End-to-end encryption

In short: With end-to-end encryption (E2EE) only sender and recipient can read a message, not the service provider and not third parties along the way.

In more detail: The keys exist only on the conversation partners’ devices. The server forwards encrypted data that it cannot decrypt itself. To verify authenticity, the partners compare a safety number (fingerprint).

Our context: Private messages between friends at Emzett are end-to-end encrypted. The recovery phrase is the only way to get the keys back on a new device.

In Depth

• Transport encryption vs. E2EE: With HTTPS only the path to the server is protected. The provider sees the contents. With E2EE it does not.
• Methods: key exchange (for example X25519), symmetric encryption of the message (for example AES-GCM or ChaCha20-Poly1305).
• Limits: Metadata (who, when, how often) is often visible. Whoever has the device sees the messages.
• Loss: Without a key backup, old messages cannot be read.

See also: Asymmetric encryption, Symmetric encryption