Is WhatsApp safe?

Based on WhatsApp's own help pages and privacy policy:

• Personal chats, group chats and calls: end-to-end encrypted by default. Not even WhatsApp can read them.
• Chat backups in iCloud or Google Drive: only end-to-end encrypted if you turn that on.
• Chats with businesses that use Meta's hosting: not end-to-end encrypted, as WhatsApp itself says.
• Your phone number: always needed to sign up, and it's how people find and see you.

So for everyday chatting, WhatsApp's encryption is solid. The gaps are around the edges, and they're easy to miss.

Yes. WhatsApp uses the Signal Protocol, the same one Signal and Morse use. In WhatsApp's own words, it all happens automatically, with no need to turn on any special settings. That covers your messages, photos, videos, voice messages and calls, in one-on-one chats and in groups.

It also works on linked devices, like WhatsApp on your laptop: each device connects on its own and keeps the chats end-to-end encrypted. But end-to-end encryption only covers the trip between devices. As the picture below shows, it doesn't reach everywhere your messages can end up.

Curious how the locking itself works? Here's how end-to-end encryption works.

WhatsApp voice and video calls are end-to-end encrypted, so nobody can listen in along the way, WhatsApp included.

But encryption only protects the call while it travels. Anyone on the call can still record it with another app or a second device, and no messaging app can stop that. The same goes for screenshots of your chats. Encryption protects you from outsiders, not from the people you're talking to.

This is the biggest gap. WhatsApp can back up your chat history to iCloud on an iPhone or Google Drive on Android. By default, those backups aren't protected by WhatsApp's end-to-end encryption. They sit in your Apple or Google account, protected by that company's security instead.

So a message that was end-to-end encrypted on its way to you can end up in a backup that isn't. If someone gets into your Apple or Google account, your chat history may be within reach. The fix is a setting called end-to-end encrypted backup, and it takes about a minute.

Here's how, according to WhatsApp's help pages:

1. 1Open WhatsApp Settings and tap Chats, then Chat backup.
2. 2Tap End-to-end encrypted backup.
3. 3Choose to use a passkey, or tap More options to use a password or a 64-digit encryption key.
4. 4Tap Create. Keep that password or key somewhere safe, because you'll need it to restore your chats.

From then on, your backups are locked with something only you have, just like your chats.

Usually, chatting with a business works like chatting with a friend. But some businesses use Meta's hosting service to handle their WhatsApp chats, and WhatsApp says it doesn't consider those chats end-to-end encrypted.

You can spot them: WhatsApp shows a notice in the chat saying "This business uses a secure service from Meta to manage this chat." When you see that, treat the chat as not private between just you and the business.

Not your regular chats. WhatsApp says Meta AI can only read messages you send to it, messages that mention @MetaAI, and messages you choose to share with it. Your other personal chats stay end-to-end encrypted.

For features like message summaries, WhatsApp says it uses a system called Private Processing, built so that Meta can't read what you share. Still, keep in mind that anything you type to Meta AI itself is a conversation with Meta, not an end-to-end encrypted chat with a friend.

The encryption itself is very hard to break. Most WhatsApp "hacks" go around it instead, and they usually start with a message. The most common tricks:

• A message from an "old friend" or "WhatsApp support" asking you to forward the six-digit code you just received. That code is what lets someone register your number on their phone.
• "Hi Mum, I lost my phone, this is my new number", followed by an urgent request for money.
• A link to a fake login page or a fake prize, made to look like it comes from WhatsApp.
• A SIM swap, where someone convinces your mobile carrier to move your number to their SIM card.

In each case, nobody breaks the encryption. They take over the account or the person instead. That's why the settings below matter so much: two-step verification alone stops most account takeovers, because a stolen code isn't enough anymore.

It's also one of the reasons Morse works without a phone number: there are no text message codes to steal and no SIM swap to worry about.

Yes, if they get hold of your unlocked phone for a minute. WhatsApp lets you link a computer by scanning a QR code, so someone with your phone could link their own laptop and read along from then on.

The fix is easy: open Linked devices in WhatsApp's settings now and then, and log out anything you don't recognize. Together with app lock, that closes this door.

Your messages can't be read along the way. But WhatsApp does collect information around them. Its privacy policy lists things like information about your activity on the app, your IP address and device identifiers, and it says it uses your IP address and phone number area code to estimate your general location, like your city and country.

WhatsApp also says it doesn't keep your messages on its servers in the ordinary course of things: they're stored on your device. So the content is protected, while information about how and when you use the app is not covered by the encryption. That's what people mean by metadata.

Yes. Regular text messages (SMS) aren't end-to-end encrypted. They pass through your mobile carrier in a form the carrier can read, and they're tied to your phone number by design.

WhatsApp messages are end-to-end encrypted, so only you and the other person can read them. If you're choosing between a text message and WhatsApp for something private, WhatsApp is the better pick, and an app that also doesn't need your number is better still.

No. You need a phone number to create a WhatsApp account. WhatsApp announced usernames in June 2026 and is rolling them out step by step, so you'll be able to chat with people without handing out your number. But the account itself still starts with a phone number, and people who already have your number saved still see it.

If you'd rather not tie your messaging to a phone number at all, have a look at messaging without a phone number.

If you're staying on WhatsApp, these are worth a few minutes:

• Turn on two-step verification, so a stolen text message code isn't enough to take over your account.
• Turn on end-to-end encrypted backup, as described above.
• Use app lock and chat lock, with your phone's fingerprint or face unlock, so a borrowed phone doesn't open your chats.
• Run WhatsApp's privacy checkup to decide who can see your profile photo, last seen and more.
• If you're at higher risk, for example as a journalist, look at WhatsApp's strict account settings.

How WhatsApp's defaults compare with the other apps people often consider:

WhatsApp got one big thing right: end-to-end encryption by default. Morse does that too, for every chat, group, photo, voice note and one-on-one call, using the same Signal Protocol, with post-quantum key exchange (ML-KEM) on top.

Where Morse is different is everything around it. You don't need a phone number or email to sign up: you get a short Morse ID, and you decide who gets it. There are no ads, because Morse is paid for by the people who use it. And there's no text message code that someone could talk you into sharing.

Curious how they compare in detail? Here's WhatsApp vs Morse, side by side.