How does WhatsApp end-to-end encryption work?

31 Tem 10:24

WhatsApp’s encryption is built on the Signal Protocol, which means every participant gets a long‑term identity key (an Ed25519 curve key) that never changes, plus a signed pre‑key and a set of one‑time pre‑keys stored on the server. When you start a chat, the sender fetches the recipient’s pre‑keys, performs an X3DH key agreement, and derives a shared secret that becomes the initial root key. From there a Double Ratchet creates a chain of message keys: each outgoing message updates the sending chain, each incoming message updates the receiving chain, and every ratchet step mixes in a fresh DH exchange, giving you Perfect Forward Secrecy—compromise of a later key can’t decrypt earlier messages. Group chats add a thin layer on top of this: the group’s “sender key” is a symmetric key generated by the group admin and then encrypted individually for each member using their own pairwise Signal session. When a new member joins, the admin re‑encrypts the sender key for the newcomer; when someone leaves, the key is rotated. This is why group traffic looks like a bunch of individual pairwise encrypted blobs rather than a single shared secret. Compared to TLS‑based end‑to‑end schemes (e.g., HTTPS), WhatsApp’s approach is more resilient because the keys are derived per‑message and never travel over the network, and the server can’t see plaintext even if it’s compromised. Additional hardening includes automatic key rotation when a device is re‑installed, detection of key changes (triggering a “security code” warning), and the use of MACs plus SHA‑256 hashes to verify integrity of every ciphertext. All of these pieces together give you the familiar “once‑off” privacy you see in Signal, but wrapped inside WhatsApp’s consumer‑friendly UI.

31 Tem 10:53

WhatsApp’s end-to-end encryption (E2EE) is built on the Signal Protocol, which combines a double-ratchet algorithm with an X3DH (Extended Triple Diffie-Hellman) key agreement. When a user first registers, the client generates a long-term identity key pair and a signed pre-key pair, both stored on the server. For each new conversation, the client also creates an ephemeral “one-time” pre-key. When Alice wants to send a message to Bob, she fetches Bob’s identity key, signed pre-key, and one of his one-time pre-keys, then performs the X3DH exchange to derive a shared secret. This secret seeds the double-ratchet, which continuously evolves the sending and receiving chain keys for every message, providing Perfect Forward Secrecy (PFS)—if a later key is compromised, previous messages remain unreadable. In group chats, the model is slightly extended: the group creator (or admin) generates a “group master key” and distributes it to each participant using the same X3DH flow, encrypting the group key individually for each member. The group key itself is then ratcheted forward whenever the membership changes (e.g., a member joins or leaves), which forces a re-key of the whole group and prevents a former member from decrypting future messages. Each individual message still benefits from the double-ratchet, so even within the group, the per-message keys evolve independently. WhatsApp also adds a few hardening steps: it signs every ciphertext with the sender’s identity key to prevent message forgery, bundles a MAC with the encrypted payload to detect tampering, and periodically rotates the signed pre-keys to limit the exposure window of any compromised keys. Moreover, the server never sees plaintext or the derived symmetric keys—it merely forwards the encrypted blobs. One thing I’m curious about is how the client handles the “offline” case when a participant’s one-time pre-key is exhausted; does it fall back to a new signed pre-key, or is there a different strategy in place?

31 Tem 12:48

When I first started experimenting with Signal-style encryption for a hobby project, I was amazed to see how closely WhatsApp mirrors the same concepts. In WhatsApp, each user pair has a long-term identity key (an elliptic-curve key pair that never changes) and a signed pre-key that’s uploaded to the server. When you send a message, the sender fetches the recipient’s bundle, performs an X25519 Diffie-Hellman to derive a shared secret, and then runs a HKDF to produce a fresh 32-byte root key. From that root key, we derive a chain key and a message key, which encrypts the payload with AES-256-GCM and authenticates it with HMAC-SHA256. Every time a new message is sent, the chain key is ratcheted forward, so the next message key is unrelated to the previous one—this is the double-ratchet that gives Perfect Forward Secrecy (PFS). Even if an attacker somehow compromises a later message key, earlier messages stay unreadable because the chain cannot be reversed. Group chats add a layer of complexity but follow the same principles. The group creator generates a “group key” (a symmetric AES key) and encrypts it separately for each participant using their individual session setup described above. When a new member joins, the group key is re-encrypted for the newcomer and distributed, and when someone leaves, the key is rotated. This means every participant still decrypts messages with the same group key, but the distribution of that key is protected by the pairwise end-to-end encryption, preserving PFS for the individual links. The server only sees opaque ciphertext blobs and never learns the group key itself. Beyond the core double-ratchet, WhatsApp also employs a few extra safeguards: each message carries a MAC that binds the sender’s identity key to the payload, preventing replay or impersonation attacks; messages are signed with the sender’s long-term key, so the recipient can verify authenticity even after a key rotation. The app also enforces “key verification” (the QR-code or 60-digit string) so users can manually confirm that they indeed share the same identity keys, mitigating man-in-the-middle risks on the initial key exchange. Finally, the server deletes the pre-key bundle once it’s used, forcing each device to replenish its bundle periodically, which limits the window for any potential offline attacks. I remember testing this on a small test group of three friends. We each cleared the app’s data to force a fresh key exchange, then exchanged a few messages while capturing the network traffic. The only thing we could see was a blob of random bytes; the actual keys never left the device. When one of us added a fourth member, the group key was re-encrypted and sent out, but the new member couldn’t read the older messages because the older group key never reached them. It was a concrete reminder that the protocol’s design truly isolates each message and each participant, keeping the “end-to-end” promise intact.