Because they're building a private, not anonymous, instant messenger. They've been very open about this.

Spam prevention

Privacy ≠ anonymity

Everything is a balancing act. Privacy, anonymity, and security aren't the same things. They're sometimes, and in some aspects always, difficult to achieve without compromising one of the other two.

When you add in the goal of quick, easy setup to make the service useful in the first place. Doesn't matter how good the service is at the trinity if nobody is willing to use it. Signal just errs on security first, privacy second, anonymity third.

So, you're going to get two schools of thought on this, and one of them is wrong. Horrendously wrong. For perspective, I was a certified CEHv7, so take that for what its worth.

There's a saying in security circles "security through obscurity isn't security," which is a saying from the 1850s and people continually attempt to apply the logic to today's standards and it's--frankly stupid--but just plain silly. It generally means that if you hide the key to your house under the floor mat, there's no point to having the lock, because it doesn't lend you any real security and that if you release the schematics to security protocols and/or devices (like locks), it makes them less secure. And in this specific context, it makes sense and is an accurate statement. Lots of people will make the argument that F/OSS is more secure because it's openly available and many will make the argument that it's less secure. But each argument is moot because it deals with software development and not your private data. lol.

When you apply the same logic to technology and private data it breaks down tremendously. This is the information age. With a persons phone number I can very likely find their home address or their general location. Registered cell phones will forever carry with them the city in which they were activated. So if I have your phone number, and know your name is John Smith, I can look up your number and see where it was activated. It'll tell me "Dallas, Texas" and now I'm not just looking for John Smith, I'm looking for John Smith in Dallas, Texas. With successive breakdowns like this I will eventually find your home address or at the very least your neighborhood.

The supposition made by Signal (and anyone who defends this model) is that generally anyone with your private number is supposed to have it and even if they do, there's not much they can do with it. But that's so incredibly wrong it's not even funny in 2025.

I've seen a great number of people in this thread post things like "privacy isn't anonymity and anonymity isn't security," which frankly I find gobstopping hilarious from a community that will break their neck to suggest everyone run VPNs to protect their online identity as a way to protect yourself from fingerprinting and ad tracking.

It frankly amazes me. Protecting your data, including your phone number is the same as protecting your home address and your private data through redirection from a VPN. I don't think many in this community would argue against using a VPN. But why they feel you should shotgun your phone number all over the internet is fucking stupid, IMO, or that you should only use a secure messaging protocol to speak to people you know, and not people you don't know. It's all just so...stupid.

They'll then continue to say that you should only use Signal to talk to people you know because "that's what its for!" as if protecting yourself via encryption from compete fucking strangers has no value all of a sudden. lol

You have to be very careful in this community because there are a significant number of armchair experts which simply parrot the things that they've read from others ad-nauseam without actually thinking about the basis of what they're saying.

OK. That's my rant. I'm ready for your downvote.

Signal fills an incredibly important spot in a spectrum of privacy and usability where it's extremely usable without sacrificing very much privacy. Sure, to the most concerned privacy enthusits it's not the best, but it's a hell of a lot easier to convince friends and family to use Signal than something like Matrix.

Privacy ≠ Anonymity ≠ Security

Bots. If it makes you feel better, you can disable other people finding you via phone number and just give them your username. All messages are private.

One of the design goals is that they don't have a user database, so governments etc can't knock down their door demanding anything. By using phone numbers your "contacts" are not on their servers but local on your phone.

0. Yes, and in that time you would visit a website with your own IP address likely, likely over HTTP without SSL/TLS, likely with your vulnerable browser fingerprint. Point?

1. Privacy, not anonymity. Two completely different things.

2. Because the way Signal is built hosting it requires a lot of resources (storage especially), so they want spam prevention and fewer accounts per person.

SimpleX

Reduce spam bot accounts and other malware, as well as to allow for user discovery so you can find your contacts more easily. It's not designed to be an anonymous service, just a private one.

https://jami.net/

Offers the same privacy but is not centralised. it's peer to peer

The amount of trolls in this thread that either try to spew false information intentionally or just have no idea what they are talking about is insane.

If you are worried about what data (including your phone number) law enforcement can recieve (if they have your specific user ID, which is not equal to your phone number) from the Signal company check this: https://propertyofthepeople.org/document-detail/?doc-id=21114562 Tldr: It's the date of registration and last time user was seen online. No other information, Signal just doesn't have any other and this is by design.

If you want to know more about how they accomplish that feat you can check out the sealed sender feature: https://nerdschalk.com/what-is-sealed-sender-in-signal-and-should-you-enable-it/

or the private contact discovery system: https://signal.org/blog/private-contact-discovery/

Also as Signal only requires a valid phone number for registration you might try some of these methods (not sure if they still work): https://theintercept.com/2024/07/16/signal-app-privacy-phone-number/

It's focused on ensuring there is no middleman between you and the other party, but it does not have a goal to provide anonymous messaging. Sadly.

I think it's important to remember de difference between being private and being anonymous. Signal IS private. It's not anonymous. The same is true for many other apps/services.

Personally I like to be private. I don't really need to be anonymous.

Signal is not perfect but we control its app, libre software. See SimpleX Chat.

Escaping WhatsApp and Discord, anti-libre software, is more important.

If you want to be mainstream a) you can't have spammers, scammers, and all the other scum of the earth and b) finding your contacts in the app HAVE TO be plug and play. Literally no normie will bother adding with usernames or whatever.

as I see it, Signal tried to fit that privacy gap for a standard centralised messenger, if you think about it, that might have made it easier to non-tech-savvy people to adopt it (even if it was as a request from a contact), decentralisation is not remotely appealing to them

Maybe I am being too simplistic here. But I have never received a spam message to my XMPP account and I don't know how a spammer would find it.

In a phone-based system a spammer can spam a list of numbers, or use contact lists that are easily shared via phone permissions. There are several low-effort discovery processes.

For e-mail, you get spam when you you input your personal e-mail into forms, websites, or post it publicly.

But for something like XMPP... It seems rather difficult to discover accounts effectively to spam them. And, if it is an actual problem, why not implement some kind of 'identity swap' that automatically transmits a new identity to approved contacts? A chat username does not need to be as static as an e-mail or a phone number for most people.

I just don't see 'spam' as such a difficult challenge in this context, and not enough in my view to balance out requesting a phone number. Perhaps a spammer can chip-in?

It's private but it's not anonymous. they know who is talking to who, but not what they are talking about.

Is there a quick explanation of what signal actually does? I don't understand the need for a phone number either. Jami doesn't ask for a phone number. It has other deficiencies that make me not want to use it, but those are technical rather than policy, more or less. Similarly, irc (I'm luddite enough to still be using it) doesn't ask for a phone number either. So this is all suspicious. There are a bunch of other things like this too (Element, Matrix, etc.) that I haven't looked into and tbh I don't understand why they exist.

SimpleX is coming nicely along. Should be good to switch next year once they got their desktop apps polished up