How the encryption works.
The protocol in full, from the handshake before your first message to the limits at the end.
One message, end to end
Follow a single message from your device to theirs.
- 01
You write it
The message is encrypted on your device under a key derived for that one message. If it cannot be encrypted it is not sent. There is no unencrypted fallback.
- 02
We carry it
What arrives on our servers is the encrypted version and the routing needed to deliver it. That is all we can hand to anyone.
- 03
They open it
Their device holds the only key that opens it, and each of their devices gets its own copy under its own key.
The handshake
What happens before your first message is sent.
X3DH to start a conversation
An extended triple Diffie-Hellman against the recipient's published keys, so the first message is already encrypted with nobody waiting online. Each device keeps a pool of 50 one-time keys, tops it up before it runs dry, and rotates its signed key weekly.
A Double Ratchet per thread
Every message advances a ratchet and is sealed under its own key. One key does not open the thread, and the chain heals after a compromise. Up to 2,000 keys are held back for messages that arrive out of order, so a long time offline still reads in full.
Sender keys in groups
One encryption per sender covers the whole group, up to 256 people. Someone leaving forces a new key generation and cannot read what comes after. Someone joining is admitted from the point they arrived and cannot read what came before.
Safety numbers you can check
A 60 digit number, 30 from each account. If someone's devices change, the app says whether a device was added or an existing key was replaced. A replaced key is the one to ask about.
Check it yourself
Read the number out together. If both sides match, nothing is in the middle.
Safety number
Read it aloud together. If both sides match, nothing is in the middle.
The primitives
Every one is standard and can be looked up.
- Key agreement
- X25519 Diffie-Hellman
- Signatures
- Ed25519, on identity and signed prekeys
- Key derivation
- HKDF-SHA256, with HMAC-SHA256 chain keys
- Message encryption
- AES-256-GCM
- Attachments
- A fresh AES-256-GCM key per file, wrapped through the same ratchet
- Safety number
- Iterated SHA-512, 5200 rounds, 30 digits per account
- Backup key wrapping
- scrypt N=65536, r=8, p=1, then AES-256-GCM
- Recovery key
- 256 bits, 64 characters, in an alphabet with no I, L, O or U
- Local key storage
- IndexedDB, sealed under a non-extractable AES-256-GCM key
There is no third-party audit of this build and the source is not published. Report anything you find to [email protected].
What reaches our servers
Delivery needs a destination and a time. Everything else is sealed with the message.
What the server holds
Ciphertext, and the routing needed to deliver it: which conversation, which sender, when.
What it does not hold
The keys to an encrypted message. We hold no key that opens one.
Metadata is sealed too
A voice note keeps only its length. A shared post keeps only that it is a post. Locations, contact cards and sticker data are sealed in full.
Backups
Encrypted on your device first, under a key wrapped by a recovery key that never leaves it. Five wrong attempts start a lockout that doubles up to an hour.
The full list names what stays readable for each kind of message, and the features that switch themselves off in an encrypted chat so no request goes out on your behalf.
Your devices
Each one has its own keys.
Each device has its own identity
A new device generates its own keys. Messages are encrypted to each of yours separately, and the sending device keeps a copy sealed to itself so your own history is readable where you wrote it.
Linking is deliberate
A new device shows a code that an existing device approves. Nothing moves until then.
History does not follow automatically
A device reads what it was there for, or what you restore from backup. When it cannot, the app counts the messages it could not open and offers the routes available: sync, restore, or link from another device.
Old devices are dropped
Five at a time, enforced on the server. A device unused for thirty days is dropped, except when it is the only one you have.
Where it stops
The four limits.
Groups above 256 people
Sender keys cover a group up to 256 members. A larger one is not end to end encrypted, and the app says so in the group itself.
Messages sent before encryption shipped
A small number of early messages predate end to end encryption and were stored readable. Everything sent since is encrypted.
The people you write to
Encryption protects a message in transit and at rest. It cannot stop someone in the conversation from screenshotting it.
What a device has seen
Your history lives on the devices that received it. Losing all of them, and the recovery key to your backup, means losing it. Nobody can reissue that key, including us.