E2EE stands for End-to-End Encryption. The cryptographic property that data is encrypted on the sender’s device, transits the network as ciphertext, and is decrypted only on the recipient’s device. Servers along the path see only the encrypted bytes. The keys never leave the endpoints.
What it means in practice
E2EE matters because it changes the legal and operational answer to the question “what can the provider produce when subpoenaed.” Without E2EE, the provider holds the keys and can be compelled to hand over content. With E2EE done correctly, the provider holds ciphertext and a court order produces noise. The Signal Foundation publishes its production responses to subpoenas; the technical claim (“we have only registration date and last connection date”) matches the legal response. Most consumer messaging apps that advertise encryption use transport encryption (TLS in transit) plus at-rest encryption on the server, not true E2EE. The difference matters at the moment of compelled production.
Where it shows up
Default in: Signal, WhatsApp messages (Meta cannot read message content but can read metadata, group membership, and the social graph), iMessage between Apple users (with caveats around iCloud backup that historically broke E2EE; Apple Advanced Data Protection introduced 2022 closes that hole if enabled), Wire, Olvid, Threema, Briar. Default off in: SMS, RCS without Google Messages between two Android users, Twitter/X DMs, Instagram DMs (default; Meta is rolling out E2EE optional), Facebook Messenger (default off, optional in Secret Conversations). For email: not a default property; PGP and S/MIME exist but are operationally rare. Proton Mail and Tutanota provide E2EE between users on the same service, with mixed-encryption modes when communicating with non-users.
What you can change today
Audit the last week of conversations that contained anything sensitive (work negotiations, family disputes, legal coordination, source contact). For each, identify whether the channel was actually E2EE or just “encrypted in transit.” Move the truly sensitive threads to Signal or Wire. Enable iCloud Advanced Data Protection on Apple devices (Settings, Apple ID, iCloud, Advanced Data Protection) so the iCloud backup of iMessage is also E2EE. For email, accept the operational reality that mainstream email is not E2EE and do not put in email what would hurt to read aloud in court.