End-to-end encryption, explained like you're busy

You've seen the little "messages are end-to-end encrypted" banner a thousand times. Here's what it actually promises, and what it doesn't.

#The one-sentence version

End-to-end encryption (E2EE) means a message is encrypted on the sender's device and can only be decrypted on the recipient's device. The servers in between carry ciphertext they can't read.

#Step 1: everyone gets a key pair

When you install an E2EE messenger, your device generates a key pair:

• a private key that never leaves your phone, and
• a public key that gets uploaded so others can find it.

Anyone can use your public key to set up an encrypted conversation with you. Only your private key can complete it.

#Step 2: agree on a secret, even while offline

Phones aren't always online at the same moment. Protocols like the Signal Protocol solve this with pre-keys: bundles of one-time public keys your device uploads in advance. A sender grabs one, does a key agreement, and both sides end up with the same shared secret without ever sending it over the wire.

#Step 3: keep changing the keys (the ratchet)

Using one key forever would be risky: steal it once, read everything. So modern messengers use a ratchet that derives a fresh key for every message:

• Forward secrecy: if a key leaks today, past messages stay safe.
• Post-compromise security: after a leak, the conversation heals itself as new keys are mixed in.

Think of it as changing the lock after every single letter you send.

#What E2EE does not hide

E2EE protects content. It doesn't automatically hide metadata: who talks to whom, when, how often and from where. Different apps make very different choices here, which is why we track things like sealed sender, phone-number-free accounts and server-side data retention.

It also can't protect you if your device is compromised or someone screenshots the chat. Encryption protects the pipe, not the endpoints.

#Group chats and the post-quantum future

Groups make everything harder (keys for hundreds of members!), which is why the IETF standardised Messaging Layer Security as RFC 9420. And because a large enough quantum computer could break today's key agreement, messengers are starting to mix post-quantum algorithms into their handshakes, so that traffic recorded today can't be decrypted later.

We'll keep explaining each of these as the news happens. 🔐