HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
signalapp
Signal-Android
Kotlin2011–2026
signalapp / Signal-Android

Signal-Android

A private messenger for Android.

Security & PrivacyMobile & DesktopCommunication & Social
Explore on GitHubRead Hacker News discussions
280Distinct people
372Mentions
5Explicit recommenders
29.6KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

A private messenger for Android.

GitHub

Where it is used

  • Molly — Molly uses the signalapp/signal-android codebase as an independent fork to deliver a variant of the Signal Android app with added features. It ships as its own app built from the Signal Android project. Source

What people are saying

I never hated on Signal, on the contrary I recommend it too many people but I can say that the energy consumption on Android is in many cases abysmal for multiple years now and…

johschmitz used a recommendation phrase. 5 indexed comments match. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year372 dated mentions

Observed mentions: 2011-12-21 12:48:31 UTC to 2026-10-12 11:10:46 UTC.

0204060802011-01-01 00:00:00 UTC to 2012-01-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 comments20112012-01-01 00:00:00 UTC to 2013-01-01 00:00:00 UTC (exclusive): 4 mentions; 1 submissions, 3 comments2013-01-01 00:00:00 UTC to 2014-01-01 00:00:00 UTC (exclusive): 12 mentions; 0 submissions, 12 comments2014-01-01 00:00:00 UTC to 2015-01-01 00:00:00 UTC (exclusive): 23 mentions; 0 submissions, 23 comments2015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 26 mentions; 1 submissions, 25 comments2016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 46 mentions; 1 submissions, 45 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 22 mentions; 2 submissions, 20 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 24 mentions; 4 submissions, 20 comments20182019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 10 mentions; 1 submissions, 9 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 25 mentions; 1 submissions, 24 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 87 mentions; 12 submissions, 75 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 30 mentions; 2 submissions, 28 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 13 mentions; 0 submissions, 13 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 16 mentions; 2 submissions, 14 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 23 mentions; 1 submissions, 22 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 10 mentions; 0 submissions, 10 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20112011-01-01 00:00:00 UTC2012-01-01 00:00:00 UTC110
20122012-01-01 00:00:00 UTC2013-01-01 00:00:00 UTC413
20132013-01-01 00:00:00 UTC2014-01-01 00:00:00 UTC12012
20142014-01-01 00:00:00 UTC2015-01-01 00:00:00 UTC23023
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC26125
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC46145
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC22220
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC24420
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC1019
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC25124
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC871275
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC30228
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC13013
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC16214
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC23122
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC10010

What Hacker News says

372 sources
microtonal·Oct 12, 2026
Oh, they certainly don't appear days later. But sometimes they do between ~1-30 minutes. This is a well-known issue, you can find many topic about it. When you open the app, everything comes in all at onec. It is sometimes annoying to me. I cycle a lot and sometimes my wife or somebody else sends a message when I'm on the go (like picking up some extra groceries) and then I miss it. There is a longer discussion with various people here: https://github.com/signalapp/Signal-Android/issues/14166
In Will Linux phones become a viable alternative to the Android/iOS duopoly?
Cider9986·Sep 12, 2026
> Lol how is that any better at all? They are [1] implementing unlinkable payments so all that is known by credit card is that you purchased Signal and Signal doesn't know which credit card goes with which account. >Signal is an obvious honeypot. Claims without evidence can be dismissed without evidence. You might say they don't do enough to protect metadata privacy but it was never made to be an anonymous messenger, it was made to be a private messenger. You can easily check the end-to-end encryption in the code (reproducible builds on all platforms except iOS BTW!). This person audited Signal recently [2]. >They make no money and have no plans to. They make money from donations and paid backups and they might make money from paid accounts. [1] https://github.com/signalapp/Signal-Android/commit/7da3357b5... [2] https://soatok.blog/2025/0
Read the rest
2/18/reviewing-the-cryptography-us...
In How Trail of Bits helps verify the integrity of Signal chats
holowoodman·Jan 4, 2026
> Because Signal's client software still is open source. Only when you can trust that the published client source code is equivalent to the distributed client binaries. The only way to do this is reproducible builds, since building your own client is frowned upon and sometimes actively prevented by the signal people. Signal has always been a my-way-or-the-highway centralized cathedral, no alternate implementations, no federation, nothing. Which was always a suspicious thing. Also, "the signal client is open source software" only holds if you don't count in the proprietary Google blobs that the signal binary does contain: FCM and Maps. Those live in the same process and can do whatever to E2EE... About the signal client that does the E2EE, reproducible builds are frequently broken for the signal client, e.g.: https://github.com/signalapp/S
Read the rest
ignal-Android/issues/11352 https://github.com/signalapp/Signal-Android/issues/13565 and many more. Just search their issue tracker. The latter one was open for 2 years, so reproducible builds were broken at least during 2024 and most of 2025 for the client. They don't keep their promise and don't prioritize fixing those issues, because they just don't care. People do trust them blindly and the Signal people rely on that blind trust. Case in point: you yourself reviewed their code and probably didn't notice that it wasn't the code for the binary they were distributing at the time. Now you might say that reproducible builds in the client you reviewed weren't affected by their Mobilecoin cash grab, and you are right, but it shows a pattern in that they don't care, and even lots of professionals singing their praises don't care. And their server code does affect your privacy even with E2EE. The server can still maliciously correlate who talks to whom. You have to trust their published source code correctly doing its obfuscation of that, otherwise you get metadata leaks the same as in all other messengers. The server can also easily impersonate you, read all your contacts and send them to evil people. "But Signal protects against this", you say? Well, it does by some SGX magic and the assurance that the code inside the enclave does the right thing. But they clearly don't care about putting their code where their mouth is, they rather put their code where the money was. Behind closed doors, until they could finish their Mobilecoin thingy. >> The Signal people are absolutely not trustworthy for reasons of money and greed. > I don't think you've raised sufficient justification for this point. Trust is hard to earn and easy to squander. They squandered my trust and did nothing to earn it back. Their behavior clearly shows they don't care about trust, because they frequently break their reproducibility and are slow to fix it. They cared more about their coin thing. They are given trust, even by professionals who should know better, because their cryptography is cool. But cryptography isn't everything, and one should not trust them, because they obviously are more interested in Mobilecoin than in trust. What more is there to justify, it's obvious imho.
In The PGP problem (2019)
some_furry·Jan 4, 2026
> Signal was made by people who then used it to push their get-rich-quick cryptocurrency scheme on users and who threw all their promises of being open-source and reproducible over board for it. I reviewed Signal's cryptography last year over a long weekend: https://soatok.blog/2025/02/18/reviewing-the-cryptography-us... There's a lot to be said for the utility of reverse engineering tools and skills, but I did not need them, because it was open source. Because Signal's client software still is open source. Whatever you think about MobileCoin, it doesn't actually intersect with the message encryption features at all. At all. The only part in Signal that's not entirely open source are the anti-spam features baked into the Signal Server software. And, frankly, the security of end-to-end encryption messaging apps has so little to do with wha
Read the rest
tever the server software is doing that it's frankly silly to consider that relevant to these discussions. https://soatok.blog/2025/07/09/jurisdiction-is-nearly-irrele... And, yes, this is only a server-side feature. See spam-filter (a git submodule) in https://github.com/signalapp/Signal-Server but absent from https://github.com/signalapp/Signal-Android or https://github.com/signalapp/Signal-iOS > The Signal people are absolutely not trustworthy for reasons of money and greed. I don't think you've raised sufficient justification for this point.
In The PGP problem (2019)
RealCodingOtaku·Nov 29, 2025
> Surprised how many people don't seem to know about it. There are a few reasons for that. 1. The link to APK cannot be found on the official site[0], so it needs to be looked up in a search engine. 2. Even when downloading from the site, they try to scare you away with a warning [1]. The reason for warning could be avoided by hosting their own F-droid repo, but they refused it, claiming you can download APK and not listening to reason[2]. Though for people using F-droid can still get Signal through the Guardian repository [3] Thing about the signal APK and the Guardian one is that, it still have the so called "crap" in the final APK, it just runs a background service when required google services are not detected, causing battery drain for many[4]. The drain could also be avoided by supporting UnifiedPush (it can fall back to FCM when it
Read the rest
's detected), but they don't want to do that either[5]. [0] https://signal.org/download/ [1] https://signal.org/android/apk/ [2] https://community.signalusers.org/t/how-to-get-signal-apks-o... [3] https://guardianproject.info/fdroid/ [4] https://github.com/signalapp/Signal-Android/issues/9729 [5] https://community.signalusers.org/t/use-gcm-fcm-alternatives...
In Molly: An Improved Signal App
godelski·Nov 29, 2025
> It sounds good in theory but signal updates are beyond excessive Those are two different arguments. Updating too frequently is not equivalent to "doesn't need to be updated." I can agree that they update a bit too frequently but that's nowhere near the argument about never updating. A program cannot be secure if it does not update. Full stop. > Most of the time there is zero explanation for the update There's always a changelog. If you, unlike most people, are interested it is all open source https://github.com/signalapp https://github.com/signalapp/libsignal/releases https://github.com/signalapp/Signal-Android/releases https://github.com/signalapp/Signal-iOS/releases https://github.com/signalapp/Signal-Desktop/releases I would suggest looking at the actual commits and not just the release notes. Libsignal usually has mor
Read the rest
e info about the security > legitimately can't think of another app or program that updates more frequently Probably because they do so silently.
In Molly: An Improved Signal App
g-b-r·Nov 29, 2025
"fdroid repos" have little to do with what people consider F-Droid, they can host any whatsoever binary. In fact, that's not a build by the Guardian Project, but (when I tried) a redistribution of Signal's https://github.com/signalapp/Signal-Android/releases builds. I'm not sure why they're doing it; anyhow, I'd at least avoid doing the initial installation through that repo, you're trusting an additional party for no gain that I could think of (updates are ok because the signature needs to match the one of the installed version).
In Molly: An Improved Signal App
greysonp·Sep 9, 2025
Hi! I don't know if we'll have anything super official, but the code is obviously all open source, and the backup file is just a stream of protobufs[1], so it shouldn't be too bad to make a tool. I know have some rough CLI tools sitting around -- I'll see if there's anything we want to clean up and release publicly when the local backup portion of this launches. Also, as someone else noted, the format is indeed incremental. So while we'll still do the thing where we keep the last two backups on disk, because those two backups will share almost all the same media files, the size on disk will be much much smaller. As someone with a 50 GB backup file, this was very much a goal for me :) [1] https://github.com/signalapp/Signal-Android/blob/main/app/sr...
In Signal Secure Backups

Showing the 15 most recent of 372 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.