What End-to-End Encryption Actually Protects

End-to-end encryption is real. It also gets misused constantly in marketing. Vendors slap it on their homepage and imply total privacy. What it actually does is specific — and knowing where it stops is what matters when you're evaluating tools for your product or your users' data.

Here's the structural difference. With true end-to-end encryption, data is encrypted on your device before it leaves. The server relays ciphertext it can't read. Only the recipient's device decrypts it. With in-transit-only encryption — which most services actually use — data is encrypted between you and the server, but the server decrypts it, reads it, stores it, and re-encrypts it outbound. The server has full access.

What's actually protected in each model? Both encrypt data in transit — so a network attacker can't intercept it. True E2E also means the server never sees plaintext. But even E2E doesn't hide metadata: who you're talking to, when, how often. And it does nothing if the endpoint device is compromised. In-transit-only means your data lives on their servers in a form they can read — which affects subpoenas, breaches, and employee access.