Signal Desktop Download for Windows: Verify It

Short answer: To download Signal Desktop for Windows safely, use signal.org/download. It is Signal’s only official website, and the page also links to Signal’s Microsoft Store listing. Signal Desktop is safe when it comes from those two places, but it is not a standalone app. Signal says it must be linked to Signal on Android or iPhone before you can use it, and it needs Windows 10 or 11. Before you run the installer, compare its SHA-512 hash with the value in Signal’s own update feed and check that it is signed by “Signal Messenger, LLC”.

Official-source review — 18 October 2026 UTC: We checked signal.org/download, Signal’s “Installing Signal” and “Linked Devices” support articles, the Signal Desktop GitHub repository, Signal’s Windows update feed, Microsoft’s PowerShell documentation, and reports from Google Threat Intelligence Group, Hunt.io, eSentire (via KnowBe4) and Malwarebytes. We did not install or run Signal Desktop, link it to a phone, or test any of the fake sites described below. On 17 October 2026 (UTC) we downloaded signal-desktop-win-x64-8.31.0.exe from updates.signal.org but did not run it. Its SHA-512 matched the value Signal publishes, and Windows showed a valid Authenticode signature from “Signal Messenger, LLC”.

Where to download Signal Desktop for Windows

Use one of the two sources linked from Signal’s own site:

signal.org/download. This is the page with the “Download for Windows” button. The Signal Desktop GitHub README also sends people to signal.org/download for production builds.
Microsoft Store. The download page links to the Store listing XP89119P9F2PCQ. If you take this route, check that the link came from signal.org and was not found by searching inside the Store.

Signal’s installation article lists the system requirements as “Windows 10 or 11”. The Windows update feed gives the minimum OS version as 10.0.10240, the first release of Windows 10. Our Signal catalogue page lists the current version and the official links in one place.

Signal Desktop needs your phone first

Signal Desktop runs as a linked device. Signal’s support article says it “must be linked to Signal on Android or iPhone before it can be used,” and the download page says Signal must first be installed on your phone. According to Signal’s Linked Devices article, you link the desktop app like this:

Open Signal Desktop. It shows a QR code.
On your phone, go to Signal Settings > Linked devices > Link a new device.
Scan the QR code, then choose whether to transfer your message history.

The same article says you can link up to 5 devices. Your phone has to come online at least once every 30 days or your linked devices are unlinked, and a linked device is also unlinked after 45 days of inactivity. If a page offers a Signal for Windows that works without a phone, treat that as a warning sign.

What is in Signal’s Windows update feed

Signal Desktop’s updater reads updates.signal.org/desktop/latest.yml, and you can open it in a browser. When we read it, it listed version 8.31.0 with a release date of 15 October 2026 and three Windows installers, each with its own size and SHA-512 hash:

Windows builds listed in latest.yml (version 8.31.0, read 17–18 October 2026)
File	Architecture	Size (bytes)
`signal-desktop-win-x64-8.31.0.exe`	x64 (most Intel and AMD PCs)	142,711,976
`signal-desktop-win-arm64-8.31.0.exe`	Arm64 (Windows on Arm, for example Snapdragon laptops)	141,419,464
`signal-desktop-win-8.31.0.exe`	Universal (no architecture in the file name)	283,364,976

The feed also has a top-level path and sha512 at the bottom. In this release they refer to the arm64 file. Always compare your file with the hash listed directly under its own file name, not the one at the bottom. The version number will change with each release, so read the feed on the day you download.

How to verify the Signal Desktop installer in PowerShell

This is the same check we ran on 17 October. Do it before you double-click the installer.

1. Compute the SHA-512 in Signal’s format

Signal publishes its hashes in Base64 (for example, a string ending in ==), not as the hex string that Get-FileHash prints. So if you compare Get-FileHash output with latest.yml, they will never match. Instead, compute the hash and encode it in Base64:

$file = "$env:USERPROFILE\Downloads\signal-desktop-win-x64-8.31.0.exe"
[Convert]::ToBase64String([Security.Cryptography.SHA512]::Create().ComputeHash([IO.File]::ReadAllBytes($file)))

Compare the output with the sha512: line under your file name in latest.yml. Every character must match. Also check that the file size in File Explorer (Properties > Size, in bytes) matches the size: value. If either differs, delete the file and download it again from signal.org.

2. Check the digital signature

Right-click the installer, choose Properties > Digital Signatures, and confirm that the signer is Signal Messenger, LLC. Then select it and click Details to confirm that Windows reports the signature as OK. In PowerShell, Get-AuthenticodeSignature shows the same information:

Get-AuthenticodeSignature $file | Format-List Status, StatusMessage, @{n='Signer';e={$_.SignerCertificate.Subject}}

You want Status : Valid and a signer subject that names Signal Messenger, LLC. A blank signer or any status other than Valid means stop. Our guide to checking a Windows installer’s digital signature explains what each status means.

3. Optional: identify the file by SHA-256

Our SHA-256 checker identifies installers by their SHA-256 hash. That is a different algorithm from the SHA-512 Signal publishes, so use it as an extra check, not as a replacement for the comparison above. To see how we collect and confirm hashes, read how we verify downloads.

Fake Signal sites and apps that researchers have reported

Signal’s popularity makes it a common lure. These cases come from reports we read:

Google ads leading to a cloned download page (2021). eSentire’s Threat Response Unit found malicious Google ads pointing to copies of Signal’s download page that delivered the Redline Stealer infostealer, KnowBe4 reported. The red flags: most links on the fake page did not work, the sites used unusual domain endings, and the page served an outdated Signal version.
Backdoored Windows executables (2025). Hunt.io described fake Signal, Line and Gmail download pages aimed at Chinese-speaking users. The fake Signal page delivered a ZIP file containing a Windows executable. After it ran, the malware used PowerShell to exclude the whole C: drive from Windows Defender scans. Hunt.io believes victims reached the sites through manipulated search results.
Fake QR codes that link your account (2025). Google Threat Intelligence Group reported Russia-aligned groups using modified Signal group invites and fake pages with malicious QR codes. Scanning one links the victim’s account to a device the attacker controls. The same report describes post-compromise tools that copy Signal Desktop’s message files on Windows.
Fake “Signal Support” messages (2026). Malwarebytes reported messages that pose as Signal Support and ask users to paste their backup recovery key. The same article notes that Signal does not contact users first and never asks for registration codes, PINs or recovery keys.

What these cases share: the danger is a fake download page or a tricked user, not a flaw in the real Signal app. For more warning signs, see our guide to fake download sites, or paste a link into the download site checker before you trust it.

What this check does not tell you

A matching hash and a valid signature show that the file is the one Signal published. They do not tell you anything about the security of your PC, your phone or your account.
No download check protects you from scanning a malicious QR code. The only QR code you should scan is the one shown by Signal Desktop that you installed yourself. Check Settings > Linked devices on your phone regularly, as Google’s researchers recommend.
We do not host Signal and do not offer a mirror. Every download link we give points to Signal.

Questions

Is Signal Desktop safe to download?

Yes, if it comes from signal.org/download or the Microsoft Store listing linked from that page. Signal Desktop’s code is public on GitHub under the AGPLv3 licence. The risk comes from copies on other sites.

Can I use Signal Desktop without a phone?

Not at the moment. Signal’s support site says Signal Desktop must be linked to Signal on Android or iPhone first.

Why doesn’t my Get-FileHash output match latest.yml?

Because Signal publishes SHA-512 in Base64, while Get-FileHash prints hex. Use the [Convert]::ToBase64String(...) command above. Also make sure you are comparing with the hash for the right build (x64, arm64 or universal).

Which Windows build should I choose?

Most desktops and laptops with Intel or AMD processors use x64. Windows on Arm devices use arm64. The universal file is about the size of the other two put together. Whichever file you get, compare it with the hash listed under its own name.

Signal Desktop Download for Windows: How to Verify the Installer