How it works, and what to expect

Sigweeper · Last updated 4 August 2026

Sigweeper asks for access to your Signal Keychain entry and then permanently deletes files. Those are two things you should be sceptical of. This page explains exactly what happens and why, so you can decide with the facts in front of you.

What it does, step by step

1. Reads a key from your Keychain. Signal encrypts its local database. The key that unlocks it is protected by the macOS Keychain entry Signal Safe Storage. macOS prompts you the first time; you can refuse, and Sigweeper simply won't be able to read anything.
2. Unwraps the database key. Using that Keychain secret, Sigweeper decrypts the wrapped key stored in Signal's config.json.
3. Opens Signal's database read-only. It lists your attachments — size, type, date, and which conversation they came from — sorted largest first. It does not modify the database.
4. Decrypts previews in memory. To show a thumbnail or a document peek, the file is decrypted in RAM. Large files are only partially decrypted, so previewing stays fast.
5. Deletes only what you select. Nothing is removed until you select files and confirm.

What it never does

• It never uploads your attachments, messages, or keys anywhere.
• It never modifies Signal's message history — only the attachment files on disk.
• It never touches your phone. Signal on your phone is unaffected.
• It never deletes anything without an explicit confirmation from you.

Why it asks you to quit Signal first

If Signal Desktop is running while files are removed, it can rewrite its database or re-create files mid-operation. Sigweeper therefore refuses to delete while Signal is running. This check fails closed: if it cannot confirm Signal has quit, it declines to proceed.

The one thing it sends over the network

Sigweeper checks sigweeper.com for a newer version at launch. No personal data is transmitted. The full detail, including what a server can infer from the request, is in the Privacy Statement.

What happens when Signal changes

This is the honest risk of a tool like this, so it deserves its own section.

Signal Desktop ships a new release roughly once a week. Sigweeper depends on five things staying the same: the Keychain entry name, the way the database key is wrapped, Signal's SQLCipher settings, its attachment table layout, and its attachment encryption format. Most Signal releases touch none of these. But any release could, and when that happens Sigweeper stops working — possibly overnight, with no warning.

How we handle it

• Sigweeper checks itself on every launch. It verifies each of those five dependencies in order. If one has changed, it tells you plainly which stage failed instead of showing a blank window or crashing.
• It distinguishes your problem from our problem. A denied Keychain prompt is something you can fix; a changed database format is something only a new version can fix. The app says which it is.
• Updates are delivered in-app. When a fix is published, Sigweeper offers it directly, so you are not left checking the website.

What we can and can't promise

Sigweeper is maintained by one person. What we commit to:

• We aim to publish a fix within a few days of a Signal change that breaks compatibility.
• We will never let the app fail silently: a broken state always explains itself.
• If the project is ever discontinued, we will say so on this page rather than let it quietly rot.

What we cannot promise: a guaranteed response time, or that a fix is always possible. Signal could change in a way that makes this approach unworkable. The Terms state that the software is provided without warranty, and that is a genuine statement of risk rather than boilerplate.

Questions

If something here is unclear or you think we have got something wrong, write to guanzy0123@gmail.com.