Signal ties a new zero-knowledge-proof credential to numberless accounts
A Hacker News post pointing to page ten of a long-running Signal community forum thread, 'Registration without a phone number,' gathered 258 points and 123 comments. The story is not a Signal press release. It comes from what forum members have pieced together from two things posted in that same thread: a Signal staff explanation of how zero-knowledge proofs already work inside the app, and a run of public commits to Signal's own open-source Android client that build phone-number-free ('numberless') registration and login.
On 26 August 2026, Signal staff member Alex Hart, posting under the forum account alex-signal, replied to a member going by Talya (rassilon1963), who had pointed out that zero-knowledge proofs are not new to Signal: they already underpin donation badges, backup payments, and the groups feature, in each case stopping the server from tying a user to a specific donation or a specific group. Hart added a fourth existing use: zero-knowledge proofs also verify that a chosen username meets Signal's character-set and length rules 'without actually revealing contents.'
Separately, other forum members have been tracking commits to signalapp/Signal-Android, mostly credited to a contributor working under the name greyson-signal. The earliest, on 25 August 2026, reworked the registration module to allow setting a username during signup, alongside a same-day commit that began scaffolding a new 'signal login' screen. The numberless-specific work surfaced in a batch committed on 2 September: 'Add basic ability to register numberless account,' 'Add basic ability to login to an existing numberless account,' and, the one that ties the feature to cryptography, 'Use new zkgroup credential for numberless accounts.' zkgroup is Signal's existing zero-knowledge-proof credential library, the same kind of mechanism already used for donation badges and the username check Hart had just described. On 9 September a further commit, 'Add ability to pay for a signal login,' attached a paid element to the same login and registration work, with no accompanying explanation of price or terms.
No Signal blog post, press release, or staff statement in the thread announces phone-number-free registration or explains what the zkgroup credential proves or hides. The connection between Hart's remarks and the commits is one the community drew by reading both in the same thread, not something Signal stated directly. No release date, beta-versus-stable channel, or rollout plan appears anywhere, and nothing says whether phone-number-based registration will be removed or kept as an alternative once numberless accounts ship.
A side discussion in the thread asked whether an existing user could unlink a phone number from their account without re-registering. One member, zetabeta, suggested unlinking could be free of charge. Another, desert_nip, said nothing in the thread points to that being planned, warning that free unlinking would let spammers register with one number, unlink it, and repeat indefinitely for unlimited free accounts, and floating a cooldown period between unlinking and re-registering. zetabeta replied that a cooldown is reasonable, for example one month, while acknowledging that even a one-month cooldown 'may not be enough to prevent spammers and scammers,' and that it cannot be long either.
Key facts
- Commits to Signal's public Android repository, mostly credited to a contributor named greyson-signal, added phone-number-free ('numberless') registration and login between 25 August and 9 September 2026.
- A 2 September commit, 'Use new zkgroup credential for numberless accounts,' is the direct evidence tying Signal's zero-knowledge-proof library to numberless accounts.
- A forum member had already noted that zero-knowledge proofs protect donation badges, backup payments, and group membership; Signal staff member Alex Hart added on 26 August that they also check username character and length without exposing the underlying data.
- No Signal announcement, release date, or rollout channel accompanies the commits, and nothing states whether phone-number-based registration will be removed or kept once numberless accounts ship.
- A 9 September commit added the ability to pay for a 'signal login' with no stated price or terms, while a separate proposal to let existing users unlink a phone number without re-registering remains unconfirmed and drew spam-abuse warnings from commenters.
Why it matters
Signal already avoids holding more information about its users than it has to, and a phone number at signup is one of the last places where a real-world identifier still touches account creation. Zero-knowledge proofs are the same cryptographic tool Signal already uses to run donation badges, handle backup payments, verify group membership, and check that a username fits its rules, all without the server learning the underlying value. A commit already attaches that same tool to the numberless-account work; if the feature ships, it would extend the pattern to the one step that currently still needs a working phone number and an SMS or voice code.
Who it affects
Anyone who cannot or will not supply a phone number for a Signal account: people without a personal number, users on VOIP-only lines, and privacy-conscious or high-risk users such as journalists and activists who avoid putting a phone number on file with any service. It also affects Signal's own abuse prevention, since phone verification currently limits how many free accounts one person can create; whatever replaces it has to do that job too, as the spam concern raised in the same thread shows. The commits so far are all in the Android client's public repository; nothing in the thread says which release channel they might reach first.
How to use it
Nothing here is available to use yet. Every commit described comes from the public GitHub history of Signal's Android app, not from a shipped feature, a beta toggle, or an announcement, and no release date or channel is stated anywhere in the thread. The one commit about payment, 'Add ability to pay for a signal login,' confirms that some paid element is attached to this work, but neither the commit message nor the thread says what it costs or what it unlocks.
How solid is it
The cryptography claim is well founded twice over: a forum member described zero-knowledge proofs as already running inside donation badges, backup payments, and groups; a Signal staff member, posting under a staff-labelled forum account, confirmed they also check usernames; and a separate, real commit in Signal's own repository explicitly adds a new zkgroup credential for numberless accounts. What is not solid is the link between the two: no Signal statement in this thread ties the zkgroup commit to the staff explanation, says why the credential is needed, or confirms numberless registration as a planned feature at all. That connection is the community's own reading of two posts in the same thread, not a claim Signal has made.
Risks and caveats
Whether phone-number registration disappears or stays as an option once numberless accounts ship is not stated anywhere in the thread. A related idea, letting an existing user unlink their phone number without re-registering, is explicitly unconfirmed: one member said nothing points to it being planned, and flagged the obvious abuse path if unlinking were ever free: get a number, register, unlink, repeat, for unlimited free accounts. Another proposed a cooldown, such as one month, as a partial fix, while admitting a short cooldown may not stop spammers and scammers, and that it cannot be long either.
“ZKP is also used for verifying things like username character set and length without actually revealing contents which is super cool and comprises of math waaaayyyyy above my head.”
— Alex Hart, Signal staff member, in the Signal community forum