Signal brings encrypted local backups to iOS and desktop, adds cross

Signal users who switch from an Android phone to an iPhone, or the other way around, can take their message history with them, and backups can be restored on Android, iOS, Linux, macOS and Windows. The option is part of a set of backup updates the company finished rolling out with Signal for iOS version 8.30.

The changes build on Signal Secure Backups, an optional end-to-end encrypted backup service introduced in September 2025. Signal said it worked on the improvements over the past year based on user feedback.

Local and hosted backups

Signal Desktop and Signal for iOS can make on-device backups for the first time. The Android version was rebuilt to use the same format.

Local backup option on iOS (Source: Signal)

“Previously, the local Signal Android backups included everything in a single archive, so daily snapshots took up a lot of extra space. Now backup media gets stored in a separate folder so it’s easier to periodically sync, and duplicate files are only stored once, which also helps save space if you decide to mirror an on-device backup to an external hard drive or NAS server on your network,” Signal said.

The hosted service backs up text messages for free, along with the last 45 days of media. For a monthly fee, users can back up to 100GB of media.

Linked devices can also fill that gap. “For instance, if you open a message thread on a newly linked laptop and scroll beyond the 45-day limit, Signal Desktop can now securely request a copy of any missing files directly from your primary device as an end-to-end encrypted attachment.”

Paid users can offload older photos and videos, leaving a thumbnail on the device. Signal says 5GB of unused media drops to 600MB with this setting.

Hosted backups are protected by the user’s recovery key and by a second key that rotates daily and is kept in a Trusted Execution Environment (TEE). The second key cannot decrypt a backup on its own and adds forward secrecy. Signal said TEEs are “currently the best way to protect this supplemental key.”

On-device backups can be stored on any drive or service, so they cannot use the TEE. Their recovery key decrypts all past backups, and Signal warns users never to it with anyone.

Disappearing messages set to vanish within 24 hours are excluded from both backup types.

“Expired disappearing messages in an on-device backup are automatically skipped during the transfer process when you restore that backup, but you may want to take additional steps such as setting a shorter expiration timer for disappearing messages in on-device backups,” Signal noted.

The iOS update also includes a reworked iPhone-to-iPhone transfer over a local end-to-end encrypted Wi-Fi Aware link.

“This wraps up the first phase of the backups project, but we’re hard at work on several non-backup improvements too,” it concluded .

EU Cyber Resilience Act requirements for containers and Kubernetes

NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)

Malicious Custom GPT on chatgpt.com lures users into installing a RAT

Download: The High-Performance Team Playbook

Simplify security management with CIS SecureSuite Platform

Download: The IT and security field guide to AI adoption

OWASP Noir: Open-source static analysis tool

EU Cyber Resilience Act requirements for containers and Kubernetes

Most open critical and high flaws are over 90 days old

NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)

Webinar: Closing the accountability gap in AI-assisted delivery