# End-to-end encryption

> Only the sender and the recipient can read a message; the service in between cannot.

- Level: Intermediate
- Topics: Security
- URL: https://tidbit.legios.com.ar/end-to-end-encryption/
- In Spanish: [Cifrado de extremo a extremo](https://tidbit.legios.com.ar/es/end-to-end-encryption/)

**End-to-end encryption** (E2EE) means a message is encrypted on your phone and decrypted only on the recipient's phone. The company that carries it (WhatsApp, Signal, Apple for iMessage) stores and forwards scrambled bytes it cannot read, because the keys exist only on the two devices. That is the difference with ordinary HTTPS, which protects the trip to the server but lets the server read everything once it arrives.

It works with public-key cryptography: each device publishes a public key, and your phone uses the recipient's public key to lock the message so that only their private key opens it. The Signal protocol, used by Signal, WhatsApp and others, adds a trick: keys rotate with every message, so even a key stolen later cannot unlock old conversations.

The limits matter. E2EE hides content, not metadata: the service still knows who talks to whom, when and how often. It does nothing if the phone itself is compromised, if someone screenshots the chat, or if your cloud backup of the chat is not encrypted the same way (check that setting; it is often the weak spot). And when a government asks for a 'backdoor' for investigators, the technical answer is that a door for one party is a door for anyone who finds it.

Practically: your chat app probably already has it on; the setting worth checking is encrypted backups. For email, E2EE is rare and awkward, so treat email as a postcard.

## An analogy

HTTPS is an armored truck between post offices: safe on the road, opened at each office. End-to-end encryption is a letter in a box only the recipient's key opens; the post office just carries the box.

## Keep in mind

- Encrypted on one device, decrypted on the other; the service never has the key.
- HTTPS protects the road to the server; E2EE also protects against the server.
- It hides content, not who talks to whom or when.
- Unencrypted cloud backups are the usual gap; check that setting.

## Go deeper

- [What is end-to-end encryption? (Cloudflare Learning Center)](https://www.cloudflare.com/learning/privacy/what-is-end-to-end-encryption/)
- [End-to-end encryption on Wikipedia](https://en.wikipedia.org/wiki/End-to-end_encryption)

## Related terms

- [Encryption](https://tidbit.legios.com.ar/encryption/): Scrambling data so that only someone with the key can read it.
- [Apple](https://tidbit.legios.com.ar/apple/): The company that sells the iPhone and the Mac, plus the services that run on them.
- [HTTPS](https://tidbit.legios.com.ar/https/): The padlock in your browser: web traffic nobody in between can read.
- [Server](https://tidbit.legios.com.ar/server/): A computer whose job is to answer requests from other computers, all day, every day.
- [Public-key cryptography](https://tidbit.legios.com.ar/public-key-cryptography/): Two linked keys: one you share with everyone to lock, one you keep to unlock.
- [Metadata](https://tidbit.legios.com.ar/metadata/): Data that describes other data: who made it, when, where and what it contains.
- [Cloud computing](https://tidbit.legios.com.ar/cloud-computing/): Renting computers over the internet instead of buying your own.
- [Backup](https://tidbit.legios.com.ar/backup/): A separate copy of your data, kept so you can get it back when the original is lost.