End-to-end encryption is the technology behind most claims that a messaging app is private. The mechanism is simple enough to state in one sentence: the message is scrambled on the sender’s device, travels scrambled, and is unscrambled only on the recipient’s device.
The mechanism
Encryption uses cryptography to turn readable text into something unreadable. The scrambled form is called ciphertext, and without the right decryption key it cannot normally be turned back. So if an unauthorised party intercepts the message in transit, what they hold is unreadable.
What makes it end-to-end is where the keys live. The keys sit on the two devices at the ends of the conversation and nowhere in between — which means the company operating the service cannot read the contents either. On WhatsApp, a personal conversation is encrypted on the sender’s phone and stays that way until it reaches the recipient’s, so WhatsApp itself cannot see the text.
The distinction almost everyone misses
Not all encryption works this way, and the difference is the single most useful thing to understand here.
Transport Layer Security, or TLS, is what the padlock in a browser address bar means. It protects data travelling between you and a server, which stops anyone on the café Wi-Fi or at the ISP from reading it. But once the data arrives at the server, the company running that server can read it perfectly well — because the encryption was between you and them, not between you and the person you are writing to.
That is the whole difference. TLS protects a message from strangers. End-to-end encryption protects it from the provider as well. An email, a Facebook post, a Google Doc and an ordinary SMS are all usually sent over TLS and all readable by the company holding them.
What end-to-end encryption does not protect you from
Three things, and each one accounts for more real-world harm than interception does.
The person you sent it to. They have the decryption key, because they are the recipient. Nothing in the mathematics stops them screenshotting it.
Your own phone. The message is readable on the device by definition. Anyone holding an unlocked handset, or any malware running on it, sees the decrypted conversation.
Metadata. Who messaged whom, when, how often and from where is not contents, and it is not hidden by this. For many purposes that record answers the question anyway.
Which gives the practical rule: use end-to-end encryption and do not treat it as a reason to send something you would not want repeated. It removes one eavesdropper — the one in the middle — and leaves the two at the ends exactly as they were.
How to check it is actually on
The claim is easy to make and easy to verify, and the check differs by app.
WhatsApp encrypts personal chats by default; open a chat, tap the contact name and choose Encryption to see a QR code and a 60-digit number. If it matches what the other person sees, nothing sits between you.
Signal is end-to-end by default for everything, including calls and group chats, and holds the least metadata of the mainstream options.
Messenger and Instagram now default to it for personal chats, but not for community or channel messages.
Telegram does not, and this is the most widely misunderstood case here. Ordinary Telegram chats are encrypted to the server, not end to end; only a manually started “secret chat” is, and group chats never are.
