The Signal Protocol, where your app actually runs.
Expo, React Native, browsers, and Node from one package. Post-quantum PQXDH, the Double Ratchet, multi-device, groups, sealed sender, and encrypted attachments. The protocol code is pure TypeScript with no native crypto module to link.
What the package covers
One coherent API surface, imported by subpath so your bundle only carries what you use.
Identity and trust
One versioned X25519 and Ed25519 tuple is the trust object. Safety numbers, rotation, and fail-closed trust mutation after pinning.
Sessions and messaging
PQXDH and the Double Ratchet, with post-quantum ratcheting, replay boundaries, skipped-key limits, and bounded state recovery.
Devices and groups
Attachments and files
Application integration
Anonymous group credentials
ZK credential primitives, for products whose group membership should not be legible to the relay.
Four adapter boundaries you own
You pass adapters into createSignalProtocolClient. The protocol logic above them does not change.
The Expo, Node, browser, and bare React Native stores implement SignalProtocolLocalStore in full, so groups and multi-device work on any of them. They differ in where the bytes land. Expo uses expo-sqlite with SQLCipher, and Node an encrypted filesystem under node:crypto with 0600 permissions. The browser uses IndexedDB scoped to the page’s origin, and bare React Native a key-value backend you supply. SignalProtocolLocalStore and SignalProtocolRelayServer are documented interfaces, so you can write your own.
The Expo store needs a development build, because SQLCipher is not available in Expo Go. There is no native module of ours to link.
Adapter reference (opens in a new tab)Client composition guide (opens in a new tab)
How it compares
libsignal is the most scrutinized Signal Protocol code there is, and it is actively maintained. It is also a Node native addon with no browser, Expo, or React Native build.
This repository is used by the Signal client apps (Android, iOS, and Desktop) as well as server-side. Use outside of Signal is unsupported. All APIs and implementations are subject to change without notice, as are the JNI, C, and Node add-on "bridge" layers.
Read from the GitHub API, the npm registry API, and the published package tarballs on 2026-08-03. Dates are the ones those APIs returned. The axes are the ones this SDK was built to change, not a quality ranking. Nobody independent measured our own column.
@open-e2ee/signal-protocol-sdk | @signalapp/libsignal-client (opens in a new tab) | libsignal-protocol-javascript (opens in a new tab) | @privacyresearch/libsignal-protocol-typescript (opens in a new tab) | ts-mls (opens in a new tab) | |
|---|---|---|---|---|---|
| Expo / React Native | Yes | No — Node native addon; the 0.99.3 tarball ships binaries for macOS, Linux, and Windows only | No | No documented React Native path | Not stated — browsers, Node, and serverless are the documented targets |
| Browser | Yes | No | Yes | Yes | Yes |
| Maintained | Yes — 6.0.x, active | Yes — very active; repo push 2026-07-31 | No — archived, last push 2021-08-04 | No — last npm publish 2023-05-06, last repo push 2023-07-18 | Yes — very active; repo push 2026-08-03 |
| Post-quantum key agreement | Yes — PQXDH with ML-KEM, default, fails closed | Yes | No | No | Yes — ML-KEM ciphersuites |
| Post-quantum signatures | No — identities are classical Ed25519 | No | No | No | Yes — ML-DSA-87 ciphersuites |
| TypeScript-native | Yes | No — Rust core with TypeScript bindings | No — JavaScript | Yes | Yes |
| Protocol | Signal Protocol | Signal Protocol | Signal Protocol | Signal Protocol | MLS (RFC 9420) — a different protocol |
| Commercial license offered | Not needed — MIT or Apache-2.0 | No — AGPL-3.0 only | No — GPL-3.0 | No — GPL-3.0 | Not needed — MIT |
ts-mls is MIT and this SDK is MIT or Apache-2.0, so neither row costs its users anything. The three copyleft rows are a real cost to some readers.
Every project links to its repository, and every date came from a public API. The commands are in the comment at the top of src/lib/comparison.mjs.
Licensing
The complete SDK is available under the MIT or Apache-2.0 license, at your option. Proprietary products need no commercial license.
Check the work
Reviewed continuously by adversarial AI agents; not audited by any independent firm. Every change passes an adversarial AI review before it merges, and recurring whole-codebase AI audit passes run against the engineering repository. The assurance summary states what that covers and what it does not.