Glossary · Cryptography & authentication
End-to-end encryption (E2EE)
End-to-end encryption means data is encrypted on the sender’s device and decrypted only on the recipient’s — every intermediary, including the service operator, handles ciphertext it cannot read.
The phrase draws a line at key possession. Encryption in transit (TLS) protects the wire but terminates at the server, which sees plaintext; encryption at rest protects stolen disks but the operator holds the keys. E2EE keeps the keys exclusively at the endpoints, so the operator’s servers, backups, and staff are outside the trust boundary.
The engineering burden moves to key management: generating keys on-device, exchanging or wrapping them safely, and recovering from device loss without reintroducing a readable copy. Systems that offer operator-assisted password reset for encrypted data are, by definition, not end-to-end encrypted — someone else could decrypt.
At Ciphera, account vaults are E2EE: the vault master key is a non-extractable browser key unwrapped via the OPAQUE export key, so it exists in usable form only on the user’s device.