How do I enable Registration Lock in Signal to protect against re-registration attacks?
Applies to: Signal Private Messenger (iOS, Android)
Last updated: September 2025
Problem
If someone gains access to your phone number (through a breach, SIM-swap, or phishing attack), they could attempt to register your number on another device. While Signal messages are still encrypted, an attacker could send and receive new messages in your name.
Without Registration Lock, there’s no extra barrier preventing this kind of unauthorized re-registration.
Solution
You can protect your Signal account by enabling Registration Lock, which requires a PIN in addition to the SMS code when registering your number on a new device.
Step-by-step instructions
On Android
- Open the Signal app.
- Tap your profile icon in the top-left corner.
- Go to Settings > Account.
- Select Registration Lock.
- Create a Signal PIN (at least 4 digits, but longer or alphanumeric is safer).
- Confirm your PIN and turn on Registration Lock.
On iOS (iPhone/iPad)
- Open Signal.
- Tap your profile icon at the top-left.
- Go to Settings > Account.
- Tap Registration Lock.
- Enter and confirm a strong PIN.
- Enable Registration Lock.
Verifying setup
7. Signal will occasionally ask you to enter your PIN to help you remember it.
8. If you try to register your number on another device, Signal will require both the SMS verification code and your Registration Lock PIN.
Optional methods or tools
- Password managers: Store your Signal PIN securely if you’re worried about forgetting it.
- Longer PINs: Use at least 6 digits or an alphanumeric PIN for stronger protection.
Best practices or tips
- Never share your PIN or SMS verification codes with anyone.
- If you receive a verification code unexpectedly, it may mean someone is trying to re-register your number.
- Write down or securely store your PIN — if you forget it, you’ll need to wait until Signal allows PIN reset (this is by design for security).
- Combine Registration Lock with phone carrier PINs to protect against SIM-swap attacks.
