End-to-end encryption

The words of a message, captions and file names, photos, videos, documents and voice notes, locations, contact cards, polls, forms and formal notices, replies, edits and reactions, and the contents of attached files, including files attached to a form.

• Keys stay on your devices. Each account and each device has its own keys, and private keys never leave a device unprotected. Other people’s apps use the public half to seal keys for you.
• Every conversation has its own key, and every message its own key derived from it. A file is sealed under a key of its own and carries a fingerprint, so a swapped file refuses to open.
• The conversation key changes when the people or devices in a conversation change. Someone removed from a conversation gets no key for anything sent afterwards.
• Notifications are written by your own phone, which opens the preview itself. We do not see the line you see.
• Reporting a message hands us that one message, with proof that it is genuine and unaltered. The rest of the conversation stays closed to us.
• Algorithms: AES-256-GCM for content, X25519 for key agreement, Ed25519 for signatures, and HKDF-SHA256 and HMAC-SHA256 for derivation. Everything also travels over TLS and is encrypted again where it is stored.

• A personal chat: the devices of the people in it.
• A conversation with a business: it belongs to the business, so its staff are at that end: the person handling it, anyone it is passed to, the business’s managers, and its owner, who can open the whole archive. Someone who leaves cannot read anything sent after they left, but keeps what they had already read.
• DOT in a browser: a browser is a companion device that your phone lets in by scanning a code. It cannot create an account identity of its own, and it keeps opened messages in memory only, so they are gone when you close the tab or log out.

• Channel updates. Anyone may follow a channel, so an update is published to the public. The channel’s key protects only the drafts and scheduled updates before they go out.
• Status posts, and reactions to them. We can read a status, because we decide who may see it and count who opened it, and a business’s status is public. A written reply to a status is an ordinary message and is sealed.
• Group calls. They pass through Cloudflare’s relay, which handles the sound and picture unsealed and does not store them. A call between two people connects phone to phone and is encrypted between the two phones.
• Group join forms. An applicant is not a member yet and holds no key, so the questions and answers reach us readable.
• A business’s internal work: team chats between staff, internal notes on a conversation, and the wording of campaigns as stored on the campaign, including after it has been sent.
• A business’s automatic greeting and away replies, which are the same words for everyone who writes to it.
• Conversations with our support team, which our staff read.

Because it sits outside the seal: who sent to whom and when, delivery and read state, which conversation a message belongs to, what kind of message it is, how large a file is and its declared type and extension, the scrambled word fingerprints that make server search possible, the scrambled fingerprint that lets us spot one message sent to many people, and the address of a link when a phone asks us to fetch its preview.

• Changed keys. When someone’s keys change, usually because they reinstalled the app, your app moves to the new keys without stopping and shows the change on that person’s contact page, not in the chat. If someone with control of our servers replaced those keys, they could read what is sent afterwards. Comparing security codes with the other person is how you can check.
• Group and business conversations. Who receives a new key comes from a list on our servers. Your app cannot check that list independently, as it can in a personal chat between two people.
• No per-message forward secrecy. One key covers many messages. If a conversation’s key were stolen, it would open every message sent under it and all earlier ones in the conversation.
• Fingerprints come from the sender’s phone. An altered copy of the app could leave its search fingerprints out, or send a wrong spam fingerprint.
• Independent review. DOT’s encryption has not yet been reviewed by an outside security firm.

There are two ways to bring your account to a new phone: approve it from a phone that is already signed in, or enter your 64-digit recovery code. Every phone account must have a code, and only you hold it. There is no recovery password.

Backup is optional. It is locked on your phone with a key worked out from your recovery key, and it goes to your own Google Drive or iCloud account. We keep no copy of that key, so neither Google, Apple nor we can open it. An iCloud backup cannot be restored on Android; to move between platforms, use Google Drive.

We are moving to a design where our servers hold a message only until it has been delivered, instead of storing sealed messages as they do today. Your devices and your own backup will then be the only place your history lives. Until then, section 5 of the Privacy Policy describes what we keep. We will update this page and tell you in the app before the change takes effect.