TL;DR
Signal and Shoal are not the same kind of product. Signal is the cryptographic high-water mark for private communication: pure end-to-end encryption, minimal metadata, no business model that conflicts with privacy. Shoal is built to give parents structural oversight of children’s chats while keeping everyone else’s private. Those goals require different architectures, and we want to be straight about which one Shoal isn’t.
What Signal does well
Signal is exceptional at what it sets out to do. The Signal Protocol is the gold standard for end-to-end encrypted messaging; its design underpins the encryption in WhatsApp and, for chats between Android phones, Google Messages. Sealed sender minimises the metadata Signal itself can see. The app is open source, its encryption has been formally verified and widely studied by independent researchers, and it’s run by a non-profit foundation funded mainly by donations. There is no advertising, no analytics SDK, no quiet metadata harvesting.
If your need is “I want to talk to specific people and have very high confidence that no one — not even the operator of the messaging app — could be compelled to read what we say,” Signal is the right answer.
Where Shoal is different (and we should be honest about this)
We’ve been clear elsewhere on this site that Shoal is not Signal-grade in the strict cryptographic sense. The privacy page goes into the architectural detail; the short version is:
- Shoal holds the keys. Each family’s key is stored on our servers, encrypted under a root secret. No code path decrypts content today, so Shoal staff can’t see your messages — but because Shoal holds the keys, one could be built, and Shoal could be legally required to build it. Signal holds no keys that would let it read your messages.
- Shoal is not end-to-end encrypted. Content is encrypted on the sending device and stored as ciphertext, but that protects against breaches and eavesdroppers, not against us. With Signal, the operator is ruled out by design.
- Family admins can read children’s chats. That’s how Shoal’s safety features work, and it’s the reason for the first two points. Signal has no equivalent: it has no parental controls, and its design gives no one but the people in a chat access to it.
These aren’t bugs. They’re the deliberate trade-offs Shoal makes to be useful for families with kids who need to be on the same chat as their parents under structural oversight. Signal would say — and we’d agree — that they are exactly the trade-offs Signal refuses to make.
Side by side
| Shoal | Signal | |
|---|---|---|
| End-to-end encrypted | No — encrypted on the device, but Shoal holds the keys (see /security) | Yes (Signal Protocol) |
| Operator can decrypt messages | Yes, though it doesn’t in normal operation | No (architecturally ruled out) |
| Sealed-sender / metadata-minimising | No | Yes |
| Parental oversight built in | Yes (family admins read children’s chats) | No |
| Kids without phone numbers | Yes (family device) | No — 13 and over only, and a phone number is needed to register (a beta version for Android is testing sign-up without one) |
| Family / multi-family structure | Yes | No |
| Operator | Independent UK company (for-profit) | Signal Foundation (US non-profit) |
| Open source | Not currently | Yes |
When to pick which
Pick Signal if your priority is the strongest possible cryptographic separation between yourself and the messaging app’s operator, you want no parental oversight in the picture, and the people you’re talking to (adults, or teenagers of 13 and over) are willing to install Signal too.
Pick Shoal if you want an encrypted messenger built specifically around families with children — including kids who can’t have a phone number, conversations that family admins should be able to oversee, and a single chat that works across every device in the family.
You can use both for different purposes. We do.
Signal is a registered trademark of the Signal Foundation. We have no affiliation with Signal and we admire what they’ve built.