security in-a-box

tools and tactics for digital security

Search form

English

አማርኛ العربية Bahasa Burmese ភាសាខ្មែរ فارسی Français 简体中文 Português Русский English Español Македонски Tibetan ภาษาไทย Türkçe Tiếng Việt

Follow us on Twitter
  • Tactics
    • Digital security fundamentals

      • Protect yourself from malware & hackers
      • Protect your data from physical threats
      • Create & maintain secure passwords

      Secure data storage

      • Protect sensitive files on your computer
      • Recover from information loss
      • Destroy sensitive information

      Secure communication

      • Keep your online communication private
      • Remain anonymous & bypass censorship
      • Stay safe on social networking platforms

      Mobile device security

      • Use mobile phones more securely
      • Use smartphones more securely
  • Tools
    • Windows

      • avast! - anti-malware
      • Spybot - anti-spyware
      • Comodo - network firewall
      • KeePass - secure password manager
      • TrueCrypt - secure file storage
      • Cobian Backup
      • Recuva - file recovery
      • Eraser - secure file removal
      • CCleaner - secure session cleanup
      • Pidgin - secure instant messaging
      • Jitsi - secure IM & VoIP
      • Thunderbird & OpenPGP - secure email
      • gpg4usb - email and file encryption
      • Firefox & add-ons - secure browsing
      • TorBrowser - anonymity & circumvention

      Mac

      • KeePassX - secure password manager
      • VeraCrypt - secure file storage
      • Jitsi - secure IM & VoIP
      • Thunderbird & OpenPGP - secure email
      • Firefox & add-ons - secure browsing
      • Tor Browser - anonymity & circumvention

      Linux

      • KeePassX - secure password manager
      • VeraCrypt - secure file storage
      • Jitsi - secure IM & VoIP
      • Thunderbird & OpenPGP - secure email
      • Firefox & add-ons - Secure Browsing
      • Tor Browser - anonymity & circumvention

      Internet

      • Riseup - secure email service
      • Social networking platforms
  • Mobile tools
    • Android

      • Basic Android security setup
      • APG - file encryption
      • K9 with APG - secure email
      • KeePassDroid - secure password manager
      • ObscuraCam - privacy aware photos
      • OrBot - anonymity & circuvention
      • Orweb - anonymity & circumvention
      • Signal - Encrypting mobile IM & VoIP
  • Community
      • Tools and tactics for everyone
      • For the LGBTI community in the Middle East and North Africa
      • For the LGBTI community in Sub-Saharan Africa
      • For environmental rights defenders in Sub-Saharan Africa
      • For women human rights defenders
Updated: 
29 December, 2014
TextSecure for Android

TextSecure is an Android-platform mobile phone application to send encrypted text messages (SMS). It can also send encrypted messages using your phone's data connection (which might be WiFi or mobile data) . Either way, the messages you send and receive are stored in an encrypted container on your phone.

Required reading: 
Use mobile phones as securely as possible
Use smartphones as securely as possible
TextSecure
Project website
Download link
Version used in this guide: 
2.3.2
License: 
Free/Open Source Software
System requirements: 
  • Android 2.3 or higher
What you will get from this guide: 

Text messages to other TextSecure users can be encrypted when sent.

Text messages are stored in an encrypted database on your device, protected by a passphrase.

If your phone is lost or stolen, your messages will remain unreadable to those without the passphrase.

  • Anchor link
1. Introduction to TextSecure
  • Using this application will prevent anyone from being able to read the content of your text messages, but will not hide the fact that you are sending messages.

  • TextSecure will only hide who the messages are being sent to when your phone connects to Internet and messages are sent over data connection through WhisperSync server. Traditional SMS, encrypted or not, will still disclose the recipient(s) to your mobile phone company.

  • In some countries, an encryption programme such as TextSecure may attract attention, be illegal or subject to legal constraints.

  • Anchor link
1.0 Other tools like TextSecure
  • Android: surespot, ChatSecure
  • iOS: surespot, ChatSecure
  • Microsoft Windows: Jitsi, Pidgin
  • Mac OS: Jitsi, Adium
  • Linux: Jitsi, Pidgin
  • Anchor link
2. Install TextSecure
  • Anchor link
2.1 Installation process

Step 1. On your Android device, download and install the app from the Google Play store by tapping .

Figure 1: TextSecure on the Google Play Store

Step 2:. Before the installation process begins, you will be prompted to review the access that the application will have on your phone. Review this carefully. Once your are happy with the permissions that will be granted, press and the installation will complete. If you do not agree with the permissions that will be granted, press the back button and the installation will be cancelled.

Figure 2: Permissions required

Step 3. Tap Open to run the app for the first time

  • Anchor link
3. Configuration and first-time setup
  • Anchor link
3.1 TextSecure Registration

Step 1: Begin the registration process by choosing the country your SIM card was purchased and entering your phone number and press

Step 2: Verify that the number you entered is correct and press , otherwise press and correct your phone number.

Figure 3 & 4: Registration screen and confirming number

Step 3: TextSecure will proceed with the registration. During this process you will receive one SMS to complete registration.

Note: If for some reason you do not receive the SMS you will be given the option to receive an automated phone call where you will hear a 6-digit code, this code once entered will complete the registration.

Figure 5 & 6: Registration completing and Voice verification screens

  • Anchor link
3.2 Importing messages

As TextSecure can securely store your SMS messages, it is recommended that you import the messages from your current SMS app.

Step 1: After registration is complete, TextSecure will open and you will be presented with an option to import your messages from your current default SMS app. Press

Figure 7: Import messages into TextSecure

Once the import process is complete you will have access to all your old messages via TextSecure and you should delete them from your other application.

  • Anchor link
3.3 Making TextSecure the default application

After your old messages have been imported you should make TextSecure the default SMS application, to ensure that all new incoming messages appear in it and not the old application. This can be done by tapping when prompted.

Figure 8: Set TextSecure as the default SMS application

  • Anchor link
3.4 Encrypted Storage

Along with the ability to send encrypted messages, TextSecure also allows you to store all your messages in an encrypted container protected by a passphrase, so if someone gains access to your phone they will not be able to access your messages when TextSecure is locked. After a set period of time, if you have not looked at any messages, TextSecure will automatically lock and you will have to enter your passphrase the next time you want to read your messages.

Step 1: Tap on in the top right of your screen to bring up the menu and select .

Step 2: Scroll down to the PASSPHRASE section and uncheck Disable Password.

Step 3: When prompted enter a passphrase that will be used to protect the messages stored on your phone and tap .

Figure 9 & 10: passphrase options and setting a password

Step 4: To have TextSecure automatically lock after a period of inactivity check the box next to Timeout passphrase (See Fig 9 above).

Step 5: Tap Timeout interval and in the next screen enter the desired period of time you want TextSecure to lock if unused and tap .

Figure 11: TextSecure timeout settings

  • Anchor link
4.Sending and Receiving messages

Note: To send encrypted messages to your contacts, they must also have TextSecure installed, otherwise the message will be sent as an insecure SMS.

TextSecure can send messages as SMS using your mobile phone company to relay the message. With this option, even if your recipient is using TextSecure and the SMS is encrypted, your mobile phone company will know that you are sending a (encrypted) message to this particular recipient. If your phone is connected to the Internet, either using a data connection offered by your mobile phone company or using local wifi, TextSecure will instead send the message over an encrypted connection with a WhisperSync server. In this instance, your mobile phone company will not know who you are sending your messages to.

  • Anchor link
4.1 Messaging Individuals

Step 1: Open TextSecure and tap at the top of your screen to bring up your contact list.

Step 2: Tap on the contact you wish to message.

Note: The contact list will display at the top all your contacts who also use TextSecure (under the TextSecure Users heading) and then your full contact list (including TextSecure users) in the All Contacts section.

Figure 1: TextSecure contact list

Step 3: Compose your message in the box and tap to send.

Note If you send a message to another TextSecure user and you are connected to the Internet, the default option is to send it via Internet. If you want to send an encrypted SMS (using your mobile phone company) or an insecure SMS instead of an encrypted message long press to bring up the alternative sending options.

Figure 2 & 3: Sent message / Alternative sending options

Things You Should Know

Your sent messages are given different background colours / indicators to help you identify how they were sent:

Blue with a icon: The message was sent encrypted via Internet.

Figure 4: Encrypted message send via mobile data

Green with a icon: The message was sent as an encrypted SMS.

Figure 5: Encrypted SMS

Green: The message was sent as an insecure SMS.

Figure 6: Insecure SMS

A icon in your message indicates that it has been delivered. Note: the only appears by default when messages are sent via Internet; to see them when sending SMS you need to enable SMS delivery report in settings.

The messages you receive from your contact will always be grey. If they have a icon, they were received encrypted. If there is no icon the message was received insecurely.

  • Anchor link
4.2 Messaging Groups

TextSecure also allows you to message multiple people at once.

Note: If at least one of the people you are messaging does not use TextSecure, the messages will be sent as an MMS and not encrypted.

Step 1: Tap on in the top right of your screen to bring up the menu and select .

Step 2: Enter a name for your chat group and tap to add your contacts.

Step 3: Tap the box to the right of each contacts name to add them to the group and press .

Figure 7 & 8: Contact selection & Group Creation

Step 4: Tap to complete the creation of the group and be brought back to the TextSecure main screen.

Step 5: Tap on the group you have created and begin messaging the group.

Figure 9: Group conversation

  • Anchor link
4.3 Sending Files

TextSecure allows you to send images, video and audio files to your contact.

Step 1: Start a conversation with the person you want to send the file to.

Step 2: Tap on in the top right of your screen to bring up the menu and select .

Step 3: Choose from the list the type of file that you want to send - Picture / Video / Audio

Step 4: Select the file you want to send.

Step 5: Verify that the file you want to send is in the compose window and press to send.

Figure 10 & 11: File type selection / Image sent to contact

  • Anchor link
5. Verify the identity of your contact

To confirm that the messages you are sending and receiving are with the right person, you should both verify your TextSecure identities with each other.

  • Anchor link
5.1 Reading Fingerprints

The Following steps will need to be performed by both parties.

Step 1: Open an existing conversation with your contact and tap at the top of the screen.

Step 2: Tap from the pull-down menu.

Step 3: You will be presented with a 66-character fingerprint of your TextSecure identity and that of your contacts. These should be read to each other, and verify that you both have the same fingerprints for each other, either in person or via a medium that allows you to confirm visually or audibly to whom you are talking.

Figure 12: TextSecure fingerprints

  • Anchor link
5.2 Scanning Fingerprints

Note: To verify fingerprints by scanning you need to have Barcode Scanner installed on your phone. If it is not available on your phone at the time of scanning TextSecure will download and install the app for you.

The Following steps will need to be performed by both parties.

Step 1: Open an existing conversation with your contact and tap at the top of the screen.

Step 2: Tap from the pull-down menu.

Step 3: You will be presented with a 66-character fingerprint of your TextSecure identity and that of your contacts.

Step 4 On both your phones tap on .

Step 5: On your phone tap and your contact should tap . Your contact's phone will display a QR code and your phone will open Barcode Scanner.

Step 6: Use Barcode Scanner on your phone to scan your contact's QR code.

Figure 13 & 14: Your contact's QR code / Barcode scanner

Step 7: Once the QR code has been successfully scanned TextSecure will check that the identity is valid.

Figure 15: TextSecure identity verified

Step 8: Once you have verified your contact's TextSecure identity, they should repeat the above steps to verify yours.

  • Anchor link
6. Export your messages

Note: While TextSecure allows you to export your messages, the messages in the backup file will not be encrypted and you should take additional steps to protect its contents.

  • Anchor link
6.1 Exporting the messages

Step 1: Tap on in the top right of the main TextSecure screen to bring up the menu and select .

Step 2: The next screen will open on the import options, tap .

Step 3: On the export screen tap .

Step 4: Confirm that you want to export the unencrypted messages to the storage on your phone by tapping .

Step 5: TextSecure will confirm the export has completed by displaying . You will find a file called Textsecure.xml on your phone's storage that contains your unencrypted messages.

Figure 16 & 17: TextSecure Export and Export confirmation screens

security in-a-box

tools and tactics for digital security

  • About
  • Contact
  • Blog
  • Glossary
  • Disclaimer

This work is licensed under a Creative Commons Attribution-Share Alike 3.0 Unported License.

security-in-a-box is a project of Tactical Technology Collective and Front Line Defenders.

Follow us on Twitter