Mobile Networking · Encryption in Transit · Lesson 4 of 4

End-to-End Encryption

Find out how some apps lock messages so even their own servers can't read them.

Locking Out the Server

HTTPS protects your data between your phone and a server. Once the data arrives, the server decrypts it. When you sent See you at 7 in Course 1, the café couldn't read it, though the chat company's server could, unless the app adds another layer.

End-to-end encryption (E2EE) is that extra layer. Your phone encrypts the message with keys that only the recipient's devices hold. The server still carries the message, and it can't read it. If the company is hacked or asked for message contents, it only has scrambled data to hand over.

This relies on key pairs. Each device makes one. The public key is shared through the server so others can encrypt messages to you. The private key never leaves your phone.

Many apps use E2EE by default. Signal and WhatsApp encrypt personal chats end to end, and so does Apple's iMessage. Meta made it the default for personal chats on Messenger in 2023. Ordinary SMS texts have no end-to-end encryption, and RCS chats only have it in some apps and setups.

What E2EE Doesn't Hide

E2EE hides what you say. It doesn't hide everything around it. The service usually still knows who you talk to, when, how often, and from which IP address. That information is called metadata, and investigators and advertisers can learn a lot from it. Signal is designed to keep as little as possible. Many other services keep more.

Backups are another gap. A message can be end-to-end encrypted on the way and then saved in a cloud backup the provider can open. On iPhone, standard iCloud Backup isn't end-to-end encrypted unless you turn on Advanced Data Protection. WhatsApp backups are only end-to-end encrypted if you switch that option on.

Then there's the device itself. Anyone holding your unlocked phone can read the chats on it.

Apps also let you confirm that a contact's key really belongs to them. Signal calls this a safety number, WhatsApp calls it a security code, and iMessage offers Contact Key Verification on iOS 17.2 and later. Comparing it in person protects you if a server ever swaps in someone else's key.