How the phrase works
The basics
Every circle has a live phrase: three words that change every 60 seconds. Everyone in the circle sees the same words at the same moment. On a suspicious call you ask, “What’s our phrase?”, glance at your screen, and compare.
Where the words come from
When a circle is created, a random secret is generated on the admin’s phone. Invites deliver that secret to each member’s phone in a sealed form our servers cannot read. From then on, every phone in the circle computes the current three words itself, from the shared secret and the current time, using the same kind of cryptography banks use for one-time login codes.
Because each phone computes the words locally:
- The phrase is never transmitted. It doesn’t travel over the network, so there’s nothing to intercept. Our servers never see it and couldn’t reconstruct it.
- It works offline. No signal, aeroplane mode, dead wifi: the words still appear and still match everyone else’s.
- An overheard phrase is nearly worthless. Sixty seconds later it’s gone. Yesterday’s phrase tells a scammer nothing about today’s.
Why the clock matters
The words are derived from the time, so both phones need roughly the correct time. Phones set to automatic date and time (the default) are always fine. If a phone’s clock has drifted badly, SafePhrase hides the phrase and tells you, rather than showing words that would wrongly fail a real family member. The fix is Settings, General, Date & Time, set automatically.
The daily verification phrase
During voice-call onboarding you’ll see a different, stable phrase that lasts for the day. It exists so a new member has something to read back before they’re trusted with the live phrase. Once verified, everything uses the live rotating words.
