Signal sells a phone-number-free account for $2.99 through Google Play billing

A user pays, screenshots the Account ID and recovery key, replaces the phone, and finds there is no support channel and no appeals process. Greyson Parrelli, Signal's lead Android developer, told testers to treat the two strings like a username and password and to keep them in a password manager ^[4]. "If you lose them, your account is gone," Parrelli wrote. "There is no other recovery mechanism." ^[5]

Reachability is the other thing a rollout has to settle before anyone signs up. "If you choose not to add a username, your account will be completely unreachable," Parrelli wrote, and the only chats a user can take part in are the ones they start themselves ^[6]. For a source who wants to contact a newsroom and nobody else, outbound-only is the point. For a contractor you need to raise on a Sunday, it means the account cannot receive a first message at all.

Parrelli said the fee exists to keep these accounts scarce. "If it was free, spammers would acquire massive numbers of these accounts and ruin our network," he wrote ^[7]. At the launch price, 10,000 accounts cost $29,900 ^[16]. That stops a hobbyist, and it is a modest line item for anyone reselling accounts. Signal has already said the number may move: "Hopefully we chose the right price, but if these accounts somehow become a spam vector, we may have to increase the price in the future," Parrelli wrote ^[8].

Signal runs the purchase through the same zero-knowledge proofs it uses for donations, so its servers can confirm that someone paid without tying the payment to the account that gets created ^[9]. Google's side of the transaction keeps a plainer record: a particular Google account bought a Signal Login product at a specific time ^[11]. Gizmodo describes the request pattern that follows, where a government asks Signal for Account ID activity and Google for the Play purchase, then tries to line the two up by timing ^[11]. Google generally requires Play-distributed apps to use Play billing for digital in-app purchases, which is the likely reason there is only one rail ^[17].

WhatJustShipped, reviewing the Android code commits, put the consequence this way: "If the shipping version still says Play only, the group with the strongest reason to want a numberless account, people who deliberately run degoogled Android, will be the only group that cannot get one" ^[12]. GrapheneOS is the clear case. The hardened Android build, usually run on Pixels, is made for people who treat Google accounts and Play Services as a tracking surface they do not want, and they cannot buy a Signal Login unless they install GrapheneOS's sandboxed Play Services workaround ^[13].

Signal added usernames in 2024 so people could start a chat without showing their number, and the app went on collecting the number at signup regardless ^[15].

Deciding whether to hand someone one of these accounts turns on reachability and the threat model. Does the person need to receive first contact from someone who does not already have their handle? If yes, a username is mandatory, and you are now managing a handle and a recovery key instead of a phone number. If the threat model includes the app store, the Android checkout does not answer it, and the workaround for that user is sandboxed Play Services on the device they hardened to keep Google off ^[13].