Learn / Does Signal have a web version?
Explainer · updated for 2026A lot of people search for "Signal web" hoping to open a tab and start messaging. Here is the straight answer, the reasoning behind it, and what your options actually are.
Short answer: No — Signal has no web or browser version, and its developers have explicitly declined to build one. Signal Desktop is an installed application that must be linked to a phone already running Signal. If you need end-to-end encrypted messaging in a plain browser tab with nothing installed, you need a different tool built for that trust model.
Open the web appGet the app for Android or iPhone
Last updated October 18, 2026. Signal's web-client stance was last re-verified against the closed GitHub request on September 11, 2026. Living page — corrections welcome.
“Does Signal have a web version?” usually means “can I do this on the machine in front of me”. The answer changes by device, and on one of them Signal has no answer at all. Pick your situation and the table marks the rows that apply.
5 situations covered
Signal vs Sendant, by situation
Re-checked 27 October 2026
| Situation | Signal | Sendant |
|---|---|---|
| Android phone | Install — the Play Store app is the only way in. | Install or browser — Play Store, or app.sendant.io with nothing installed. |
| iPhone | Install — the App Store app, and still no web client. | Install or browser — the App Store app since August 2026 (iOS 17+), or the same client in Safari. |
| Windows or Mac | Install, then link — Signal Desktop has to be paired with a phone that already runs Signal. | Nothing to install — open app.sendant.io in a tab; identity, contacts and history persist. |
| A computer where you cannot install anything | Nothing works — there is no browser path to fall back on. | A tab is enough — subject to your organisation's policy, which is a separate question from whether it is technically possible. |
| You have no phone number to give | Not possible — a number is required to register. Usernames hide it; they do not replace it. | Not asked for — identity is a key generated on the device, with no email and no account either. |
The row where Sendant loses is not in this table, deliberately. Audited maturity is a Signal strength and a Sendant gap, and a table sorted by “where can I log in” will always hide that. It is on Sendant vs Signal in full: Signal has years of third-party audits, Sendant has none yet.
Signal runs on phones and desktops — as installed software only. The full lineup:
Practical consequence: if you can't install software — a locked-down work laptop, a library or school computer, a borrowed device — you can't use Signal on it. That's not an oversight; it's a decision, explained below.
The rows below answer the only question this page is about: can you message in a browser tab, and what does that take?
| Dimension | Signal | Sendant |
|---|---|---|
| Browser client | No web version; Signal Desktop is an installed app. | Yes — app.sendant.io, nothing to install. |
| Install required | Yes, for every desktop use. | No — the browser client is persistent — identity, contacts and history survive closing the tab. |
| Phone number | Required to register; usernames hide it but don't replace it. | Not required — no phone number, email, or account. |
| Message history | Full history on phones and the linked desktop app. | Full encrypted history; the browser tab is a first-class client, not a temporary session. |
| Independent audits | Repeatedly audited, with years of public analysis. | Not yet audited; an independent audit is planned. |
The trade, stated plainly: Sendant gives up Signal's audit history and maturity. In exchange it removes the install and the phone number.
Signal's refusal deserves to be presented honestly, because it's a principled position, not laziness. Three concerns drive it:
A web app receives fresh code from the server every time you open it. That means a compromised — or legally coerced — server could serve malicious JavaScript to one specific user, once, and quietly exfiltrate keys or plaintext. An installed app's code changes only when you update it, which makes targeted tampering far harder and more detectable.
Browsers host extensions with broad page access, and a malicious or compromised extension can read what's on the screen or in the DOM. The browser environment simply has more moving parts between the crypto and the user than a dedicated installed app does.
Long-term secret keys stored in browser storage (IndexedDB, localStorage) enjoy fewer OS-level protections than keys held by an installed app, which can use platform keychains and hardware-backed stores.
Given Signal's threat model — high-risk users, nation-state adversaries — the team concluded the browser's guarantees weren't strong enough, and chose not to ship a client it couldn't stand behind. Whatever you think of the tradeoff, that is engineering integrity, and it's the same reasoning behind Signal's other famous requirement: the phone number.
Signal's objections are real problems, not excuses. Any messenger that does run encrypted messaging in a browser has to answer each of them directly:
Since the server ships the code, the delivery pipeline itself must be hardened: a strict Content Security Policy so no unexpected script can run, and — still ahead for Sendant, as a roadmap item — a signed build manifest so the browser can check that what the server served matches a published release. That narrows "the server can serve anything" toward "the server can serve only what it committed to."
Keys have to live somewhere the browser protects as strongly as it can — origin-isolated storage, non-extractable key material where the platform supports it — while being honest that this still trails an installed app's access to OS keychains and hardware-backed storage.
The subtle failure mode is shipping a second, JavaScript rewrite of the protocol for the web that slowly drifts from the native implementation. The robust answer is compiling the same crypto code to WebAssembly, so browser and native app run one implementation with one set of bugs to find and fix.
Sendant made the opposite call from Signal: the browser is exactly where private messaging is missing, so the hard problems above are worth solving rather than avoiding. Sendant is, as far as we know, the only identifier-free messenger with a persistent no-install browser client — open app.sendant.io and you're messaging, with no phone number, no email, and no account. The browser runs the same WASM-compiled X3DH + Double Ratchet crypto path as the native app, so there is no second implementation to drift. On an iPhone, Sendant offers both: a native app on the App Store (available since August 2026) and the same browser client, with nothing to install.
Honest tiering: the browser client is Sendant's low-friction tier — the way in when you can't install anything. An installed app remains the higher-assurance tier, for exactly the reasons Signal articulates: stabler code delivery and stronger key storage. And Sendant has not yet been independently audited; an audit is planned, and known limitations are documented rather than hidden. If audited maturity is your top requirement today, Signal wins that row.
If you just need Signal: this page isn't a trick to switch you. If your contacts are on Signal and you can install apps on your devices, Signal Desktop plus the mobile app is a mature, heavily audited setup — use it. The browser question only bites when installing isn't an option or a phone number is the dealbreaker; see the full Sendant vs Signal comparison for where each one wins.
No. Every way of using Signal requires an installed app: the mobile app on Android or iOS, and Signal Desktop, which itself must be linked to a phone that already runs Signal. There is no signal.org page you can open in a browser and start messaging from.
Because Signal's team considers the browser trust model too weak for its threat model. A web app receives fresh code from the server on every visit, so a compromised or coerced server could ship malicious JavaScript that steals keys or plaintext. Signal has explicitly declined to build a web version rather than accept that risk. It is a principled engineering position, not a missing feature.
The browser is a genuinely harder trust model: you re-trust the server's code delivery on every visit, and key storage in a browser is weaker than in an installed app. Mitigations exist — a strict Content Security Policy, signed build manifests, and running the same crypto implementation as the native app compiled to WebAssembly rather than a separate JavaScript rewrite — but an installed app remains the higher-assurance option. A well-built browser messenger is a reasonable low-friction tier, not a replacement for a native app when the stakes are highest.
Ephemeral encrypted chat rooms exist on the web, but they are one-off links, not persistent messengers with contacts and history. Sendant is a persistent encrypted messenger that runs entirely in the browser at app.sendant.io, with no phone number, email, or install — the browser is its low-friction tier, and an installed app remains the higher-assurance tier. See how it stacks up in the Sendant vs Signal comparison.
More on the browser option: what a browser-based messenger can and cannot promise for privacy, how to send secure messages from a browser, and why persistence is the hard part of browser messaging.
No phone number, no email, no install. See what the browser tier feels like — or start with the FAQ and the full comparison hub.
Open web appSendant vs Signal