is whatsapp safe is whatsapp encrypted can whatsapp read my messages

Is WhatsApp safe? What is encrypted and what Meta collects

Adrian Maverick · · 13 min read

"Is WhatsApp safe" is really four questions. Can Meta read my chats? Can a hacker get in? Are my photos private? Can the police get my messages? Each has a different answer, and most depend on settings you can check in a few minutes.

Here is each answer, from WhatsApp's own documentation, court records and security research, checked on October 11, 2026.

Is WhatsApp safe?

WhatsApp is safe for the content of personal chats and calls. They are end-to-end encrypted by default, and WhatsApp says nobody else can read them. The weak spots sit around the content: Meta collects metadata about your account, cloud backups are only encrypted end to end if you turn that on, and Meta can read some business and AI chats.

What WhatsApp encrypts and what it does not

End-to-end encryption means a message is locked on your phone and unlocked only on the recipient's phone. WhatsApp's Help Center page About end-to-end encryption says this covers "your messages, photos, videos, voice messages, documents, live location, status updates, and calls", using the Signal encryption protocol, with no setting to turn on. The same page lists the exceptions.

What End-to-end encrypted?
Personal chats, group chats and calls Yes, by default
Photos, videos, voice messages, documents, status updates Yes, by default
Cloud backup in iCloud or your Google Account Only if you turn on end-to-end encrypted backup
Chats with a business that uses the WhatsApp Business app Treated as end-to-end encrypted. The business can use what you send for marketing
Chats with a business that uses Meta to store and answer messages No. WhatsApp says it does "not consider messages with these businesses to be end-to-end encrypted"
Messages you send to Meta AI or tag with @Meta AI No. Meta can read them
Payments (in countries where WhatsApp offers them) No
Messages you report WhatsApp receives up to five of the last messages from the person or group you report
Your device, IP address, and when and how much you use the app No. This is metadata, covered below

Can WhatsApp read my messages?

For personal chats, WhatsApp's position is that it cannot. The Help Center says: "No one outside of the chat, not even WhatsApp, can read, listen to, or share them." The exceptions are the "No" rows above.

That position was challenged in court twice in 2026.

  • Dawson v. Meta Platforms. In January 2026, WhatsApp users from five countries filed a proposed class action in federal court in California. Citing unnamed whistleblowers, it alleges that Meta staff and contractors could view message content. Meta denies it. In July 2026, Judge Rita Lin dismissed the complaint with permission to refile, finding it gave too little detail on how the whistleblowers knew what they claimed.
  • State of Texas v. Meta. On May 21, 2026, the Texas Attorney General sued Meta and WhatsApp under the Texas Deceptive Trade Practices Act, alleging that employees have been able to access user communications. Meta says the allegations are false.

No court has found that WhatsApp can read end-to-end encrypted personal chats. These are allegations, and both cases are unresolved.

What Meta collects about you

Encryption hides what you say, not the facts around the conversation. The WhatsApp Privacy Policy shown to US users lists what is collected automatically:

  • Usage: how you use the service, how you interact with others, and "the time, frequency, and duration of your activities and interactions".
  • Profile and presence: profile photo, "about" text, whether you are online and when you were last seen.
  • Groups: group name, picture and description.
  • Device and connection: hardware model, operating system, battery level, app version, mobile network, phone number, language, time zone and IP address.
  • Contacts: if you allow it, the phone numbers in your address book, uploaded on a regular basis.

The policy says this information is shared with other Meta companies, for purposes that include "showing relevant offers and ads across the Meta Company Products". WhatsApp states separately that it does not keep logs of who everyone is messaging or calling. Our guide to what metadata reveals about you explains why this matters even when content is sealed.

Are WhatsApp backups encrypted?

Only if you turn it on. The Help Center page About end-to-end encrypted backup describes it as a layer you "can add" to your iCloud or Google Account backup, and it includes your messages and media. Without it, years of chats sit in a cloud account protected only by that account's password.

Since October 30, 2025, the backup can be protected with a passkey, so your fingerprint, face or screen lock replaces the older password or 64-digit key. WhatsApp cannot reset any of the three.

Meta AI and ads in WhatsApp

Meta AI. WhatsApp's Help Center says "Meta can only read messages that mention @Meta AI or that people choose to share with it, not any others." What you send to the assistant is not end-to-end encrypted and may be used to improve AI at Meta.

Private Processing. Message summaries and writing help run through a separate system. Meta says it processes your messages in a secure environment that neither Meta nor WhatsApp can read, and stores nothing afterward. It is turned off by default, under Settings > Chats > Private Processing.

Ads. WhatsApp announced ads in Status, promoted channels and paid channel subscriptions on June 16, 2025. As of October 2026 its Help Center page on ads says the rollout is gradual and may not have reached your region. Ads appear in Status and Channels, not in chats. WhatsApp says it picks them using your country code, device language, city or country, and your activity in Status and Channels, and that personal messages, calls and contacts are not used. If you add WhatsApp to Meta's Accounts Center, which is being renamed Meta Account, information from your other Meta accounts is used too. Adding it is optional.

Is WhatsApp safe from hackers?

Encryption protects a message on its way. It does not protect a compromised phone or a hijacked account, and those are the two real routes in.

Spyware. On January 31, 2025, WhatsApp notified about 90 accounts that they had been targeted with Paragon's Graphite spyware through a zero-click exploit, meaning no tap was needed. Citizen Lab documented the campaign, and WhatsApp says it blocked the exploit. In August 2025, WhatsApp patched another zero-click flaw (CVE-2025-55177) in its iPhone and Mac apps that had been used in targeted attacks.

The NSO Group case. WhatsApp sued NSO Group in 2019 after Pegasus spyware was delivered to about 1,400 users through WhatsApp's servers. A US court found NSO liable in December 2024, and in May 2025 a jury awarded about $167 million in punitive damages. On October 17, 2025, the judge cut the punitive award to about $4 million and permanently barred NSO from targeting WhatsApp. NSO has appealed to the Ninth Circuit. Attacks like these are aimed at journalists, activists and officials, not at most users.

Your phone number is discoverable. Researchers at the University of Vienna showed in 2025 that WhatsApp's contact lookup could confirm about 3.5 billion accounts by phone number, with any profile photo or "about" text set to public. No message content was exposed, and the researchers report the gap has been closed.

Scams and account takeover. This is what reaches ordinary users. Meta says it removed more than 6.8 million WhatsApp accounts linked to scam centers in the first half of 2025. Four patterns repeat:

  • A message asking you to forward a 6-digit code "sent by mistake". That code registers your account on someone else's phone.
  • A "new number" message from a relative, followed by a request for money.
  • An investment group, or a job that pays for likes and then asks for a deposit.
  • A request to scan a QR code or enter a pairing code, which links the sender's device to your account.

If someone takes over your account, registering your number again with the SMS code logs every other device out. WhatsApp says the intruder cannot read your past chats, which are stored on your devices.

Is WhatsApp safe for sending private photos?

In transit, yes: photos are end-to-end encrypted like any other message. The risk comes after delivery. The recipient has a copy and can forward it. "View once" removes a photo after one opening and blocks screenshots in the app, but WhatsApp warns that someone can photograph the screen with another device. Photos are also included in backups, so a backup without end-to-end encryption on either side holds a readable copy.

Check your own account in 2 minutes

Three checks show where you stand today.

  1. Linked devices. Open Settings (or tap your profile picture) and tap Linked Devices. Log out of anything you do not recognize.
  2. Backup status. Go to Settings > Chats > Chat Backup and see whether "End-to-end encrypted backup" is on.
  3. Encryption check. Open a chat, tap the contact's name, then tap Encryption. WhatsApp verifies the security code automatically.

How to make WhatsApp safer: 10 settings to change

Setting names match the WhatsApp Help Center for iPhone as of October 11, 2026. On Android, open Settings from the three-dot menu.

  1. Turn on end-to-end encrypted backup. Settings > Chats > Chat Backup > End-to-end encrypted backup > Turn on. Create a passkey, or tap More options for a password or 64-digit key. Store it safely, because WhatsApp cannot recover it.
  2. Turn on two-step verification. Settings > Account > Two-step verification. WhatsApp is replacing the old 6-digit PIN with a password, and lets you add a recovery email. It stops someone with your SMS code from registering your number.
  3. Add a passkey and recovery email. Settings > Privacy > Privacy Checkup > Add more protection to your account.
  4. Review Linked Devices regularly. Log out of any device you do not use.
  5. Tighten who sees you. Settings > Privacy. Set Last seen and online, Profile photo and About to My contacts. By default, any user can see your profile photo and when you are online.
  6. Control groups and calls. Settings > Privacy > Groups > My contacts stops strangers from adding you to groups. Settings > Privacy > Calls > Silence unknown callers stops calls from unknown numbers from ringing.
  7. Use the Advanced privacy options. Settings > Privacy > Advanced. "Protect IP address in calls" relays calls through WhatsApp's servers so the other person cannot see your IP address. "Disable link previews" stops previews for links you send.
  8. Set a default message timer. Settings > Privacy > Default message timer. Choose 24 hours, 7 days or 90 days so new chats clear themselves.
  9. Use Restricted chat for sensitive conversations. Tap the chat name and turn on Restricted chat, which is replacing "Advanced chat privacy". People in that chat cannot export it, auto-save its media, use Meta AI in it or open it on linked devices.
  10. Decide on Meta's optional features. Leave Private Processing off if you do not want AI summaries, and keep WhatsApp out of Accounts Center if you do not want your other Meta accounts used for ads.

If you are a journalist, activist or public figure, look at Settings > Privacy > Advanced > Strict account settings, announced in January 2026. It blocks media from unknown senders, silences unknown callers and locks your profile to contacts. Whatever you choose, keep WhatsApp and your phone updated: both zero-click flaws above were fixed by updates.

The other half of your private life is email

Chats are one channel. Bank statements, medical results, contracts, receipts and every password reset arrive by email, and a mailbox often holds years of it. Secria Mail keeps every message in your mailbox under zero-access encryption: your keys are created on your device and only reach our servers encrypted. If you are sorting out which conversations belong where, we also compared when to use a chat app and when to use email.

Frequently asked questions

Is WhatsApp safe from the police?

WhatsApp's guide for law enforcement says it does not store delivered messages or logs of them, so it cannot hand over the content of personal chats. With US legal process it can provide account records: a subpoena covers name, service start date, last seen date, IP address and email address, a court order adds blocked numbers, and a search warrant adds profile photos, group information and your address book. A cloud backup without end-to-end encryption is held by Apple or Google, who can be asked for it separately.

Can WhatsApp be hacked without me clicking anything?

It has happened. The Paragon campaign disclosed in January 2025 and the flaw fixed in August 2025 were both zero-click and aimed at a small number of people. For most users the realistic risks are scams, a stolen verification code or an unknown linked device.

Are WhatsApp calls safe?

Calls are end-to-end encrypted. A one-to-one call can connect directly, which shows your IP address to the other person, unless you turn on "Protect IP address in calls". Group calls are always relayed through WhatsApp's servers.

Lock down the chats, then give your inbox the same attention. You can start with a free Secria Mail account.

Sources

Secria fact-checks every post against primary sources. Spotted something wrong or out of date? Email hq@secria.me and we will correct it.

Back to all posts