What calling and messaging apps actually encrypt (and what they still reveal)
"Encrypted" is printed on almost every calling app. The word covers very different protections. The useful question is not whether a call is encrypted, but who holds the keys and what is left visible.
Three levels of protection
Encryption on the radio link
A normal mobile call is encrypted between your phone and the mast, so a nearby eavesdropper with a radio receiver cannot simply listen in. Once the call reaches the operator, it is decrypted and handled in the clear inside the network. The operator, and authorities with lawful access, can intercept it. Wi-Fi calling works the same way: the tunnel to your operator is encrypted, the operator's network is not end to end.
Encryption in transit to a server
Many apps encrypt traffic between your device and their servers (for example with TLS). This protects you on public Wi-Fi, but the provider can decrypt the content on its servers.
End-to-end encryption (E2EE)
With end-to-end encryption, only the devices taking part in the conversation hold the keys. The provider relays encrypted data it cannot read. This is the strongest protection for content, and the one to look for if confidentiality matters.
Which apps use end-to-end encryption for calls
| App | One-to-one calls | Source |
|---|---|---|
| Signal | End-to-end encrypted by default (Signal Protocol) | Signal technical documentation |
| End-to-end encrypted by default (based on the Signal Protocol) | WhatsApp security page and encryption white paper | |
| FaceTime | End-to-end encrypted | Apple Platform Security guide |
| Facebook Messenger | Default end-to-end encryption for personal chats and calls, rolled out from December 2023 | Meta announcement |
| Telegram | Voice and video calls are end-to-end encrypted; ordinary "cloud" chats are not, only "Secret Chats" are | Telegram FAQ |
| Regular phone call, VoLTE, Wi-Fi calling | Not end-to-end; encrypted only on parts of the path | See above |
Features change, so check the app's own documentation. Group calls, business accounts and integrations with third-party services can have different protections from one-to-one calls.
How you can verify a contact
End-to-end encryption protects you only if you are talking to the right device. Most E2EE apps let you compare a "safety number" or "security code" with your contact, in person or over another channel. If it matches, nobody is sitting in the middle. Apps also warn you when a contact's code changes, which usually just means they reinstalled the app or changed phone, but is worth confirming for sensitive conversations.
Metadata: what encryption does not hide
Even when content is unreadable, the service may know a great deal about the communication itself: who called whom, when, for how long, from which IP address, and who is in your contact list. Such metadata can be as revealing as content. Providers differ significantly here:
- Some design their systems to collect as little as possible; Signal, for example, uses a technique it calls "sealed sender" to hide the sender of a message from its own servers, and publishes the very limited data it has been able to hand over in response to legal requests.
- Others retain more account and usage information, which is described in their privacy policies and transparency reports.
- For calls, a direct peer-to-peer connection can reveal your IP address to the other party. Some apps offer an option to relay calls through their servers to hide it, at a small cost in quality.
Backups: the forgotten copy
An end-to-end encrypted conversation is only as private as its backups. If chat history is backed up to a cloud service without end-to-end encryption, the content is protected in transit but readable in the backup. Examples:
- WhatsApp offers optional end-to-end encrypted backups, which must be switched on in the backup settings.
- On iPhone, iCloud backups are end-to-end encrypted only if you enable Apple's Advanced Data Protection.
Call audio is not normally stored, but call logs and messages exchanged around a call are.
Practical steps
- For confidential conversations, use an app with default end-to-end encryption for calls, and make sure both sides have an up-to-date version.
- Verify safety numbers with the people you talk to most about sensitive matters.
- Turn on encrypted backups, or disable cloud backups for that app.
- Protect the phone itself with a strong passcode: encryption does not help if someone can unlock your device.
- Review linked devices (desktop and web sessions) regularly and remove those you no longer use.
- Remember that an ordinary phone call to a phone number is not end-to-end encrypted, whatever network carries it.
Encryption is one part of choosing a calling method. For cost and reach, see calling abroad: the options; for emergencies, see why apps cannot replace the dialler.