End-to-end encryption (E2EE) means a message is encrypted on the sender's device and can only be decrypted on the recipient's device, so the service that carries it, its employees, and anyone who breaches its servers see only scrambled data. That's different from encryption in transit, used by most email and many apps, where data is protected on the way to the server but the provider can read it once it arrives. Signal, WhatsApp (which adopted the Signal Protocol in 2016) and Apple's iMessage use E2EE by default. It has real limits: it does not protect a message once it's on an unlocked or compromised phone, it usually does not hide metadata such as who you contacted and when, and cloud backups are only covered if a setting such as WhatsApp's end-to-end encrypted backup or Apple's Advanced Data Protection is turned on. Comparing safety numbers or security codes confirms you're talking to the right device.
Reading time
— 4 min
Updated
— Sep 27, 2026
Fact-reviewed
— Sep 27, 2026
Key Takeaways
Key Takeaways
1End-to-end encryption means only the phones or computers at each end of a conversation can read it, not the company carrying it.
2That's stronger than ordinary encryption in transit, where the service can read your data once it reaches its servers.
3It doesn't protect an unlocked or infected phone, it usually doesn't hide who you talked to, and backups need their own setting.
The concept
Picture sending a letter in a locked box. With ordinary encryption, the post office has a key: the box is locked on the truck, but the post office opens it at the depot, reads it if it wants, and relocks it for delivery. With end-to-end encryption, only you and your friend have keys. The post office carries a box it can't open. That's what apps like Signal, WhatsApp and iMessage do for your messages. But the letter is still readable on your desk and your friend's desk, the post office still knows who sent a box to whom, and if you keep photocopies in an unlocked cabinet (an unencrypted cloud backup), the lock on the box doesn't help.
E2EE and a VPN solve different problems: a VPN hides your traffic from the local network and your internet provider, while E2EE hides message content from the messaging company itself.
Quick check
What's the key difference between end-to-end encryption and encryption in transit?
Worked examples
Example 1: A server breach (baseline case)
Suppose attackers break into a messaging company's servers. If the service only uses encryption in transit, they may walk away with readable message archives. If it uses E2EE, they get ciphertext: scrambled data that's useless without keys that never left users' phones. They may still get account details and metadata, such as phone numbers and contact timestamps, which is why E2EE limits the damage of a breach rather than making it harmless.
Example 2: The backup gap (edge case)
Maya uses WhatsApp, which encrypts her chats end to end. Her phone backs up chat history to her cloud account every night, and she never turned on end-to-end encrypted backups. Her messages are protected on the way to her friends, but a readable copy also lives in the cloud, protected only by that cloud provider's ordinary security. Anyone who gets into that account, or obtains it through legal process, can restore it. One toggle, WhatsApp's end-to-end encrypted backup setting with a password or key she stores safely, closes the gap.
Example 3: Setting up a sensitive conversation (real-world use)
You need to send a relative your bank account details. Use an E2EE app rather than email or SMS, which are not end-to-end encrypted in most setups. Compare safety numbers or security codes once, in person or on a video call, so you know you're talking to their real device. Turn on disappearing messages so the details don't sit in both chat histories for years. And lock both phones with a strong passcode, because on the phone itself the message is readable.
Quick check
Maya's chats are E2EE but her cloud backup isn't. Who could read her history?
How it works (visual)
Encrypted in transit vs end-to-end encrypted
Common mistakes
Common Mistakes
✕
Assuming 'encrypted' in an app's marketing means end-to-end.
→ Look for the words 'end-to-end' in the app's own help pages, and check whether it's on by default.
✕
Leaving chat backups unencrypted.
→ Turn on end-to-end encrypted backups (WhatsApp) or Advanced Data Protection (iCloud), and store the recovery key safely.
✕
Relying on E2EE while leaving the phone unlocked or unprotected.
→ Use a strong passcode, keep the OS updated, and avoid installing apps from unknown sources.
Common misconception
“If an app is end-to-end encrypted, nobody can ever see my messages.”
E2EE protects messages while they travel and on the company's servers. Anyone holding your unlocked phone, or your contact's, can read them. Spyware on either device can read them. The recipient can screenshot or forward them. And the service may still know who you talked to and when. It's a strong lock on one part of the journey, not a guarantee of total secrecy.
What to do next
What to do next
Move sensitive conversations (money, health, passwords) to an app that's end-to-end encrypted by default.
Check your chat backup settings today and turn on encrypted backups.
Verify safety numbers or security codes with the few contacts you share sensitive information with.
Set a strong phone passcode and turn on disappearing messages for sensitive threads.
FAQ
FAQ
Related terms
Related terms
End-to-end encryption (E2EE)
Encryption where only the communicating devices hold the keys, so the service in the middle can't read the content.
Encryption in transit
Protection for data while it travels, such as TLS, which ends at the provider's server where the data can be read.
Metadata
Data about a message rather than its content: who sent it, to whom, when, how often and from where.
Safety number
A code (Signal's term; WhatsApp calls it a security code) that two people can compare to confirm no one has swapped in a different key.
Endpoint
A device at either end of the conversation, such as your phone or laptop, where messages exist in readable form.
This entry was researched from public sources and drafted with AI-assisted tools, then edited — errors are still possible. Spot one, or want a topic covered? Read our disclaimer.
KnowThis