How to verify you're talking to the right person: encryption safety numbers explained
The part encryption doesn’t cover
End to end encryption gets marketed as a single feature: your messages are private. That’s true as far as it goes, but it answers the wrong question for a specific kind of worry. Encryption guarantees that nobody in the middle can read your message. It does not, by itself, guarantee that the person receiving it is who you think they are.
Those are two different problems. One is “can someone intercept this,” which strong encryption handles well. The other is “is this actually my contact, or someone who’s taken over their account, swapped their SIM, or set up a new device claiming to be them.” That second problem is what safety numbers (Signal calls them safety numbers, WhatsApp calls them a security code, some apps call them a fingerprint) exist to solve.
How the keys actually work
When you start a conversation in an app like Signal or WhatsApp, both devices generate a pair of cryptographic keys: one public, one private. The public key gets shared so messages can be encrypted specifically for you; the private key stays on your device and is what decrypts them. Nobody else, including the app’s own servers, holds your private key.
A safety number is derived from both parties’ public keys, usually run through a hash and displayed as a string of digits or a QR code. If your public key and your contact’s public key are the ones the app actually used to encrypt the conversation, the safety number you see will match the one they see on their own screen. If someone has substituted a different key, either because the account moved to a new device or because something less benign happened, the safety number changes.
This is a math problem with a math answer. The number doesn’t depend on trusting the app’s servers to tell you the truth. It’s computed on each device from the actual keys in use. Independently. That’s why comparing it out of band, in person or over a channel you already trust, means something. Seeing “verified” in the app’s own UI does not mean the same thing.
Why the number changes
A changed safety number is not automatically a red flag. The most common reasons are mundane:
- Someone reinstalled the app, which generates a fresh key pair.
- Someone got a new phone and restored their account onto it.
- Someone reset the app’s storage without a backup and started clean.
All of these regenerate keys, and regenerated keys mean a new safety number, whether or not anything malicious happened. The app will usually flag this with a notice like “your safety number with X has changed.” That notice is doing its job. Treat it as a prompt to re-check, nothing more.
The less mundane reasons are the ones this feature is actually built to catch. Someone gained control of your contact’s account. A SIM swap, a compromised recovery method, a stolen device. They are now messaging you from a session with different keys than the ones you’d previously verified. Encryption alone doesn’t distinguish between “my friend got a new phone” and “someone else is now operating my friend’s account.” Verification is the step that does.
Who actually needs to do this
Verifying safety numbers for every contact in your messaging app is not a realistic habit, and telling people to do it universally is the kind of absolutist advice that gets ignored. Most conversations don’t carry enough risk to justify the friction.
Where it earns its keep is a small number of higher stakes situations. A source. A lawyer. A business partner. Or with a family member during a period where account takeover is plausible, like a divorce, a dispute, or a known breach at a company that handles your recovery email. It also matters more for the first message in a relationship, before you’ve built up months of context that would make an impersonator’s mistakes obvious.
Think of it less as a permanent checklist and more as something you reach for when the identity of the person on the other end actually matters to the decision you’re making. Sending a photo to a friend doesn’t need it. Confirming wire transfer details or sharing something you can’t take back does.
How to check it, concretely
In Signal, open the conversation, tap the contact’s name at the top, and look for “view safety number.” You’ll get a block of numbers and a QR code. In WhatsApp, it’s in the contact info screen under “encryption,” labeled as a security code.
There are two ways to compare it with your contact, and they are not equally strong:
Scan the QR code, in person. One person opens the code, the other scans it with their camera in the app. This is the most reliable method because it removes the possibility of a typo or a lookalike digit, and doing it in person means you’re not relying on a phone call or video feed that could itself be compromised.
Read the digits aloud over a channel you already trust. If you can’t be in the same room, read the number out over a voice call you’re confident is really with that person (not the messaging app itself, since that’s the thing you’re trying to verify). This is weaker than an in person QR scan but far better than nothing, and it’s the realistic option for most remote relationships.
What doesn’t work: asking “is your safety number 1234…?” inside the same chat you’re trying to verify. If the chat has been compromised, the answer will just come from whoever controls it now.
What verification actually proves, and what it doesn’t
A matched safety number tells you that the encryption keys on both ends line up, meaning the messages you’re sending really are being encrypted for the device you just verified, and nobody has substituted a different key in the middle. That’s a specific, useful guarantee.
It does not tell you the device itself is clean. If your contact’s phone has malware reading messages after they’re decrypted, a perfect safety number match won’t catch that, because the problem is happening after encryption already did its job. It also doesn’t tell you the person is typing free of duress or coercion. And it doesn’t make the conversation invisible to anyone; metadata like who’s messaging whom and when is a separate question with a separate set of protections, not something a safety number addresses. No single check, and no single app, makes you anonymous or untraceable, and nothing here should be read as advice for evading a lawful investigation. Safety number verification solves one narrow problem: confirming you’re encrypting for the right key. Treat it as exactly that, not as a general safety guarantee for everything you discuss.
A reasonable habit, not a ritual
The practical version of this is small: pick the handful of contacts where being wrong about identity would actually cost you something, verify with them once when you set up the conversation, and re-verify when the app tells you the number changed and you don’t already know why (new phone, reinstall). For everyone else, it’s fine to rely on the encryption doing its normal job without adding a verification step that has no real payoff.
If you want more explainers like this one that stay specific about what a given privacy tool does and doesn’t cover, you can find them on the privacy wire.