- What WhatsApp encrypts without you touching a thing
- Where the encryption runs out
- If you run a business on WhatsApp, read this bit
- How to check a chat is encrypted
- Backups are the quiet gap
- The bigger risk is your account, not the maths
- Privacy defaults I'd change
- My verdict on WhatsApp safety
- Frequently asked questions
For personal chats, yes: WhatsApp says messages and calls between you and another person are end-to-end encrypted by default, so nobody outside the chat, not even WhatsApp, can read or listen to them. The protection stops at three places you control or choose: your own account, your backups, and chats with businesses that use optional Meta services, so those are what I'd lock down.
What WhatsApp encrypts without you touching a thing
WhatsApp says its end-to-end encryption covers messages, photos, videos, voice messages, documents, live location, status updates and calls when you chat with another person. Only you and the recipient hold the key, and there's no setting to switch on.
Under the bonnet it's the Signal encryption protocol, and WhatsApp says encryption and decryption happen entirely on your device, with keys that change with every message sent. If you want the term itself unpacked, I've covered what end-to-end encrypted means on WhatsApp separately. This page is about the other half of the question: where that protection runs out.
One more line from WhatsApp worth knowing. It says it can't and doesn't hand over the content of end-to-end encrypted messages when governments ask. Depending on the request, it may provide basic subscriber and account details, such as your name, IP address, device type, profile photos and contacts list. So the words are sealed; the facts about your account aren't.
Where the encryption runs out
As of Nov 2026, WhatsApp's own help pages list several situations where the default doesn't apply, or applies with a catch. This is the table I'd keep in my head:
| What you're doing | Encrypted end to end? | The catch |
|---|---|---|
| Chatting or calling one person | Yes, by default, WhatsApp says | The other person keeps a copy and can forward it |
| Chatting with a business on the WhatsApp Business app | Yes, by default, WhatsApp says | Once it lands, the business's own privacy practices apply, and it can use the chat for its own marketing |
| Chatting with a business that uses Meta to store messages, or shows "uses AI from Meta" | No, WhatsApp doesn't consider these end-to-end encrypted | WhatsApp says it shows this clearly in the chat |
| Chatting with a third-party agent | No | A Meta service manages the conversation on the agent's behalf |
| Sending a payment, in select countries | No | Financial institutions need the payment details; card and bank numbers are stored encrypted |
| Backing up to your Google Account | Only if you switch it on | WhatsApp can't recover an encrypted backup if you lose the key |
| WhatsApp cloud storage backup (new, may not be available yet) | Always, WhatsApp says | Same rule: lose the key and you lose the backup |
I'd read the business rows twice. WhatsApp says a business that receives your message can let employees or vendors process it and reply, and may use the chats it receives for its own marketing, including advertising on Meta. It also says Meta doesn't automatically use the messages you send a business to inform the ads you see, and that a chat's encryption status can't change without you being able to see it.
If you run a business on WhatsApp, read this bit
Flip that table around and it's about you. When a customer messages your business, encryption gets the message to you safely. After that, it sits under your practices: who on your team can read it, which vendor or tool processes it, and whether you use it in marketing. WhatsApp makes that point itself.
So the question has two answers for a business owner. It's safe in transit. Whether it's safe once it's on your side depends on the choices you make. If you switch on optional Meta services or AI from Meta for your business chats, WhatsApp says those messages are no longer considered end-to-end encrypted, and it labels them in the chat. Your customers will see that label, so decide on purpose rather than by accident.
The same goes for anything you send out. WhatsApp's safety page reminds people that when you share a chat, photo, video, file or voice message, the other person has a copy and can forward or share it. Encryption protects the pipe, not what someone does with the message once it arrives. I'd never send anything on WhatsApp you'd be upset to see screenshotted.
How to check a chat is encrypted
Verification is optional, but it's quick, and it's the one way to see the protection for yourself rather than taking it on trust. As of Nov 2026, WhatsApp describes it like this:
- Open the chat with the person.
- Tap their name at the top of the chat.
- Tap Encryption.
- Let the automatic check run. WhatsApp calls this key transparency.
- If you'd like the manual option, compare the QR code or the 60-digit number, either in person or by sending the number over another platform.
Two things to know. If a contact reinstalls WhatsApp, changes phone or adds or removes a paired device, you may see a notice that their security code changed. And if either of you uses several devices, WhatsApp says to verify on all of them.
Backups are the quiet gap
Here's what most people miss. Your chats can be encrypted end to end on the phone and then sit in a backup that isn't, unless you've switched the encrypted backup on. WhatsApp says encrypted backups are protected by a passkey, a password or a 64-digit encryption key. Its newer WhatsApp cloud storage backups, which may not be available to you yet and include 2 GB on free accounts, are always end-to-end encrypted.
For backups to your Google Account, WhatsApp gives this path as of Nov 2026:
- Open WhatsApp and go to Settings.
- Tap Chats, then Chat Backup.
- Tap End-to-end encrypted backup.
- Follow the prompts to set a passkey, a password or a key.
- Store that password or key somewhere safe that isn't your phone.
That last step matters more than it looks. WhatsApp says you can't restore an encrypted backup without the password, key or passkey, and it can't send you a copy, reset it or restore it for you. Turning the feature off or creating a new passkey won't open an existing encrypted backup either. Lose the key and that backup's gone.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
The bigger risk is your account, not the maths
WhatsApp's own pages point the same way: the realistic threat isn't someone cracking the encryption, it's someone getting into your account or your phone. Its spyware page says attackers look for weaknesses in apps or the phone's operating system, or trick people into clicking malicious links or downloading malware. How takeovers happen in practice is its own topic, and I've unpicked it in can WhatsApp be hacked.
The single rule I'd give every team: never share your verification code. WhatsApp says you get a push notification when someone tries to register WhatsApp with your number. Often it's another user who mistyped, sometimes it's a takeover attempt, and without the SMS code they can't finish. Because messages live on your device, WhatsApp says someone on another device can't read your past conversations.
Then add layers. WhatsApp's account security tips list these:
- An email address on your account, so you can recover it without SMS.
- Two-step verification, which I walk through in setting up WhatsApp two-step verification.
- A passkey, which uses your fingerprint, face or screen lock. WhatsApp says your biometric data never leaves your device.
- App lock and chat lock, which put extra authentication in front of the app or individual chats.
- Strict account settings, which WhatsApp says are built for people who may face elevated risk.
The catch WhatsApp is honest about: you need access to your account to turn these on, and they can't throw out someone who's already using it. Setting or changing a password won't remove an intruder. If that's happened, recover the account first, then lock it down. WhatsApp also recommends everyone runs its Privacy Checkup.
Privacy defaults I'd change
Out of the box, as of Nov 2026, WhatsApp says any user can see your profile photo, read receipts and when you're online; your contacts see your status updates, About and last seen; anyone can add you to groups; and anyone can call you. I'd change the group setting first: you can limit it to My contacts or My contacts except. When someone outside your contacts adds you to a group, WhatsApp shows the group info and lets you stay, exit or report, and a report sends WhatsApp up to five of the last messages.
Read receipts can be switched off, though WhatsApp says they're always sent in groups. When a stranger messages first, WhatsApp shows details so you can block or report them. For what strangers tend to want, see the WhatsApp scams to watch for.
My verdict on WhatsApp safety
WhatsApp is safe for everyday personal chats, and you don't have to do anything to get the encryption. I'd spend a short sit-down on the parts it doesn't cover: switch on the encrypted backup and store the key, add two-step verification and a passkey, and tighten who can add you to groups. Skip Strict account settings unless you believe you may be targeted, because that's who WhatsApp built it for. And if you run a business, remember the encryption ends at your inbox; what happens after that is down to you.
If customers reach your business on WhatsApp, getting these settings right is a small part of the customer messaging and automation work I help teams with. I run AI training and workshops for teams, and help businesses with AI enablement and workflow automation, so the busywork runs itself and people get time back. Most of that work is with SaaS marketing teams and small businesses. Here's how we can work together.
Frequently asked questions
Can WhatsApp read my messages?
WhatsApp says no for personal chats: they're end-to-end encrypted by default and only you and the other person hold the key. The exceptions it lists are chats with businesses using optional Meta services, third-party agents and payments.
Are WhatsApp backups encrypted?
Only if you switch it on for Google Account backups, WhatsApp says, while its newer WhatsApp cloud storage backups are always end-to-end encrypted. Either way, WhatsApp can't recover an encrypted backup if you lose the password, key or passkey.
Is WhatsApp safe for business chats?
WhatsApp says chats with businesses on the Business app are end-to-end encrypted by default, but once a business receives a message its own privacy practices apply, and chats that use optional Meta services aren't considered end-to-end encrypted.
What's the biggest WhatsApp safety risk?
Losing control of your account. Never share your verification code, and add two-step verification and a passkey while you still have access, because WhatsApp says these can't remove someone who's already in.
