Signaling Transparency Demo

Imagine two phones trying to start a private video call. Before they can talk, they must exchange a few "setup notes": what kind of call they want, what formats they can use, and how to reach each other. Those setup notes are called signaling.

When does signaling happen? Right at the start of a call (and sometimes during reconnects). It's like texting "Can you hear me? Here's how to connect" before the real conversation begins. The actual audio/video is sent separately after this setup.

Last updated:

What should you notice?

YES- Signaling contains "setup info"
  • Call setup text (SDP)
  • Connection options (ICE)
  • Security fingerprints (for the transport)
NO- Signaling does NOT contain your call
  • No audio or video content
  • No chat message text
  • No end-to-end encryption keys

This is the main point of the demo: a relay server can forward signaling, but it still cannot "read your call," because your call media is separate and (with E2EE) encrypted on the devices.

Change the demo settings

Connection path
What this means: Direct tries to connect caller-to-caller. Relay uses a helper server when direct connection fails (strict Wi-Fi/firewalls).
End-to-End Encryption (E2EE)
What this means: With E2EE ON, only the two callers can decrypt the media. The relay cannot.
Which signaling message are you viewing?
Offer: "Here's the call I want to start."
Answer: "Yes - here's what I accept."
ICE candidate: "Try connecting to me this way (address/route)."


Below, you'll see the same signaling object shown in three places (Caller A, relay, Caller B) plus a dedicated panel showing the exact payload being relayed. These examples are sanitized and safe-to-publish (not production logs).

Caller A sends

What Caller A sends to the relay

    

Server relay sees

What the relay can see and forward


      
YES - The relay can see signaling text (setup info)
NO - The relay cannot see call media (audio/video) or E2EE keys

Caller B receives

What Caller B receives from the relay

    

What gets relayed

The exact signaling payload object (setup info only)
This is what a relay forwards. It helps the call connect. It is not the call itself.

Plain-English glossary

SDP is the "menu" for the call: it lists what each side supports (audio/video formats) and how the secure connection is set up. It's like agreeing on "we'll speak English and use FaceTime-quality video" - not the conversation itself.

ICE is the "map" for how to connect: it tries different network routes so the callers can reach each other, even behind routers and firewalls. TURN is the backup route: a relay that passes encrypted packets when a direct route fails.

Related: Security Hub - Threat model - Logging policy