WhatsApp Deploys End-to-End Encryption for Chat Backups

WhatsApp began quietly testing end-to-end encryption for chat history backups earlier this summer. Now the company is making the feature official: WhatsApp today announced that all users will be able to encrypt their chat history backups.

While WhatsApp messages have been encrypted since 2016, the app hasn’t offered end-to-end encryption of backups, which rely on iCloud or Google Drive. But with the latest update, users will be able to opt for end-to-end encryption for their backups before those backups reach their cloud storage service. Users can expect the update “in the coming weeks,” according to the company.

Once end-to-end encryption is activated, “neither WhatsApp nor the backup service provider will be able to access” the backup, WhatsApp wrote in a blog post. Backups are encrypted with a “unique, randomly generated encryption key”. Users will then be able to choose between two options: manually store the 64-digit key, or define a password, which can be used to access the key.

While this feature certainly makes backups more secure, there are a few factors to keep in mind. The first is that signing up means there will be no way to recover your backup if you lose the 64-digit encryption key (you can reset the password if you forget it). Then, even though WhatsApp recently announced support for multiple devices, you will only be able to create encrypted backups on your primary device.

It’s also worth pointing out that end-to-end encryption doesn’t guarantee that your chats will never be used in ways you might not like. This week, ProPublica posted a long article on WhatsApp’s use of human moderators who review threads reported by WhatsApp users. And earlier this year Information reported that Facebook may be looking for an AI that could one day allow it to serve ads to users based on encrypted messages (the head of WhatsApp refuse the messaging app was chasing the technology). While none of the above “breaks” the security that encryption offers – and there are many very good reasons why people should be able to report abusive messages – it’s a good reminder that privacy is more than the simple presence of end-to-end encryption.