What end-to-end encryption actually is

End-to-end encryption (often written as E2EE) is a way of sending messages so that only the sender and the recipient can read them. Not the app company. Not an internet provider. Not an attacker who intercepts the data. Only the two people talking.

If you use a messenger that says it's end-to-end encrypted, it means the message is scrambled on your device into unreadable ciphertext, travels in that scrambled form, and is only unscrambled on the recipient's device. The server in the middle — the company running the app — never sees the readable message.

It's the difference between sending a postcard and sending a sealed, locked box. A postcard can be read by anyone who handles it. A locked box can only be opened by someone with the key.

Encryption in transit vs end-to-end

There's a common point of confusion here. Encryption in transit (the kind behind the padlock in your browser's address bar) protects data while it travels over the internet. But it protects the data from other people on the network — not from the server you're talking to.

Here's the key difference:

• Encryption in transit: the server receives your message and can read it. It chooses to store it, analyze it, or share it.
• End-to-end encryption: the server receives your message and cannot read it from storage. It holds ciphertext, not a readable copy.

Many popular messaging apps use encryption in transit as a default, or make end-to-end encryption an option you have to switch on. In Markero, end-to-end encryption is the only mode — there's no plaintext mode to enable or disable.

How E2EE works, without the jargon

You don't need a degree in cryptography to use it — but understanding the basics helps you trust it. Here's the short version:

1. Each person gets a pair of keys. A private key (kept secret, never shared) and a public key (shared freely, like an address).
2. You lock a message with the recipient's public key. Once locked, only their private key can unlock it.
3. The scrambled message travels through the server. The server could be hacked, subpoenaed, or curious — it still sees only ciphertext.
4. The recipient unlocks it with their private key. Their device is the only place the message becomes readable again.

Markero uses PGP with a Curve25519 keypair. Your private key is encrypted with a client-only key-wrap secret, which is itself encrypted with your password. The login TOTP secret is separate and is used only to verify sign-in codes — it does not unlock the private key.

Why "zero access" matters

"Zero access" is the strongest form of end-to-end encryption. It means the service provider has no technical way to read your messages — not just a policy saying they won't.

That distinction matters more than most people realize:

• An app with "encryption in transit" can read your messages and can be compelled to hand them over.
• An app with end-to-end encryption could in theory read messages if it also held the keys — some apps keep a copy of your keys on their servers.
• An app with zero access never sees usable keys or plaintext, so there is literally nothing to hand over.

What E2EE protects — and what it doesn't

Being honest about the limits of E2EE is important, because no security tool is a magic shield.

What end-to-end encryption protects

• Message content — the words, photos, files and voice messages you send.
• Data at rest — even if server storage is compromised, stored ciphertext is unreadable.
• Interception — messages are meaningless to anyone who captures them mid-flight.

What it doesn't protect

• Metadata — who you talk to and when can sometimes be visible, even if the content is private.
• Your device — if someone steals your unlocked phone, they see your messages. That's why locking your device matters.
• You — if you're tricked into giving someone your password and 2FA code, they can sign in as you. Never share them.

Markero reduces even some of this: because sign-up requires only a username (no email or phone number), there's no personal identifier tying your account to your real-world identity.

Frequently asked questions

Is end-to-end encryption the same as encryption in transit?

No. Encryption in transit protects data while travelling, but the server can still read it. End-to-end encryption means only the sender and recipient have the keys — the server only ever stores scrambled ciphertext.

Can the government or police read end-to-end encrypted messages?

With true zero-access encryption, there is nothing to hand over. Because the provider never holds plaintext or usable decryption keys, it cannot decrypt messages — even under legal compulsion.

Does end-to-end encryption slow down messaging?

No. Modern encryption like Curve25519 adds only milliseconds of delay, which is imperceptible in chat and voice calls. You won't notice it's there.

What happens if I lose my device?

Your private key is encrypted before it is stored, so a new device needs your password and, if enabled, your sign-in code or a recovery code to regain access. Markero provides recovery codes as a backup for the authenticator. TOTP protects account sign-in; it does not encrypt or unlock the private key.