Also known as: E2EE · E2E encryption
End-to-end encryption (E2EE) is a system in which messages are encrypted on the sender's device and decrypted only on the recipient's, so that no intermediary — including the service provider — can read the content in transit or at rest on its servers.
The defining property is that the provider holds no key capable of decrypting content. This is what distinguishes E2EE from ordinary transport encryption, where the provider decrypts messages on arrival and could be compelled to hand them over.
E2EE protects content, not metadata. Who communicated with whom, when, how often, and from what approximate location typically remains visible to the provider — and in aggregate that metadata is frequently more revealing than the message text it accompanies.
Metadata
Metadata is the information surrounding a communication rather than its content — who contacted whom, when, for how long, from where, and how frequently — which remains visible even when the content itself is encrypted.
TLS
TLS (Transport Layer Security) is the cryptographic protocol that encrypts data in transit between clients and servers, providing confidentiality, integrity, and server authentication — most visibly as the S in HTTPS.
Encryption at Rest
Encryption at rest is the encryption of stored data — on disks, in databases, or in backups — so that physical access to the storage medium does not yield readable data.
Zero-Knowledge Architecture
A zero-knowledge architecture is one in which a service provider stores user data but holds no ability to decrypt it, because encryption and key management happen entirely on the user's device.
Forward Secrecy
Forward secrecy is a property of encryption protocols ensuring that if a long-term private key is later compromised, past recorded sessions still cannot be decrypted, because each session used ephemeral keys that were discarded afterwards.