What is End-to-End Encryption? A Plain English Explanation
WhatsApp says it uses it. Signal is built on it. But what does end-to-end encryption actually mean, and does it actually protect you?
The simple version
End-to-end encryption (E2EE) means that a message is encrypted on your device and can only be decrypted on the recipient's device. Nobody in between — not the app company, not your internet provider, not a government with a court order served to the app company — can read the content of the message.
The "end-to-end" part means the encryption exists from one end (your device) to the other end (the recipient's device), with no point in between where the message exists in readable form.
How it works without getting technical
Think of it like a locked box. You put a message in the box and lock it with a key that only the recipient has. You send the locked box through the mail. The postal service (the app company) handles the delivery but can't open the box — they don't have the key. Only the recipient can open it.
In cryptographic terms, this works through public-key cryptography. Each user has a public key (shareable with anyone) and a private key (never leaves their device). Messages encrypted with someone's public key can only be decrypted with their private key.
Which apps actually use it
Signal — the gold standard. Open source, independently audited, E2EE by default for all messages and calls.
WhatsApp — uses the Signal protocol for E2EE, but Meta collects significant metadata (who you message, when, how often) even if they can't read message content.
iMessage — E2EE between Apple devices. Falls back to unencrypted SMS when messaging non-Apple users.
Regular SMS/text messages — not encrypted. Your carrier can read them, and so can anyone who intercepts them.
Standard email (Gmail, Outlook) — not E2EE. The provider can read your emails. ProtonMail offers E2EE email.
What E2EE doesn't protect against
E2EE protects the transmission of data — not the endpoints. If someone has access to your unlocked phone, they can read your Signal messages. If your device has malware, the attacker can capture messages before they're encrypted. E2EE is a powerful protection but not a complete one.
Metadata is also typically not protected. Even with E2EE, an app company often knows who you communicate with and when — just not what you said.
The bottom line
For private conversations, use Signal. For everyday messaging where perfect privacy isn't critical, WhatsApp's E2EE is adequate. Understand that regular SMS and standard email are not private communications — treat them accordingly.