While WhatsApp’s end-to-end encryption ensures that the text message you write is kept private from everyone except the sender and recipient, it does not keep the person’s life around that message private. Calls and personal chats are locked automatically, with no settings necessary, but the record of whom you have contacted and at what times will remain visible even after these two features are activated. Additionally, anything the person on the opposite side takes a screenshot of, forwards, or saves in the cloud is also not protected by WhatsApp’s end-to-end encryption.
When people search for turning on or off WhatsApp end-to-end encryption, most of these searches actually lead to a list of options regarding the app’s privacy settings, as these controls are limited to a backup and few additional layers. The feelings of uncertainty and concern expressed when they reach this page can be justified; however, the conclusions drawn from these searches are often incorrect. The following four limitations of WhatsApp’s end-to-end encryption are useful to keep in mind, as well as one easy way to confirm whether your own messages are protected.
What WhatsApp Encrypts by Default — and Why There’s No Switch to Find
WhatsApp’s encryption applies to personal messages even if you have never heard anything about encryption prior. All one-on-one and group chats (messages, calls, images, videos, voicenotes, and files), are protected by the Signal Protocol, the same protocol that will keep you safe on Signal, and they cannot be opened until they reach the intended recipient.
In 2016, WhatsApp announced its commitment to privacy by stating it would be offering these services “always on and by default” and would not require customers to “turn on” anything to use these features. Even today, almost ten (10) years later, WhatsApp still describes the same commitment to privacy in this same manner. It states that nothing from within a chat can be viewed, heard, or made public by either WhatsApp or Meta. Only the individual(s) participating in the chat will see, hear and have access to everything shared in that conversation. Its 2016 announcement and its privacy page still put the claim the same way — no one outside the chat, not even WhatsApp or Meta, can read, listen to, or share it.
Most people fail to see the most important part of that policy: before the message leaves your phone. Your device is simply the delivery service for the message. According to the Signal specification, what happens when the server receives a message is far more important than having one single master key to all your messages. The parties to the conversation (both of you) create a new key for each message, so even if a key is leaked after you sent it, that key cannot open any of the messages sent to you before it was leaked. Conversely, if the key was leaked prior to sending you, you will not have access to any future messages sent to you. No message can be found on the shelf waiting to be opened by someone else.
As the following two consequences explain, they are the fundamental basis for everything else that follows…
All individuals looking to find a “switch” that will turn off their chat encryption should know they are searching for something else entirely, as they’re generally looking for the backup screen, which (in fact) is a “switch.” The backup screen belongs to an entirely different platform/system, the details of which are covered in the backups section of our documentation, in its own section.
While WhatsApp is a transit-based encryption application/service, this does not mean WhatsApp is providing an “information black hole” regarding the communication you send using their service. The encryption provided by WhatsApp only represents what occurs during the transmission of your message(s) on your or someone else’s device; it provides no information about what copies of your message(s) remain accessible (readable) on either device after the transmission, nor does this provide information about any historical copies of your message(s) stored on cloud accounts, as each night WhatsApp pushes copies of your historical chat information to your cloud account. WhatsApp will tell you what information is missing from their encrypted message(s) after the transmission of your message(s) to/from another individual, via the same simple plain-language page where they indicate their commitment to providing an encrypted communication solution. Thus, users searching for information regarding the loss of chat data after transmission should feel comfortable obtaining that information directly from WhatsApp, rather than having to search through their legal policies or user agreements for such information.
What WhatsApp Still Knows When It Can’t Read a Word
Encryption keeps your information safe, but it does not conceal the existence of that information.
This may sound technical, until one gets through the “technical” walls that may hide this. As WhatsApp itself states in its privacy policy, WhatsApp collects the time, frequency, and duration of each user’s activity and interactions, the last time the user used the service and the last messages read; the user device model, battery level, signal strength, the app version of the user device, mobile network, language and time zone; identifiers that link the user’s backups to their account; an approximate general location (based on their IP address and phone number area code, WhatsApp can predict the city users are in); and the phone numbers the user stored on their phone’s address book in order for that user to be able to add those contacts to their WhatsApp contact list.
Then, from the same Q&A section of WhatsApp, WhatsApp states that it does not keep logs of all users’ messages and calls, and that record-keeping could potentially threaten users’ privacy, which would be extensive. Thus, while both statements are from the same provider, and are currently active, neither is consistent with the other. Therefore, one must assume these statements do not mean the same thing; a message log from a previous conversation is an entirely different entity from a report on the usage of that same conversation. Therefore, while WhatsApp provides an assurance that it does not store messages, there also is no information that states, “We store every message sent by all users.”
Both are helpful but the accurate version is more helpful. WhatsApp’s policy states that once a message is delivered it is removed from its servers, but a message that has not yet been delivered will remain in an encrypted state for a maximum of 30 days before being deleted. This is the distinction that the EFF makes in its own encryption recommendations: the contents of communications are encrypted, but the existence of the communication is not.
The only thing that remains following the issuance of a request for records is a record of the relationship; there is no sentence or message. As one user of Reddit pointed out, there are court cases where email messages were not available in response to a subpoena, but the contact records were; in order for there to be no response to the request for the email messages, the messages would have had to have been encrypted.
All of the above does not contribute to building a profile of any of your writing; therefore, when users of WhatsApp say, “I told someone something on WhatsApp and the next thing I knew I saw an advertisement for it”, WhatsApp simply says, “No”. What WhatsApp can act on is cheaper and easier to deny than the contents of communications: the individual with whom you communicated, the frequency of your communications, the time of day, the location of the communications, and whether the communications increased and then decreased in volume.
Before altering anything regarding your settings or privacy in WhatsApp, know this: the information you allow WhatsApp to collect will determine how effective this change will be. This collected information is stated in the privacy policy; it is NOT controlled by the various toggles in the WhatsApp settings. For example, when you hide your last seen, your profile photo and read receipts, you are making it harder for your contacts to understand what type of activity is coming from you. However, these changes do not affect the type of activity that WhatsApp will record about you.
The Chats WhatsApp Says Aren’t Fully Covered: Businesses, AI Agents, and Payments
At this point in time, this should no longer seem like a list of things that are missing but, instead, should be looked at as a rule that states that WhatsApp’s End-to-End Encryption is applied to messages between users of WhatsApp, and the level of encryption decreases when you’re attempting to use the service to send a message so that someone other than the original sender and receiver can read it.
The grid below should now be considered a means for sorting through the Vendor information rather than an end-all be-all decision on the application. The middle column contains what the Vendor has made public about their application as of September 2026, while the last column indicates who maintains control over the application.
| What you’re doing | Covered | Not covered | Conditional on |
|---|---|---|---|
| Personal chats and calls | Content on both phones and in transit | Names, photos, group rosters, activity records | Nothing — it’s on by default |
| Profile photo, “about”, group name and description | Visible to whoever can see that surface | Your own audience settings | |
| Message to a business on WhatsApp | Storage and use by the business | Whether the business reads its own policy or Meta’s cloud | |
| Chat with Meta AI | What you send the assistant | You starting or tagging that chat | |
| Payments and transfers | Transaction data reaching banks and partners | Whether payments exist in your country | |
| A chat someone reports | The copy that report carries | A participant filing it | |
| Cloud chat backup | Anything held outside WhatsApp | Whether you switched encryption on and kept the key | |
| Undelivered message on WhatsApp’s servers | Nothing — held encrypted up to 30 days | Nothing |
Why conditional coverage isn’t one thing
Only one line lacks an asterisk, while there are multiple conditional rows containing asterisks of assorted types. You can categorize these asterisks according to the entity that controls the condition, and therefore, you can interpret the fine print as a guideline.
As for WhatsApp messages sent from companies to answer their customers, many of these messages are routed through either Meta’s cloud or an intermediary provider. As to the threads formed via routing, “we do not deem these messages as having an end-to-end encryption.” WhatsApp advises that when a company routes messaging through a provider, the company may allow the provider access to send, receive, read and manage its conversations. The company may also use the sender’s data for its own marketing purposes. This information can be identified in the chat where there is a blue system message. Your protection in regards to this situation depends on a contract with a stranger’s vendor, which is why it is eminently wise to read the privacy policy of the vendor before you hand over your information to the vendor.
The reverse is true in the AI example. Meta AI on WhatsApp only has access to what you send them or to content identified by a group member in the conversation. This is the reason for the extremely popular warnings that the AI is reading every message that you send unless you are using an optional privacy setting. These widely circulated warnings were fact-checked and rated false by Snopes.
Two additional exclusions have also been issued that are worthy of checking yourself because their language is particularly blunt; that is to say the chat logs routed through 3rd party agents are not considered end-to-end encrypted because the agent uses Meta’s services to route its message(s). Additionally, payment transactions do not fall within the end-to-end encryption because banks must receive transaction data through an intermediary due to federal law. WhatsApp’s U.S. policies support the above-stated position, whereby if you use a payment service offered in your country, a separate Privacy Policy pertains to how that data is handled.
Your Backup Is a Separate System — and Its Key Can’t Be Reset
Using chat encryption does not mean your backup is protected in iCloud or Google Drive, and this isn’t just semantics. WhatsApp made this clear to users back in 2021, as The Verge recorded: the protection only extends until delivery; the security of those messages, once they are stored in a cloud service, depends on the service provider — i.e., a company that has provided such records to law enforcement in response to a valid warrant. WhatsApp describes the same architecture in reverse because delivered copies will be deleted from its servers. The copies that are subject to subpoenas, leaks, or loss are on your mobile device and in your backups.
In short, an encrypted backup option is separate from chat backup, with its own key instead of simply being a box checked. According to WhatsApp’s help section, three ways exist to protect an encrypted backup: a password associated with the device, an invented password, or a 64-digit key that will be presented to you only once when being established. The same section indicates that if you lose access to your account or you forget the password or key associated with it, “WhatsApp cannot provide you with a duplicate, reset anything, or retrieve your backup.”
It is important to mention how this relates to the policy of the company on using their authentication codes, tokens, passkeys and recovery keys that they create and store when the user chooses the encrypted backup option and also chooses a password. Those credentials are the way that service identifies the user as “who” they are. Those credentials are not how the user could retrieve their history; if they were then the encryption would only be a costumer. The design is asymmetrical – the user cannot be rescued as no one can read the user.
And this is what makes this part of the article possibly expensive for you. On a pay per use Q&A website, a software technician answers a question from a user who was trying to restore an iCloud backup to a new device, and they ended up in a situation where they couldn’t remember creating the 64 digit code. The technician said simply that without the code, “There’s no way you can get access to the encrypted backup.” The only option is to use WhatsApp support instead of a recovery option.
The failure mode is an issue of layer and not an issue of luck; your protection on your backup is associated with the installation of the device rather than the account through which you have access to iCloud; therefore, it is possible to be on a new device in the middle of a restore flow and to get prompted for a key you never consciously selected. Always run the check for free before trying anything.
- Open the chat backup screen in WhatsApp’s settings and read what it says about end-to-end encryption, on the phone that currently holds your history.
- If protection is on and you can’t produce the passkey, password or 64-digit key, fix that now, while the old device still works and is signed in — write the key down and store it somewhere you’ll still have in three years.
- If you would rather not carry a key like that, stop treating the cloud as your archive and keep chat history on the device, accepting what that costs you when the device dies.
No matter how you trade, honesty is the basis for all trades. In addition, when you trade, both parties are affected by this lack of symmetry: anything you write will be stored on one side of the transaction. Your contact has control over their own cloud settings and, even if you choose to keep your chat confidential, if your contact’s phone is set up that way, a copy of the chat will also be saved to their Drive.
How to Check One Specific Chat — and What the Security Code Actually Proves
Only the Security Code Check located within the actual chat can be tested; this is the only portion of this entire narrative that can be tested in this manner vs. by having faith that it works as advertised. According to the WhatsApp Help page, in order to verify the Security Code Check, first open the chat with your partner, tap on your partner’s name, and look for Encryption. This will show a QR code and a 60-digit number for both of you to either scan each other’s codes or read the numbers out loud to each other until a match is made, which will produce a green check mark.
The certification that this produces has two main benefits. The number that you see is a summary of the keys that each person has installed, not a password and not the keys themselves; therefore, by comparing the two numbers, you can answer only one question: Is there anyone else in between me and my partner in this communication thread? The second benefit that the help page mentions is that once the chat is independently verified by both parties, it also verifies that both persons’ lists of devices linked to their accounts are current. If an intermediary were able to insert a device that he/she/they could use to read the contents of the communications, it would be done via a device added to your partner’s account secretively.
These benefits, however, are limited in the following three ways from being misused.
The code that is assigned to a WhatsApp chat represents only that particular chat. Therefore, a green checkmark does not indicate the overall health of the entire application nor does it guarantee the integrity of the application — that will be discussed in the next section.
There are many mundane reasons why the code changes from one chat to another: If a user reinstalls WhatsApp, switches to a new phone, or swaps their linked device, each will create a new chat code. The best way to respond to an invalid/chat code is to re-verify them in person, and check the linked devices list located in the Account section of Settings to log out from any unknown devices.
Additionally, Verification will only catch conversations where it can “see” both ends of the conversation. A verification check will compare what both devices have for a given conversation; therefore, it is recommended to conduct a verification in person, within the same location, for the few threads that could result in a negative outcome if incorrect information is received.
Closed Source, a Lawsuit, and What You’re Actually Trusting
There is one question that cannot be answered by the green check: how can you trust the app is doing what it claims? A headline addressed this issue on multiple occasions this year.
Encryption runs on your phone, which is both the benefit and the problem with verifying it. Matthew Green, a cryptographer at Johns Hopkins University, has been researching these types of systems for 15 years. In a February 2026 analysis, Matthew described this limitation: because WhatsApp is closed-source, “You can’t simply download the source code, so you can’t easily verify whether encryption works correctly or not; nor can you compile your own version to compare it with the one from the app store,” whereas he notes that with Signal you can definitely do both those things.
Matthew’s take on the original accusation was stronger. If the level of backdoor access alleged were true, it would have to be documented in some way by the vast array of users who used WhatsApp for at least ten years. In fact, researchers have previously successfully decompiled past builds of WhatsApp. Thus, the real position is not verified secure; rather, the position is the math is public, the client is not.
Lawsuit Highlights Lack of Trendiness: The lawsuit was filed by six people in five countries and the US against Meta in January 2026, claiming that employees of Meta can read users’ messages on demand using anonymous whistleblowers as a source. The complaint was dismissed on July 24, 2026, by a federal judge in San Francisco, who ruled that the complaint did not adequately explain how the anonymous informants knew what they claimed, finding that to be an issue of pleading, not of the interference with encryption.
The court also denied the plaintiffs’ lawyers’ request for sanctions and rejected the argument made by Meta that people outside the United States do not have the right to sue under American privacy laws because the servers were located in California.
The litigation continues: The court records show an amended complaint was filed on August 4, 2026, and Meta has moved to dismiss that new complaint as well, and as of September 2026, no ruling has been issued on the motion. Meta disputes the allegations made against it and has expressed that it believes the assertion regarding non-encryption of its messages is utterly ridiculous and untrue. Bloomberg reported that the US Department of Commerce concluded a similar investigation of the same whistleblower source in April.
WhatsApp is not a promise of privacy that you can guarantee; it is a matter of trust. The soundness of the WhatsApp protocol has been independently validated for the past ten years. To ensure that the implementation remains true to the protocol, we must rely on decompilers, researchers, and attorneys who are verifying it, rather than relying on you. Endpoint attacks continue to be less expensive than trying to reverse-engineer an application — which is where the final section belongs.
Where the Encryption Stops: Your Screen, Their Screen, and Everything After
When a message has been transmitted and opened, it is essentially just a text communication on someone’s portable electronic device, and this is where the authority of the encryption ceases to be of significance. WhatsApp states this so simply that it is nearly as blatant as the statements made by its critics – the WhatsApp Policy notes that users can capture images of conversations or create recordings of phone conversations with one another and distribute them in many ways, and once the content is received by an individual person, that individual can store it or redistribute it both on and off WhatsApp.
The traditional perspective has been flipped around. The structure responsible for separating you from unknown individuals is not merely the protocol itself, but rather, your and the other individual’s two separate equipment, two separate cloud accounts, and two separate habit structures. The only thing that the encryption secures is the wire between your respective cells, while none of the other equipment along the chain can be guaranteed.
Furthermore, equipment is also where serious attackers spend their time. In 2019, Citizen Lab documented a campaign to inject NSO Group spyware into the cell of individuals through WhatsApp calls, even without answering the call, and emphasized that the spyware was designed to bypass end-to-end privacy by targeting the hardware rather than the physical files. The error was corrected within days of the initial report, but it still serves as a record of interest due to the high cost of “breaking” a locked device as opposed to simply borrowing an unencrypted device from a friend.
The setting that helps, and the one it doesn’t cover
WhatsApp has introduced a new feature, known as Advanced Chat Privacy, starting in April 2025, that is being seen as a softer solution to this problem. The benefit is that you turn on the feature in your chat; this means that the other participants will not be able to export your conversation, your media will no longer be saved to their personal gallery; and AI features for that chat are disabled for all members of that chat, including yourself.
However, it is NOT end-to-end encryption and it does NOT appear on any screen. WhatsApp has stated that this feature was the first version of a much more secure version; and that when they originally launched the feature, they made it clear that a screenshot can still be taken; and as of now there are no reports of a screenshot blocker being available so that is still an open area of concern. The two features that are commonly confused for this are the “Chat Lock” feature, which allows you to “lock” your chat using your authentication method, and “disappearing messages,” which limit the existence of any copy of the messages. Neither of these two features provide a key to anyone; all three features can be accessed through a person’s phone if they are already in possession of that phone.
Ultimately, what this means is that the last practical prescriptive step is to accurately identify your “weakest link” and no longer consider your app’s “weakest link.” To do this, consider the last chat you wished no one else could see. There are three questions you can ask of the person you were chatting with: (1) Would you leave the other person’s phone unlocked? (2) Do you each have a backup of that chat without a key that is recognizable to you both? (3) Has anyone in that thread ever filed a report? Based on the answers to those three questions, there are two “yes” answers that indicate the solution is behavioral and not just another toggle switch.
The Two Settings That Actually Extend the Lock
The two types of activity which impact what you’re doing are those which happen automatically and those which you must actively determine. The encryption on WhatsApp is already working, so the useful settings for privacy in WhatsApp are those which give a message a life beyond a chat. Encrypted backup will protect your messages from tampering, and you should protect your key or 64-character key, as if it were a password that you cannot recover or reset, because that is the only barrier between you and many years of message history being lost to a restore screen that offers no assistance. You should enable Advanced Privacy for the threads that you do not want to see exported (note that Advanced Privacy does not prevent a user from taking a screenshot).
Frequently Asked Questions
Can police read my WhatsApp messages?
Content that is sent or received through WhatsApp is secure because it is encrypted on your device. According to WhatsApp, once a message has been sent to you, it has already been removed from WhatsApp’s servers. If a legal request has been made for chat information, WhatsApp provides only the information regarding the chat and associated contact, the date and time of the message, and the account that used the application. Any decrypted version of the message can only be obtained from either your device or the sender’s device.
Why does WhatsApp want a 64-digit key I never created?
Encrypted backups are not automatically enabled, they require your consent to turn on. If they are enabled, WhatsApp cannot access your backup to send it, reset it, or assist you with restoring it unless you provide access to your backup by entering your passcode, password or key.
Does switching encrypted backup on protect chats I already backed up?
Only after you’ve turned the feature on will any backups of your data be generated; thus, if you have created an encrypted backup prior to turning the feature on, the prior encrypted backup will not be affected when turning the feature off. The screen provides specific details on what happens to an already encrypted backup through its own language, rather than downplaying it as part of the company policy; therefore, take the time to read the confirmation prior to tapping on the confirmation button.
Can Meta AI read my WhatsApp group chats by default?
No. The Assistant will only see messages that are sent directly to it or tagged with @Meta AI, which is the reason why the viral warning regarding chats being revealed unless a special setting is enabled was assessed and deemed false. WhatsApp classifies the Assistant as being in the “off” position until the user actively invites it to the chat.
