Skip to content

What is End-to-end encryption?

End-to-end encryption is a design in which a message is encrypted on the sending device and decrypted only on the receiving devices, so that the server carrying it holds no key that can open it.

Updated

  • E2EE
The keys live on the devices. The server carries ciphertext it cannot open.

Encryption

End-to-end encryption, explained

The defining property is not the strength of the cipher but the location of the key. Almost every service encrypts data in transit with TLS and at rest with disk or column encryption, and in both cases the server holds the key — which means the operator can read the content, and so can anybody who compels or compromises the operator. End-to-end encryption removes that possibility by never giving the server a key in the first place.

How Enclessa uses it

Enclessa end-to-end encrypts direct messages and group direct messages using MLS per RFC 9420. Group channels are managed by default: rooms the server can read, which is what makes search, retention and export work on them. An organisation can permit end-to-end encrypted channels, chosen per channel at creation, and such a channel gives up server-side search, export, retention that reads content, bots and quotes in notification mail. Enclessa’s own implementation has had no external audit. Which mode a room uses is fixed when the room is created and displayed in the room itself, so nobody has to guess which guarantee applies.