WhatsApp adds end-to-end encryption to chat backups, locking up data in the cloud

The feature gives users a safer way to back up messages.
The recent flaw in WhatsApp does not mean encryption is a gimmick. (<a href="">Jeso Carneiro</a>/Flickr)

WhatsApp will add a feature that allows users to turn on end-to-end encryption for messages they back up to cloud providers, the Facebook-owned company announced Friday.

Since 2016, WhatsApp has offered end-to-end encryption, meaning messages are only accessible for the sender and the recipient. End-to-end encryption does not mean those messages can’t be revealed by the sender or recipient to other parties once the message is received, as a recent article by ProPublica on WhatsApp’s content moderation process underscored. The same was true for messages backed up to third-party cloud providers.

Until now, WhatsApp did not offer users a way to protect those messages upon backing them up to a third party like Google Drive or iCloud. For instance, FBI agents in 2018 proved capable of accessing WhatsApp messages from former Donald Trump presidential campaign manager Paul Manafort by obtaining a court order to search his iCloud.

Now users can choose to opt-in to encrypt backups. Decrypting the messages will require an encryption key that can only be accessed by users manually or via a password verification system. WhatsApp has security measures in place to make accounts inaccessible after a certain number of failed password attempts.


The backup encryption will be available on both iOS and Android in the coming weeks, according to WhatsApp.

Tonya Riley

Written by Tonya Riley

Tonya Riley covers privacy, surveillance and cryptocurrency for CyberScoop News. She previously wrote the Cybersecurity 202 newsletter for The Washington Post and before that worked as a fellow at Mother Jones magazine. Her work has appeared in Wired, CNBC, Esquire and other outlets. She received a BA in history from Brown University. You can reach Tonya with sensitive tips on Signal at 202-643-0931. PR pitches to Signal will be ignored and should be sent via email.

Latest Podcasts