Who Can Read Your Messages
"Encrypted" is not one thing. The question that matters is whether the company running the app can read your messages too — and for most apps, the honest answer is yes.
Every chat app says "encrypted". So they are all private, right?
They almost all encrypt. The word hides the question that actually matters: encrypted from whom. From a stranger on the Wi-Fi, or from the company that runs the app itself?
Two very different promises
Most apps encrypt messages in transit — safe from the network — but the company's servers can still read them, because the messages are decrypted there. End-to-end encryptionEnd-to-end encryptionEncryption where only the sender and the recipient can read a message — not the app's company, not the network, not anyone in between. is the stronger promise: only you and the person you are talking to can read it. The service carries ciphertext it cannot open.
Transit encryption only:
you -> [encrypted] -> SERVER (reads it) -> [encrypted] -> them
End-to-end encryption:
you -> [encrypted all the way] -> them
the server only ever sees a locked box
- Line 2Protected from outsiders, but the company can read, scan, hand over, or lose your messages. This is the default for a lot of popular apps.
- Line 5The service becomes a courier of sealed envelopes it cannot open. Even compelled by a court, it can only hand over ciphertext. That is the line that matters.
An app is "encrypted" and its company advertises that it takes privacy seriously. How do you tell whether it is actually end-to-end?
Which fact tells you a messaging app is NOT end-to-end encrypted?
Why it matters, concretely
Trusting the word "encrypted"
- Assuming any padlock means the company cannot read your chats
- Storing sensitive conversations in an app that can scan them
- Not knowing whether a breach of the company exposes your messagesAsking who holds the keys
- Prefer end-to-end encryption, on by default, for anything sensitive
- Understand that true E2EE means the company cannot recover your history —
that limitation is the feature working
- Match the choice to your threat model: casual chat needs less than a
conversation that could put someone at risk"Encrypted" answers the wrong question. "Can the company read this?" answers the right one, and the answer decides what a breach, a subpoena, or a rogue employee can reach.
So the padlock was doing the same trick as the VPN adverts.
The very same. A true statement — it is encrypted — standing in for the one you actually care about. Learn to ask the sharper question and the marketing stops working on you.
And from my side: a service that can read messages is a service I can try to reach through — the company, an employee, a breach. End-to-end takes that whole avenue away from me.
Legal
Choosing private tools for your own conversations is entirely legitimate. Using them to coordinate harm, or attempting to intercept other people's messages, is not what this teaches and is a serious offence.
So "encrypted" is not the promise — "the company cannot read it" is, and only end-to-end encryptionEnd-to-end encryptionEncryption where only the sender and the recipient can read a message — not the app's company, not the network, not anyone in between. delivers it. Match it to your threat modelThreat modelFour honest answers: what you are protecting, from whom, what happens if it fails, and how much trouble you will go to.: against a network snoop any encryption helps; against the company, a court, or a breach, only end-to-end does. Next: email — the channel most of your serious mail still runs on, and how much it leaks even when the words themselves are safe.