How end-to-end encryption works: why even WhatsApp cannot read your messages

Two chat apps can both say "your messages are encrypted" and mean opposite things. In one app, the company unlocks every message on its server. In the other app, like WhatsApp and Signal, the company passes on each message but cannot open it. Send one secret from your phone to a friend's phone, and learn what makes the second kind work: public and private keys, the key exchange, safety numbers, the Signal protocol and its ratchet, and group chats. Then see where the lock does not reach: metadata, backups and the phone itself.