Signal has added encrypted local backups to its iOS and Desktop apps and enabled restoring them across platforms, Help Net Security reported on 30 September 2026. Signal for iOS version 8.30 completes the rollout of the backup improvements [1].
Background
Signal introduced an optional end-to-end encrypted hosted backup service in September 2025. A backup is a copy of message history, and it is a target because it can contain years of private conversation. Where a backup is kept, and who holds the key that opens it, decides how private it stays.
What the report describes
Local backups are stored on the device and are supported by Signal Desktop and iOS for the first time. Android was rebuilt to use the same format. Signal states that media is stored in a separate folder, so that periodic syncing is easier, and that duplicate files are stored once [1]. Backups can be restored on Android, iOS, Linux, macOS and Windows [1].
Local backups depend on the user's recovery key alone and have no protection from a trusted execution environment (TEE). Signal warns users never to share the recovery key. Hosted backups use two keys: the recovery key and a supplemental key that rotates daily and is stored in a TEE. The supplemental key cannot decrypt a backup on its own, which gives forward secrecy [1].
The hosted service has a free tier that backs up text messages and the last 45 days of media, and a paid monthly tier that allows up to 100GB of media. Linked devices can ask the primary device for missing files through an end-to-end encrypted attachment. Messages set to disappear within 24 hours are excluded from both backup types [1].
Implications for Mac users
A Signal Desktop user on a Mac can now keep a backup on an external drive or a folder of their choice, and restore it on another platform [1]. The report states that a local backup may be kept on any drive or service. If the chosen folder is synced by a cloud service, the encrypted file leaves the Mac, and its security then rests on the recovery key alone.
Recommendations
- Store the recovery key offline, apart from the backup, and never share it.
- Keep a local backup on an encrypted drive, or in a folder that no cloud service syncs, unless you accept the trade-off.
- Decide whether the hosted service, with its extra key, suits your threat model better than a local file.
- Remember that disappearing messages under 24 hours are not in either backup.
Relevance to FireAI
FireAI does not read or protect the content of backups or messages, and it does not manage Signal's keys. It is a network firewall: if a backup folder is synced online, Activity shows which app uploads and to which company, and the world map shows the destination. Large uploads to one country far above the usual rate are flagged as upload spikes, which FireAI does not block by itself.
Limitations
The report describes Signal's announcement and does not include an independent evaluation of the backup design. It does not give the price of the paid tier.
Try FireAI, by HisnLabs free for 17 days.