What Is End-to-End Encryption? A Plain English Guide

Almost every app now says it is encrypted. Fewer are encrypted end to end, and that difference decides who can read what you send or store: only you and the person you meant, or also the company, anyone who breaches it, and anyone who can make it hand data over.

The one sentence version

End-to-end encryption means your data is locked on your device and can only be unlocked on the device it is meant for, so nobody in between, including the company running the service, can read it.

Encryption in thirty seconds

Encryption scrambles data with a key so it looks like random noise to anyone without that key. Modern encryption is not the weak point. AES-256, the standard used by governments and banks, has no known practical way to be broken by guessing the key. So the real question is never whether data is encrypted. It is who holds the key.

Three kinds of encrypted that are not the same

The server is the difference

Ordinary encryption protects the road, then opens the box at the company. End-to-end encryption never opens it in the middle at all.

How end-to-end encryption works

Most messaging apps use public key cryptography. Each device has a pair of keys. The public key can be shared with anyone and only locks. The private key never leaves the device and is the only thing that can unlock.

• When you message someone, your app locks the message with their public key.
• The locked message passes through the company's servers, which can only see noise.
• Only the recipient's private key, on their phone, can unlock it.
• Protocols like the Signal Protocol, used by Signal and WhatsApp, also change keys constantly, so even a key stolen later cannot unlock old messages. This is called forward secrecy.

For files you store for yourself, the idea is the same with one key instead of a pair: the key is made on your device, stays there, and the service stores only what it cannot read. This is sometimes called zero knowledge storage.

Where you already use it

• WhatsApp and Signal encrypt messages and calls end to end by default.
• Apple's iMessage and FaceTime are end to end encrypted.
• Google Messages encrypts RCS chats end to end between Google Messages users.
• Facebook Messenger made end to end encryption the default for personal chats in December 2023.

The catch is backups. WhatsApp chat backups to Google Drive or iCloud are not end to end encrypted unless you turn on the end to end encrypted backup option in settings. On iPhone, iCloud backups are only end to end encrypted if you enable Advanced Data Protection, which Apple withdrew for new users in the UK in 2025. Your messages can be sealed in transit and sitting readable in a backup.

What end-to-end encryption does not protect

It protects the middle of the journey completely. It does nothing for the ends. Knowing the limits is what makes it useful rather than a slogan.

• Metadata. The service may still know who you talked to, when, and how often, even if it cannot read what was said.
• An unlocked device. Anyone holding your unlocked phone sees everything the app shows you.
• Malware on the device, which reads the screen before encryption ever happens.
• The recipient. Once they can read it, they can screenshot it, forward it or save it.
• Weak passwords and PINs, which let someone simply log in as you.
• Unencrypted backups, as above.

“Encryption answers who can read your data on the way. It cannot answer who is holding your phone.”

Kavion Solutions Team

How DigiSafe uses it for your documents

DigiSafe, the free document vault we build at Kavion Solutions, applies end-to-end encryption to identity documents rather than chats. Your PIN is turned into a key on your phone, your documents are locked with AES-256 before they are saved or backed up, and our servers only ever store what they cannot read. We explain the full design, including how the recovery code works, in how we built DigiSafe.

Sharing keeps the same promise. A shared link carries its key after the # symbol, a part of a web address that browsers never send to a server, so the recipient can open the document and the server that delivers it cannot. That is the difference from emailing a passport, where every server along the way holds a readable copy, as we cover in sharing a copy of your ID safely.

How to tell if an app is really end to end encrypted

The label gets used loosely. These questions cut through it:

• Who holds the key? If the answer is not clearly “only your devices”, it is not end to end.
• Can the company reset everything with just your email? If support can restore all your data without your password or a recovery code, the company can decrypt it.
• Is it on by default? Optional encryption that most people never switch on protects most people from nothing.
• Does it explain the design in public? Serious services describe how their encryption works rather than just saying “bank grade”.
• What about backups and sharing? Check that neither quietly falls back to ordinary encryption.

Building software that keeps promises like these is a large part of what we do for clients, from app development to cloud security. The principle is the same every time: decide who must never be able to read the data, then build so that they cannot.