WhatsApp already encrypts every personal chat end to end, by default, with the Signal protocol, so WhatsApp cannot read your messages in transit. The gaps are elsewhere: a chat backup in iCloud or Google Drive is only end-to-end encrypted if you switch that on, an unlocked or seized phone shows everything, and Meta keeps the metadata. HushHush encrypts the text on your phone with its own keys before WhatsApp sees it, so WhatsApp, its backups and anyone holding the phone get ciphertext.
What WhatsApp can and cannot see
WhatsApp's help page is clear. Every personal chat and call is end-to-end encrypted, automatically, using the Signal protocol; no one outside the chat, “not even WhatsApp, can read, listen to, or share them”. The keys change with every message. You can confirm it for any one chat by comparing the 60-digit security code with the other person. That is a strong, well-studied design, and this page does not pretend otherwise.
The exceptions are spelled out on the same page. Chats with a business that uses Meta's optional services, for example letting Meta host its messages or answer with Meta's AI, are not considered end-to-end encrypted. Nor are chats with third-party agents, or payments. Your personal chats are not affected by any of that.
Backups are where most people's protection quietly ends. WhatsApp's end-to-end encryption covers the message in transit and on the two phones. The copy in your iCloud or Google Account backup is covered only if you have turned on end-to-end encrypted backup, a separate setting protected by a passkey, a password or a 64-digit key. If you have not, that backup sits with Apple or Google under their rules. So does your contact's backup of the same chat, which your settings cannot touch.
Metadata is never encrypted. WhatsApp's privacy policy says it collects how you interact with others, including the time, frequency and duration, along with device and connection details, and that it shares information with the other Meta companies. It does not keep delivered messages. It does keep the record of who talked to whom.
| What | WhatsApp today | With HushHush |
|---|---|---|
| The words you type | Not readable by WhatsApp in personal chats | Ciphertext only |
| Who you message, and when | Yes | Still yes |
| Chat backups in iCloud or Google Drive | Not covered unless you turn on encrypted backup | Ciphertext only |
| An unlocked, borrowed or seized phone | Every chat on screen | Locked behind its own password |
Why this matters: backups, borrowed phones and trusting one company
Think about where a WhatsApp message actually lives. In transit it is protected. On your phone it is behind your screen lock, and on your contact's phone behind theirs. In the two backups it is whatever each of you happened to set. A court order to Apple or Google for a backup, an account recovery by someone who guessed a password, or a phone handed over at a border all reach the plain text without touching WhatsApp's encryption at all.
A borrowed phone is the everyday version. WhatsApp opens to the chat list. Anyone who holds the unlocked phone for a minute, a partner, a colleague, an officer, reads whatever is there. HushHush keeps its own encrypted store behind its own password, with an auto-lock timer, so the ciphertext sitting in WhatsApp is all they get.
Then there is the question of who holds the design. WhatsApp's encryption is written, keyed and updated by Meta's app, and a change to that app changes it for everyone at once. HushHush's keys were made on your two phones at the moment you paired and have never touched a Meta server. Someone who wanted the text would have to defeat both, independently. What HushHush does not change is the metadata: Meta keeps that either way.
How HushHush helps
HushHush encrypts the text on your phone before WhatsApp sees it, with four ciphers in a shuffled order and keys that exist only on the two phones. WhatsApp carries the ciphertext, encrypts it again in transit as it always does, and both backups store the ciphertext. The other person decrypts it in their HushHush. Both of you need the app, and you pair once, in person, by scanning each other's QR code. No account, no phone number, no server of ours.
Pair once, in person
Open HushHush, add a contact, and scan the QR code on the other phone. No account, no phone number, no server.
Type it in HushHush
Write the message and tap send. It is encrypted on your phone and copied as ciphertext.
Paste it into WhatsApp
WhatsApp carries the ciphertext, and so does every backup of the chat. Your contact copies it and taps Paste in HushHush to read it.
What HushHush does not do. It does not hide who you talk to or when: WhatsApp and Meta still see the two accounts, the time of every message, how often you write and how long the ciphertext is. It does not change or replace WhatsApp's own encryption, and it is not a reason to skip turning on encrypted backups. Both people need HushHush. It protects text, not WhatsApp's calls, voice notes or photos.
Frequently asked questions
Can WhatsApp read my messages?
Are WhatsApp backups encrypted?
Can police read WhatsApp messages?
Does WhatsApp share my data with Meta?
How do I check that a WhatsApp chat is end-to-end encrypted?
Encrypt it before WhatsApp sees it.
HushHush is on the App Store and Google Play. Pair in person, then send in any app.
Related
Sources
- About end-to-end encryption, WhatsApp Help Center, accessed 7 October 2026.
- About end-to-end encrypted backup, WhatsApp Help Center, accessed 7 October 2026.
- WhatsApp Privacy Policy, WhatsApp, accessed 7 October 2026.
- WhatsApp Privacy, WhatsApp, accessed 7 October 2026.