End-to-end encryption (E2EE) means data is encrypted on the sender's device and only decrypted on the receiver's device. Everything in between, including the company running the service, only ever sees scrambled data.
A simple picture
Imagine sending a letter in a safe. You lock it at home, the post office carries it, and only the person with the matching key opens it. The post office can weigh the safe and read the address, but not the letter.
That is end-to-end encryption. The "ends" are devices that belong to people, not servers.
End-to-end vs "encrypted at rest" vs "encrypted in transit"
These phrases sound alike and are often mixed up on purpose.
| Term | Who holds the key | Who can read your data |
|---|---|---|
| Encrypted in transit (HTTPS) | The service | The service, once it arrives |
| Encrypted at rest | The service | The service, whenever it decrypts it |
| End-to-end encrypted | Only you (and who you share with) | Only you |
Most websites use the first two. They protect you from someone sniffing Wi-Fi or stealing a hard drive, but not from the service itself, a rogue employee or a breach of the servers that also holds the keys.
What E2EE still reveals
Even with end-to-end encryption, a service usually knows some metadata: that you have an account, roughly how much data you store, and when things change. A careful service tells you exactly what it can see. Potent Cipher's security page lists it: the number and size of your items and when they changed, never their names or contents.
Where it stops protecting you
- Your device. If malware runs on the device where you read the data, it sees what you see.
- Your key. If someone guesses your passphrase, they are an "end" too. Use a long, unique one.
- The app itself. The code that does the encryption must be honest. Open-source encryption code lets independent people check it. Ours is published here.
Is end-to-end encryption safe?
Yes, when it is done with well-reviewed algorithms and the key really never leaves your device. Good signs are standard building blocks (for example XChaCha20-Poly1305 or AES-GCM for the data, Argon2id for turning a passphrase into a key), an open specification and no "reset your password" button that brings your data back.
Try it
You can see end-to-end encryption at work without an account: encrypt a file in your browser. The file never leaves your computer, and only someone with the passphrase can open the result.