What Is End-to-End Encryption?

End-to-end encryption (E2EE) is a method of secure communication where a message is encrypted on the sender's device and can only be decrypted on the recipient's device. No intermediary — not the messaging server, the internet provider, or any government — can read the content, because they never hold the decryption keys.

The phrase "end-to-end" refers to the two ends of the conversation: your device and your contact's device. Encryption and decryption happen only at those ends. Everything in between — the app's servers, the Wi-Fi router, the cellular network, the backbone routers that carry the packets — sees only ciphertext, a scrambled blob that is useless without the key.

How end-to-end encryption works

E2EE relies on public-key cryptography. Each user's device generates a key pair: a public key that can be shared freely, and a private key that never leaves the device. When you want to send a message, your device uses the recipient's public key (and its own private key) to establish a shared secret through a key-agreement algorithm such as Diffie–Hellman. That shared secret is used to derive a symmetric key, and the message body is encrypted with a fast, strong cipher like AES-256.

Because only the recipient holds the matching private key, only the recipient's device can complete the key agreement and decrypt the message. The server that relays the ciphertext cannot — it never had the private keys and never derived the shared secret. Modern messengers layer this into a full Signal Protocol handshake and a Double Ratchet so that every message gets a fresh key.

Why end-to-end encryption matters

E2EE is what makes a messaging service trustworthy by design rather than by promise. Without it, your privacy depends entirely on the provider's good behavior, its internal access controls, and its willingness to resist data requests. With it, even a fully compromised or subpoenaed server yields nothing readable. E2EE protects journalists and their sources, activists organizing under repressive governments, businesses handling trade secrets, medical and legal professionals bound by confidentiality, and ordinary people who simply believe private conversations should stay private.

Common misconceptions

• "E2EE hides everything." It protects message content, but not necessarily metadata — who you talk to, when, and how often. Strong privacy requires protecting metadata too.
• "If it says encrypted, it's end-to-end." Not always. Check whether the provider can technically read messages. If they offer server-side search of your message text, or cloud backups they can read, it is usually not end-to-end.
• "E2EE means no one can ever see my messages." The endpoints still see plaintext. If your device is unlocked, infected with spyware, or backed up unencrypted, the content is exposed regardless of the protocol.

How to tell if an app is truly end-to-end encrypted

Marketing language is not proof. A few practical signals separate real end-to-end encryption from encryption in transit. Look for whether the provider can technically read your messages: if the service offers server-side full-text search of your chats, or cloud backups that restore without a key only you hold, the content is almost certainly readable to the provider. Check whether the app offers safety numbers or key verification, which let you confirm you are encrypting to the right person and not a machine-in-the-middle. Prefer apps that publish their protocol and, ideally, their source code, so independent experts can confirm the claims. Finally, be skeptical of features that would be impossible under true E2EE, such as the server generating link previews from your message text or scanning content for advertising.

How OSHI uses end-to-end encryption

OSHI is end-to-end encrypted by default. It uses X25519 for key agreement and AES-256-GCM for authenticated message encryption, wrapped in a Signal-protocol-style handshake and a Double Ratchet so that each message uses a fresh key and past messages stay safe even if a key is later compromised (perfect forward secrecy). OSHI requires no phone number, is open source under the MIT license, and can even deliver messages over a Bluetooth mesh when there is no internet at all.

Frequently Asked Questions