The lock on your WhatsApp is published for anyone to read

The WhatsApp messages you sent your family today were locked with a design that is published for anyone to read. Only the keys are secret. The design is on Signal's website, with its authors named on the first page. WhatsApp uses it, and Meta says WhatsApp has more than 3 billion monthly users (April 2025).

That sounds backwards. A lock is supposed to be secret. This one stays safe even though the design is public, because the keys are not.

Your phone locks the message, and only the other phone can open it

WhatsApp calls this end-to-end encryption, and describes it in its own technical paper. In plain terms:

1. When you install WhatsApp, your phone makes its own keys. It sends WhatsApp only the public half, which works like an open padlock that anyone can snap shut. The only key that opens it stays on your phone.
2. Your phone locks each message before it leaves. It fetches the other person's padlock and locks the message with it. Photos, videos, voice notes and files are locked the same way before upload.
3. WhatsApp's servers pass the message along without being able to open it. WhatsApp's paper says the design is meant to stop "third parties and WhatsApp" from reading messages. Once a message is delivered, WhatsApp's privacy policy says it is deleted from its servers. If the other phone is offline, the locked message is held for up to 30 days while WhatsApp tries to deliver it.
4. The key changes with every message. Each message gets a new, short-lived key. WhatsApp's paper says that even if the keys on a phone are stolen today, they "cannot be used to decrypt previously transmitted messages."

There is a second lock around the connection between your phone and WhatsApp's servers. It uses a method called Noise, which hides some details of your connection from anyone watching the network.

Two people wrote it down

The method is the Signal Protocol, developed from 2013 onward by Open Whisper Systems, the group that makes the Signal app. Its two core documents name their authors: Moxie Marlinspike and Trevor Perrin. Rolfe Schmidt joined as an author on later revisions of one of them. In 2017 the two shared the Levchin Prize for Real-World Cryptography, "for the development and wide deployment of the Signal protocol."

Perrin also wrote Noise, the connection lock above, so his work sits in WhatsApp twice.

WhatsApp started using the protocol in November 2014, on Android and for one-to-one text only. On 5 April 2016 both companies announced the switch was complete: chats, group chats, calls, photos, videos, files and voice messages, locked by default on every up-to-date app.

The design is public, and Signal's own code, libsignal, is published under an open-source licence (AGPL-3.0). WhatsApp's app is not open source, and no source we found says WhatsApp runs Signal's code. WhatsApp uses the design.

A very small team behind it

In February 2018, Marlinspike wrote that Signal had averaged 2.3 full-time software developers, and the whole team had "never been more than 7 people." The same post launched the Signal Foundation, a non-profit Marlinspike started with Brian Acton, a co-founder of WhatsApp. Signal said it began with initial funding of US$50 million from Acton. Signal later called that money "a generous initial loan from Brian Acton." By 2022 Marlinspike said the team was about 30 people. In 2023 Signal put its infrastructure costs at roughly US$14 million a year, and said it is supported by donations.

What the lock does not cover

Who, when and how often. The lock protects what you say. WhatsApp's privacy policy says it still collects how you interact with others, including the time, frequency and duration, plus group names and pictures, your phone number, IP address and device details.

Your backups, unless you switched them on. Backups to Google Drive or iCloud are protected by those cloud accounts. End-to-end encrypted backup has been an optional setting since October 2021, and in 2025 WhatsApp made it easier with passkeys. We found no source saying it is now on by default, so check: Settings, Chats, Chat backup, End-to-end encrypted backup.

Chats with some businesses. WhatsApp's paper says it "does not consider… communications with businesses using Cloud API, to be end-to-end encrypted." If a business hands its WhatsApp system to an outside vendor, WhatsApp says those messages are not end-to-end encrypted either, and the vendor "will have access to their private keys", and WhatsApp's paper adds that this applies even when that vendor is Meta. Customers see a system message in the chat when this applies.

The person you sent it to. They can screenshot or forward anything you send.

What this means for your business

If your company answers customers on WhatsApp through a chatbot, a customer-management system or a vendor's platform, those chats may sit outside the lock your personal chats get. That can be a sensible trade for a team that needs shared inboxes and automation. It should be a decision someone made on purpose.

Ask your provider who can read these chats and where they are kept. Then check your own phone's backup setting.

We found no authoritative source on how Malaysian law treats business chats on WhatsApp, so this piece makes no legal claim. Ask your adviser if that matters to you.