type what you hear. Green banner: verified. Red banner: something's wrong — hang up and call her back on a number you already trust.
Signet works over any channel. Voice calls, video calls, text, email, in person. The only requirement is that the two of you paired once, in person or over a trusted channel, before the crisis.
Built for a world where AI voice cloning is commodity. Defends against:
* Real-time voice and video deepfakes
* Pre-recorded deepfake voicemails
* Vishing using scraped biographical knowledge
* Compromised messaging accounts where the attacker has chat history but not the paired device
* SIM swaps
* Reflection attacks: the rotating code is direction-aware, so an attacker echoing your own phrase back at you fails
Core properties:
* No server. No cloud. No account. No INTERNET permission.
* No telemetry. No analytics. No ads.
* Hardware-backed secrets via Android Keystore, StrongBox when available.
* Offline-first; airplane mode does not affect any flow.
* RFC-validated crypto (X25519, HKDF-SHA-256, AES-256-GCM, BIP-39).
* Open source, AGPL-3.0.
v0.3 includes in-person pairing, long-distance pairing, lost-phone recovery via paper or file, multi-relationship storage, in-person rekey, bulk backup (every paired relationship in one encrypted file with a single 8-word unlock), a printable challenge-response grid for when the other side can't reach their phone, liveness prompts for video calls, and screenshot blocking on sensitive screens.
Not included: duress codes (gated on an abuse-analysis pass), account recovery (there is no account), cloud backup (out of scope forever).
- Author: digital-grease
- License: GNU Affero General Public License v3.0 only
- Website
- Issue Tracker
- Source Code
- Build Metadata
- Reproducibility Status
Donate
Versions
Although APK downloads are available below to give you the choice, you should be aware that by installing that way you will not receive update notifications and it's a less secure way to download. We recommend that you install the F-Droid client and use that.
Download F-Droid-
x86_64This version requires Android 9.0 or newer.
It is built and signed by F-Droid, and guaranteed to correspond to this source tarball.
Download APK 25 MiB PGP Signature | Build Log
-
arm64-v8aThis version requires Android 9.0 or newer.
It is built and signed by F-Droid, and guaranteed to correspond to this source tarball.
Download APK 23 MiB PGP Signature | Build Log
-
armeabi-v7aThis version requires Android 9.0 or newer.
It is built and signed by F-Droid, and guaranteed to correspond to this source tarball.
Download APK 21 MiB PGP Signature | Build Log
-
x86_64This version requires Android 9.0 or newer.
It is built and signed by F-Droid, and guaranteed to correspond to this source tarball.
Download APK 25 MiB PGP Signature | Build Log
-
arm64-v8aThis version requires Android 9.0 or newer.
It is built and signed by F-Droid, and guaranteed to correspond to this source tarball.
Download APK 23 MiB PGP Signature | Build Log
-
armeabi-v7aThis version requires Android 9.0 or newer.
It is built and signed by F-Droid, and guaranteed to correspond to this source tarball.
Download APK 20 MiB PGP Signature | Build Log
-
x86_64This version requires Android 9.0 or newer.
It is built and signed by F-Droid, and guaranteed to correspond to this source tarball.
Download APK 25 MiB PGP Signature | Build Log
-
arm64-v8aThis version requires Android 9.0 or newer.
It is built and signed by F-Droid, and guaranteed to correspond to this source tarball.
Download APK 23 MiB PGP Signature | Build Log
-
armeabi-v7aThis version requires Android 9.0 or newer.
It is built and signed by F-Droid, and guaranteed to correspond to this source tarball.
Download APK 20 MiB PGP Signature | Build Log
New: Opt-in Debug Logging (Settings). Off by default. If you hit a
bug, turn it on, reproduce it, then Export to send us a diagnostic
log. Secrets are removed and your contacts' names become anonymous
tags like before anything leaves your phone. It auto-erases
after 24 hours, and a banner shows whenever it's recording.
Fixed: About screen now shows the actual installed version
(previously stuck on a hardcoded "v0.2.0-alpha" string that
never got bumped through several releases).
Privacy policy updated to accurately describe the in-app
crash-report flow added in v0.3.4 — your crash data still stays
on your phone until you tap "Send".