End-to-End Encryption (E2EE)
If you hold the keys, you can be subpoenaed. Zero-knowledge architectures prevent server compromise from becoming a data breach.
Client-Side Cryptography
In a true E2EE system, the server only routes encrypted blobs. The client generates a public/private key pair (using WebCrypto API or libsodium). The private key never leaves the device. The payload is encrypted with a symmetric key, which is then encrypted with the recipient's public key.
| Component | Role in E2EE |
|---|---|
| WebCrypto API | Generates secure random numbers and key pairs in-browser. |
| Double Ratchet | Ensures forward secrecy (used by Signal Protocol). |
| Relay Server | Stores offline messages as opaque encrypted blobs. |