WhatsApp encrypts every message end to end, meaning it is scrambled on the sender’s device and can only be unscrambled on the recipient’s. Nobody in between can read it — not the network, not a government requesting it, and not WhatsApp itself, which is why WhatsApp cannot produce your messages even when legally asked to.
Each device holds a private key that never leaves it. A message is locked with the recipient’s public key before it leaves your phone and can only be unlocked by their private key at the other end. WhatsApp relays the locked package without being able to open it. The practical consequence people find hardest to believe is genuine: when a court orders WhatsApp to hand over message content, it cannot, because it does not hold anything readable.
Three things, and they matter more than most people expect. Encryption ends at the device — if someone has your unlocked phone, or your backup, they have your messages in plain form. Metadata is different from content: who you messaged, when, and how often is visible to WhatsApp even though the words are not. And anything the recipient does with a message afterwards — screenshotting it, forwarding it, showing someone — is entirely outside encryption’s reach.
A chat backup leaves WhatsApp’s encryption and lands in Google Drive or iCloud under different protection. WhatsApp offers end-to-end encrypted backups as an option, secured by a password or a 64-digit key that only you hold — and losing that key means losing the backup permanently, with nobody able to recover it. That trade is the whole decision: a recoverable backup is one somebody else could theoretically be compelled to open.
Encryption is already on and needs no attention. What actually determines whether an account is safe is two-step verification — a PIN that stops someone re-registering your number even if they intercept the SMS code — and never sharing the six-digit verification code with anyone. Almost every real WhatsApp account takeover is a person being talked into forwarding that code, not an attack on the encryption.
Messages to a business are still encrypted in transit, but the business end may be a system rather than a handset — on the WhatsApp Business Platform, messages are decrypted at the business’s provider so they can appear in an inbox and a CRM. That is disclosed by design rather than hidden, and it is the correct model for a business that needs a team and a record. It does mean a conversation with a company is not private in the way a conversation with a friend is.
Yes. Every personal chat, call and media file is end-to-end encrypted by default, using keys held only on the two devices. WhatsApp relays messages it cannot read, which is why it cannot produce message content when legally required to and why your chats are absent from an account info report.
No. The keys that unlock a message exist only on the sender’s and recipient’s devices. WhatsApp can see metadata — that you messaged someone, and when — but not what was said. That distinction is real and is the honest limit of the protection.
Only if you turn on end-to-end encrypted backup. By default a backup sits in Google Drive or iCloud under those services’ protection rather than WhatsApp’s. The encrypted option is secured by a password or 64-digit key you alone hold — and if you lose it, the backup is gone permanently.
Almost never by breaking encryption. The common route is social: someone is persuaded to forward the six-digit verification code, often by a message appearing to come from a friend whose account was already taken. Two-step verification blocks this, which is why it is the one setting worth enabling today.
Encrypted in transit, but not private in the way a chat with a friend is. On the WhatsApp Business Platform the business end is a system, so messages are decrypted at their provider to appear in an inbox and a CRM. That is how a company can have several staff answer you and keep a record — it is disclosed, not hidden.
Written by Reputoo Editorial Team. Plain-English explainers of the terms that come up when a business runs on WhatsApp.
1,000+ businesses onboarded · Member of NVIDIA Inception · Official WhatsApp Business API, no per-message markup.
