WhatsApp messages, voice calls, and video calls run on the Signal Protocol, an encryption design built to stop third parties and WhatsApp itself from reading the content. That fact answers the headline question only halfway.
WhatsApp safety splits into three layers: The message content, the metadata around it, and your account and device. The Signal Protocol locks down only the content layer, since the encryption design in WhatsApp’s whitepaper does not extend to the surrounding metadata. The layers around the content, from backups to the device to the person you are messaging, carry most of the risk people actually face. The platform’s scale, detailed in our WhatsApp usage data, means even rare failure modes touch millions of accounts.
Key Takeaways
- WhatsApp encrypts message content with the Signal Protocol, which is designed to prevent both third parties and WhatsApp from reading your chats and calls.
- The WhatsApp server has no access to a user’s private encryption keys, so Meta cannot decrypt the content of your messages.
- A US federal jury ordered spyware maker NSO Group to pay WhatsApp more than $167 million for unlawfully targeting more than 1,400 users’ devices with Pegasus, according to Amnesty International.
- Meta removed 6.8 million WhatsApp accounts tied to criminal scam centers over the first six months of the year, disrupting one Cambodia-based network alongside OpenAI.
- US consumers reported losing $470 million to scams that started with text messages in 2024, five times more than in 2020, according to FTC data.
- WhatsApp was the first private messaging app to offer end-to-end encryption for chat backups, though the feature is opt-in rather than on by default.
- WhatsApp now lets users lock encrypted backups with a passkey, a fingerprint, face, or screen-lock code instead of a 64-digit encryption key.
How WhatsApp Encryption Actually Works
WhatsApp’s encryption design, according to WhatsApp, rests on one protocol. WhatsApp uses the Signal Protocol, designed by Open Whisper Systems, as the basis for its end-to-end encryption, and that protocol is built to prevent third parties and WhatsApp from having plaintext access to messages or calls. The encryption also has no off switch: all chats use the same Signal protocol regardless of their end-to-end encryption status. This content layer, the first of the three safety layers, is the part of WhatsApp that holds up under scrutiny.
The same design, per WhatsApp, isolates each device. Each device carries its own set of encryption keys, and if one device’s keys are compromised, an attacker cannot use them to decrypt messages sent to the user’s other devices. The cryptographic keys are ephemeral, so even if the current keys on a device are physically compromised, they cannot decrypt previously transmitted messages. That forward-secrecy property is what separates a serious encryption design from a marketing label.
For anyone weighing the messenger against rivals, the encryption layer is the easy part of the answer. The harder questions sit one layer out, in what the protocol was never built to hide.
| Layer | What it covers | Protected by WhatsApp encryption? |
|---|---|---|
| Message content | Text, photos, voice, video, calls | Yes, via Signal Protocol |
| Metadata | Who you message, when, how often | No |
| Cloud backup | Stored chat history | Only if you enable encrypted backup |
| Device | The phone itself | No, this is on the user and OS |
Source: WhatsApp Encryption Overview whitepaper v9, 2026
Key finding: Per WhatsApp’s own encryption whitepaper, the Signal Protocol is designed so that even WhatsApp cannot read message content, and the server holds no access to a user’s private keys. The protection is real for content, which is why attackers have shifted toward the device and the human instead.
Can WhatsApp or Meta Read Your Messages?
Per WhatsApp’s whitepaper, Meta cannot read the content of your WhatsApp messages because the WhatsApp server has no access to the client’s private keys. The encryption status of an end-to-end encrypted chat also cannot change without that change being visible to the user through a system message. The common belief that “Meta reads everything you send on WhatsApp” does not match how the system is built.
The accurate framing is narrower. Meta cannot see what you say, but it can see a great deal about how you behave, and chats with businesses that hand their endpoint to a third-party vendor are a separate case. When a business runs its WhatsApp Business endpoint through a vendor, that vendor has access to the business’s private keys, including when that vendor is Meta. A message to a company is not always the same privacy bargain as a message to a friend.
The Metadata Gap WhatsApp Does Not Encrypt
Per WhatsApp’s encryption whitepaper, the Signal Protocol protects message and call content, but that protection does not extend to the surrounding metadata about who is contacting whom. Metadata is the privacy weak point, and it sits outside the encryption entirely. Encryption hides the letter, not the envelope.
WhatsApp and Signal diverge sharply here despite sharing the same underlying protocol. The contents are equally protected; the data exhaust around them is not. Meta has itself described WhatsApp as a private end-to-end encrypted app alongside Signal when defending users against spyware abuse, a framing that speaks to the content layer rather than the metadata layer.
For most users, the practical takeaway is simple: the words are private, the pattern of who you talk to is far less so. Readers tracking how this plays out across platforms can compare the broader picture in our cybersecurity threat data.
Are WhatsApp Backups Secure?
Backups are the layer most users get wrong. WhatsApp was the first private messaging app to offer end-to-end encryption for chat backups, so old messages can stay with the user rather than sitting readable in the cloud. Crucially, this protection is opt-in rather than on by default, so a backup left at the default setting can be far less protected than the live chat it copies.
To make that protection easier to use, passkeys now let people lock encrypted backups with a fingerprint, face, or screen-lock code instead of memorizing a 64-digit encryption key. The passkey-encrypted backup feature is being rolled out gradually over the coming weeks and months rather than switched on everywhere at once. Turning on encrypted backups, then securing them with a passkey, helps reduce the risk that an old chat history becomes the soft spot in an otherwise locked-down account.
The takeaway: Enabling encrypted backups closes a gap that the live chat already covers. Until a user opts in, the backup is the layer an attacker is most likely to reach without ever breaking the Signal Protocol, which is why the default-off design matters more than the cryptography itself.
Spyware and the Pegasus Threat
A US federal jury ruled on 6 May that spyware maker NSO Group must pay more than $167 million in damages to WhatsApp for unlawfully targeting more than 1,400 users’ devices with Pegasus spyware. The hardest threat to encryption is the one that ignores it entirely. Meta said it detected and stopped that attack, which used the Pegasus tool to target over a thousand WhatsApp users, including human rights activists, journalists, and diplomats.
Pegasus is instructive because of how it operates. Spyware that compromises the phone reads messages after they are decrypted on screen, so it sidesteps end-to-end encryption rather than breaking it. NSO Group has been implicated in severe human rights violations against civil society, including journalists and activists, globally.
Ordinary users rarely face a Pegasus-grade operation, which is expensive and narrowly targeted. The lesson still generalizes: a compromised device defeats any messenger, so device hygiene belongs inside WhatsApp safety. Our reporting on social-engineering channels, including voice phishing data, shows attackers going around the encryption rather than through it.
Scams Are the Bigger Everyday Risk
Meta said it removed 6.8 million WhatsApp accounts linked to criminal scam centers over the first six months of the year, and disrupted a Cambodia-based campaign in partnership with OpenAI. For most people, the real danger is a convincing message rather than a broken cipher. Separately, the Federal Trade Commission reported that US consumers lost $470 million to scams that started with text messages in 2024, five times more than in 2020. The FTC figure spans all text-based scams, not WhatsApp alone, but it sizes the channel attackers now favor, a shift visible across our cybersecurity attack data.
| Threat signal | Figure | Source |
|---|---|---|
| Scam-linked WhatsApp accounts removed (H1 2025) | 6.8 million | Meta enforcement statement |
| Reported losses to text-based scams (2024) | $470 million | FTC Consumer Sentinel |
| Multiple vs 2020 text-scam losses | 5x | FTC |
Source: Meta enforcement statement (2025); Federal Trade Commission, 2024
To counter this, Meta introduced a safety overview that appears when someone who is not in a user’s contacts adds them to a group, plus alerts that prompt people to pause before responding. These tools help reduce exposure to organized scam networks, though they depend on the user actually slowing down.
Why it matters: The dominant threat has shifted. With millions of scam-linked accounts pulled in a single half-year, social engineering reaches far more WhatsApp users than interception ever does. Strong encryption does nothing against a message you were tricked into trusting, which reframes “is WhatsApp safe” as partly a question about the person on the other end.
Is WhatsApp Safer Than Signal or Telegram?
The comparison turns on metadata, not message security. WhatsApp and Signal both rely on the Signal Protocol for message content, so the cryptographic protection of what you actually say is comparable between them. Where they part ways is in how much surrounding data each service keeps, and that is the axis privacy-focused users care about most.
Meta groups WhatsApp with Signal as a private end-to-end encrypted app, a framing that holds for content protection. Telegram sits differently again, because its default cloud chats are not end-to-end encrypted at all. Our editorial view is that the honest ranking depends on the threat you are defending against: for content secrecy the gap between WhatsApp and Signal is small, while for metadata minimization Signal leads.
How to Make WhatsApp Safer
A few settings move WhatsApp from default-safe to hardened. Turning on end-to-end encrypted backups closes the gap left by an unencrypted cloud copy, since the feature is opt-in rather than automatic. Locking that backup with a passkey, using a fingerprint, face, or screen-lock code, adds protection without a 64-digit key to memorize.
Beyond backups, the highest-value habits address the human and device layers where attackers concentrate their effort. Paying attention to the safety overview Meta now shows when an unknown contact adds you to a group helps reduce exposure to scam networks. Pairing that with two-step verification, prompt operating-system updates that close spyware footholds, and basic skepticism toward unexpected money or login requests covers the layers the Signal Protocol was never meant to defend. None of this guarantees safety, but each step removes an avenue attackers rely on.
Is WhatsApp Safe to Use for Sensitive Information?
WhatsApp is reasonably safe for sensitive personal conversations, with caveats. The Signal Protocol is designed to keep message content unreadable to third parties and to WhatsApp, so the content of a sensitive chat stays protected in transit and on the server. The exposure comes from metadata, an unencrypted backup, or a compromised device rather than the message itself. For highly targeted threat models, a metadata-minimizing app remains the stricter choice.
Conclusion
WhatsApp’s encryption is the strong link in the chain. The Signal Protocol is designed so that neither third parties nor WhatsApp can read message content, and the server holds no access to private keys. The risks that matter cluster around it: metadata the encryption never covered, backups that stay exposed until you opt in, scams that reached the platform hard enough for Meta to pull 6.8 million accounts in six months, and spyware serious enough to cost NSO Group more than $167 million in court.
Reading WhatsApp safety as a question about settings and behavior, alongside cryptography, is the accurate way to weigh it. The layers a user controls are where the current-year gains are easiest to claim.
