End-to-end encryption (E2EE) is a method of communication in which data is encrypted on the sender’s device and can be decrypted only on the recipient’s device, so that no server or provider in between can read it.
How end-to-end encryption works
With ordinary transport encryption such as TLS, traffic is protected on the way to the server, but the service provider decrypts and stores messages in readable form. In E2EE, the keys exist only on users’ devices. Each device has a key pair; the sender encrypts the message for the recipient’s public key, and the server only relays ciphertext.
The most widely used design is the Signal Protocol, which adds forward secrecy: keys change constantly, so stealing one key does not reveal past messages. It powers Signal and WhatsApp (end-to-end encrypted for all users since 2016) and was adopted for Facebook Messenger chats by default in 2023. Apple uses its own protocols for iMessage and FaceTime. Users can verify they are talking to the right device by comparing safety numbers or QR codes, which protects against man-in-the-middle attacks.
What E2EE does not protect
- The endpoints – spyware such as Pegasus reads messages on the phone after decryption.
- Metadata – who talks to whom, when and how often may still be visible to the provider.
- Backups – cloud backups may not be end-to-end encrypted unless the user enables options such as Apple’s Advanced Data Protection.
Why it matters
E2EE protects private conversations, journalists’ sources and business secrets from server breaches, insider access and mass surveillance. It is also at the centre of political debate, as several governments push for “lawful access” or client-side scanning that critics say would weaken security for everyone. Note that a VPN is not end-to-end encryption: it protects traffic only up to the VPN server.
Best practices
Use messengers with E2EE enabled by default, verify contacts’ security codes for sensitive conversations, enable encrypted backups and keep devices updated.
