How End-to-End Encryption Keeps Messages Private

End-to-end encryption (E2EE) means a message is scrambled on the sender's device and unscrambled only on the recipient's device. The company that runs the messaging service, the phone network and anyone listening on the way can see that data moves, but cannot read what it says. This article explains the idea and how a well-known design, the Signal protocol's Double Ratchet, keeps changing the keys as a chat goes on.

What makes it different

Many services encrypt data only in transit, between your device and their servers. The provider can then decrypt it. In E2EE the provider never holds the keys. Wikipedia notes that the term once meant only encryption during transport, and that around 2014, with WhatsApp's rollout, it came to mean excluding the service provider as well, which is how it is used now.

Keys: public and private

Encryption turns readable text into scrambled data using a secret number called a key. In public-key systems each person has two linked keys: a public one that can be shared and a private one that never leaves the device. People use these to agree on a shared secret over an open connection. That shared secret is then used to encrypt the messages themselves.

The Double Ratchet

The Signal protocol's specification describes the Double Ratchet. It is used after two parties have already agreed on a first shared secret through a separate key-agreement step. Its purpose is to give every message its own key, so that keys keep changing through the conversation. It combines two mechanisms:

• A symmetric-key ratchet. Each message advances a chain. The step takes a chain key and produces a new chain key plus a message key, and it only works forwards. Once a message has been handled, its key can be deleted
• A Diffie-Hellman ratchet. Each message carries a fresh public key from the sender. When one is received, the receiver mixes new secret material into the chain. The two people take turns doing this, so new secrets keep entering the conversation

Two protections that result

The specification calls the first one forward secrecy. Because keys are derived one way and old keys are deleted, an attacker who obtains today's keys cannot calculate earlier ones. In the spec's words, earlier keys cannot be calculated from later ones.

The second is break-in recovery, also called post-compromise security. If an attacker steals a party's current keys, they can read messages until the session state changes. After the parties exchange new public keys, the chain absorbs secrets the attacker does not have, so future keys become unpredictable again. The specification says this works against passive eavesdroppers; an attacker who keeps control of a device or actively interferes can still keep access.

Late and missing messages

Real networks deliver messages late or out of order. The Double Ratchet numbers each message, so a receiver can work out and temporarily keep the keys for skipped ones. The spec sets a limit on how many such keys can be stored.

Checking you are talking to the right person

Encryption does not prove who is at the other end. An attacker sitting in the middle could swap keys. The defence, according to Wikipedia, is to compare key fingerprints or safety numbers through another channel, for example in person or by a call.

What E2EE does not protect

• A compromised phone or account. If someone controls the device, they can read the messages after they are decrypted
• Backups, if they are stored without the same protection (a detail that varies by service)
• The fact that you are communicating, which the network can still observe

Wikipedia also reports that governments and police have raised concerns about E2EE for investigations, and that some businesses need to read messages for compliance and archiving. Services differ in what they offer: it says Signal and WhatsApp use it by default, iMessage supports it, and Telegram offers it only in opt-in secret chats.

Looking ahead: quantum computers

The spec says that the classical, Diffie-Hellman-based ratchet does not resist quantum computers. Revision 4, dated 4 November 2025, describes extensions that run a post-quantum key agreement alongside the existing one, so an attacker would need to break both.

Sources

• The Double Ratchet Algorithm, Signal
• End-to-end encryption, Wikipedia