CINXE.COM

<!DOCTYPE html> <html lang="en-US"> <head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="mobile-web-app-capable" content="yes"> <meta name="apple-mobile-web-app-capable" content="yes"> <meta name="apple-mobile-web-app-title" content="Engineering at Meta - Engineering at Meta Blog"> <meta property="fb:app_id" content="1425766027653270" /> <link rel="profile" href="http://gmpg.org/xfn/11"> <link rel="pingback" href="https://engineering.fb.com/xmlrpc.php"> <meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1' /> <style>img:is([sizes="auto" i], [sizes^="auto," i]) { contain-intrinsic-size: 3000px 1500px }</style> <script async src="https://engineering.fb.com/wp-content/themes/code-fb-com/dist/js/optimize.min.js"></script>  <title>Building end-to-end security for Messenger - Engineering at Meta</title> <link rel="canonical" href="https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/" /> <meta name="twitter:label1" content="Written by" /> <meta name="twitter:data1" content="Jon Millican, Reed Riley" /> <meta name="twitter:label2" content="Est. reading time" /> <meta name="twitter:data2" content="8 minutes" /> <script type="application/ld+json" class="yoast-schema-graph">{"@context":"https://schema.org","@graph":[{"@type":"Article","@id":"https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/#article","isPartOf":{"@id":"https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/"},"author":[{"@id":"https://engineering.fb.com/#/schema/person/image/cde9d6205b6ae695ca28b8e53f56e414"},{"@id":"https://engineering.fb.com/#/schema/person/image/46b054f0499904ab875acc6815132fa7"}],"headline":"Building end-to-end security for Messenger","datePublished":"2023-12-07T02:00:08+00:00","dateModified":"2023-12-07T15:54:09+00:00","mainEntityOfPage":{"@id":"https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/"},"wordCount":1675,"publisher":{"@id":"https://engineering.fb.com/#organization"},"image":{"@id":"https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/#primaryimage"},"thumbnailUrl":"https://engineering.fb.com/wp-content/uploads/2023/08/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-103-Navy-1.jpg","keywords":["Messenger"],"articleSection":["Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/","url":"https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/","name":"Building end-to-end security for Messenger - Engineering at Meta","isPartOf":{"@id":"https://engineering.fb.com/#website"},"primaryImageOfPage":{"@id":"https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/#primaryimage"},"image":{"@id":"https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/#primaryimage"},"thumbnailUrl":"https://engineering.fb.com/wp-content/uploads/2023/08/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-103-Navy-1.jpg","datePublished":"2023-12-07T02:00:08+00:00","dateModified":"2023-12-07T15:54:09+00:00","breadcrumb":{"@id":"https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/#primaryimage","url":"https://engineering.fb.com/wp-content/uploads/2023/08/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-103-Navy-1.jpg","contentUrl":"https://engineering.fb.com/wp-content/uploads/2023/08/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-103-Navy-1.jpg","width":1920,"height":1080},{"@type":"BreadcrumbList","@id":"https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://engineering.fb.com/"},{"@type":"ListItem","position":2,"name":"Building end-to-end security for Messenger"}]},{"@type":"WebSite","@id":"https://engineering.fb.com/#website","url":"https://engineering.fb.com/","name":"Engineering at Meta","description":"Engineering at Meta Blog","publisher":{"@id":"https://engineering.fb.com/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://engineering.fb.com/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https://engineering.fb.com/#organization","name":"Meta","url":"https://engineering.fb.com/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https://engineering.fb.com/#/schema/logo/image/","url":"https://engineering.fb.com/wp-content/uploads/2023/08/Meta_lockup_positive-primary_RGB.jpg","contentUrl":"https://engineering.fb.com/wp-content/uploads/2023/08/Meta_lockup_positive-primary_RGB.jpg","width":29011,"height":12501,"caption":"Meta"},"image":{"@id":"https://engineering.fb.com/#/schema/logo/image/"},"sameAs":["https://www.facebook.com/Engineering/","https://twitter.com/fb_engineering"]},[],{"@type":"Person","@id":"https://engineering.fb.com/#/schema/person/image/cde9d6205b6ae695ca28b8e53f56e414","name":"Jon Millican","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https://engineering.fb.com/#/schema/person/image/23494c9101089ad44ae88ce9d2f56aac","url":"https://secure.gravatar.com/avatar/?s=96&d=mm&r=g","contentUrl":"https://secure.gravatar.com/avatar/?s=96&d=mm&r=g","caption":"Jon Millican"},"url":"https://engineering.fb.com/author/jon-millican/"},{"@type":"Person","@id":"https://engineering.fb.com/#/schema/person/image/46b054f0499904ab875acc6815132fa7","name":"Reed Riley","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https://engineering.fb.com/#/schema/person/image/23494c9101089ad44ae88ce9d2f56aac","url":"https://secure.gravatar.com/avatar/?s=96&d=mm&r=g","contentUrl":"https://secure.gravatar.com/avatar/?s=96&d=mm&r=g","caption":"Reed Riley"},"url":"https://engineering.fb.com/author/reed-riley/"}]}</script>  <link rel='dns-prefetch' href='//secure.gravatar.com' /> <link rel='dns-prefetch' href='//v0.wordpress.com' /> <link rel="alternate" type="application/rss+xml" title="Engineering at Meta » Feed" href="https://engineering.fb.com/feed/" /> <link rel="alternate" type="application/rss+xml" title="Engineering at Meta » Comments Feed" href="https://engineering.fb.com/comments/feed/" /> <script async src="https://www.googleoptimize.com/optimize.js?id=OPT-TPNDQC5" onerror="dataLayer.hide.end && dataLayer.hide.end()"></script> <script type="text/javascript"> /* <![CDATA[ */ window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/engineering.fb.com\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.7.1"}}; /*! This file is auto-generated */ !function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0),new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data));return t.every(function(e,t){return e===r[t]})}function u(e,t,n){switch(t){case"flag":return n(e,"\ud83c\udff3\ufe0f\u200d\u26a7\ufe0f","\ud83c\udff3\ufe0f\u200b\u26a7\ufe0f")?!1:!n(e,"\ud83c\uddfa\ud83c\uddf3","\ud83c\uddfa\u200b\ud83c\uddf3")&&!n(e,"\ud83c\udff4\udb40\udc67\udb40\udc62\udb40\udc65\udb40\udc6e\udb40\udc67\udb40\udc7f","\ud83c\udff4\u200b\udb40\udc67\u200b\udb40\udc62\u200b\udb40\udc65\u200b\udb40\udc6e\u200b\udb40\udc67\u200b\udb40\udc7f");case"emoji":return!n(e,"\ud83d\udc26\u200d\u2b1b","\ud83d\udc26\u200b\u2b1b")}return!1}function f(e,t,n){var r="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e){}return null}();if(!n){if("undefined"!=typeof Worker&&"undefined"!=typeof OffscreenCanvas&&"undefined"!=typeof URL&&URL.createObjectURL&&"undefined"!=typeof Blob)try{var e="postMessage("+f.toString()+"("+[JSON.stringify(s),u.toString(),p.toString()].join(",")+"));",r=new Blob([e],{type:"text/javascript"}),a=new Worker(URL.createObjectURL(r),{name:"wpTestEmojiSupports"});return void(a.onmessage=function(e){c(n=e.data),a.terminate(),t(n)})}catch(e){}c(n=f(s,u,p))}t(n)}).then(function(e){for(var t in e)n.supports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything||(n.readyCallback(),(e=n.source||{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings); /* ]]> */ </script> <style id='wp-emoji-styles-inline-css'> img.wp-smiley, img.emoji { display: inline !important; border: none !important; box-shadow: none !important; height: 1em !important; width: 1em !important; margin: 0 0.07em !important; vertical-align: -0.1em !important; background: none !important; padding: 0 !important; } </style> <link rel='stylesheet' id='all-css-2' href='https://engineering.fb.com/wp-includes/css/dist/block-library/style.min.css?m=1732206022g' type='text/css' media='all' /> <link rel='stylesheet' id='all-css-4' href='https://engineering.fb.com/_static/??-eJzTLy/QzcxLzilNSS3WzyrWz01NyUxMzUnNTc0rQeEU5CRWphbp5qSmJyZX6uVm5uklFxfr6OPTDpRD5sM02efaGpobGxkZmBkYGQMARIMu1Q==' type='text/css' media='all' /> <style id='jetpack-sharing-buttons-style-inline-css'> .jetpack-sharing-buttons__services-list{display:flex;flex-direction:row;flex-wrap:wrap;gap:0;list-style-type:none;margin:5px;padding:0}.jetpack-sharing-buttons__services-list.has-small-icon-size{font-size:12px}.jetpack-sharing-buttons__services-list.has-normal-icon-size{font-size:16px}.jetpack-sharing-buttons__services-list.has-large-icon-size{font-size:24px}.jetpack-sharing-buttons__services-list.has-huge-icon-size{font-size:36px}@media print{.jetpack-sharing-buttons__services-list{display:none!important}}.editor-styles-wrapper .wp-block-jetpack-sharing-buttons{gap:0;padding-inline-start:0}ul.jetpack-sharing-buttons__services-list.has-background{padding:1.25em 2.375em} </style> <style id='elasticpress-facet-style-inline-css'> .widget_ep-facet input[type=search],.wp-block-elasticpress-facet input[type=search]{margin-bottom:1rem}.widget_ep-facet .searchable .inner,.wp-block-elasticpress-facet .searchable .inner{max-height:20em;overflow:scroll}.widget_ep-facet .term.hide,.wp-block-elasticpress-facet .term.hide{display:none}.widget_ep-facet .empty-term,.wp-block-elasticpress-facet .empty-term{opacity:.5;position:relative}.widget_ep-facet .empty-term:after,.wp-block-elasticpress-facet .empty-term:after{bottom:0;content:" ";display:block;left:0;position:absolute;right:0;top:0;width:100%;z-index:2}.widget_ep-facet .level-1,.wp-block-elasticpress-facet .level-1{padding-left:20px}.widget_ep-facet .level-2,.wp-block-elasticpress-facet .level-2{padding-left:40px}.widget_ep-facet .level-3,.wp-block-elasticpress-facet .level-3{padding-left:60px}.widget_ep-facet .level-4,.wp-block-elasticpress-facet .level-4{padding-left:5pc}.widget_ep-facet .level-5,.wp-block-elasticpress-facet .level-5{padding-left:75pt}.widget_ep-facet input[disabled],.wp-block-elasticpress-facet input[disabled]{cursor:pointer;opacity:1}.widget_ep-facet .term a,.wp-block-elasticpress-facet .term a{-webkit-box-align:center;-ms-flex-align:center;align-items:center;display:-webkit-box;display:-ms-flexbox;display:flex;position:relative}.widget_ep-facet .term a:hover .ep-checkbox,.wp-block-elasticpress-facet .term a:hover .ep-checkbox{background-color:#ccc}.ep-checkbox{-webkit-box-align:center;-ms-flex-align:center;-ms-flex-negative:0;-webkit-box-pack:center;-ms-flex-pack:center;align-items:center;background-color:#eee;display:-webkit-box;display:-ms-flexbox;display:flex;flex-shrink:0;height:1em;justify-content:center;margin-right:.25em;width:1em}.ep-checkbox:after{border:solid #fff;border-width:0 .125em .125em 0;content:"";display:none;height:.5em;-webkit-transform:rotate(45deg);transform:rotate(45deg);width:.25em}.ep-checkbox.checked{background-color:#5e5e5e}.ep-checkbox.checked:after{display:block} </style> <link rel='stylesheet' id='all-css-8' href='https://engineering.fb.com/wp-content/mu-plugins/search/elasticpress/dist/css/related-posts-block-styles.min.css?m=1730999764g' type='text/css' media='all' /> <style id='classic-theme-styles-inline-css'> /*! This file is auto-generated */ .wp-block-button__link{color:#fff;background-color:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none} </style> <style id='global-styles-inline-css'> :root{--wp--preset--aspect-ratio--square: 1;--wp--preset--aspect-ratio--4-3: 4/3;--wp--preset--aspect-ratio--3-4: 3/4;--wp--preset--aspect-ratio--3-2: 3/2;--wp--preset--aspect-ratio--2-3: 2/3;--wp--preset--aspect-ratio--16-9: 16/9;--wp--preset--aspect-ratio--9-16: 9/16;--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgba(6,147,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgba(252,185,0,1) 0%,rgba(255,105,0,1) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red: linear-gradient(135deg,rgba(255,105,0,1) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(151,120,209) 20%,rgb(207,42,186) 40%,rgb(238,44,130) 60%,rgb(251,105,98) 80%,rgb(254,248,76) 100%);--wp--preset--gradient--blush-light-purple: linear-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(135deg,rgb(255,203,112) 0%,rgb(199,81,192) 50%,rgb(65,88,208) 100%);--wp--preset--gradient--pale-ocean: linear-gradient(135deg,rgb(255,245,203) 0%,rgb(182,227,212) 50%,rgb(51,167,181) 100%);--wp--preset--gradient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset--spacing--70: 3.38rem;--wp--preset--spacing--80: 5.06rem;--wp--preset--shadow--natural: 6px 6px 9px rgba(0, 0, 0, 0.2);--wp--preset--shadow--deep: 12px 12px 50px rgba(0, 0, 0, 0.4);--wp--preset--shadow--sharp: 6px 6px 0px rgba(0, 0, 0, 0.2);--wp--preset--shadow--outlined: 6px 6px 0px -3px rgba(255, 255, 255, 1), 6px 6px rgba(0, 0, 0, 1);--wp--preset--shadow--crisp: 6px 6px 0px rgba(0, 0, 0, 1);}:where(.is-layout-flex){gap: 0.5em;}:where(.is-layout-grid){gap: 0.5em;}body .is-layout-flex{display: flex;}.is-layout-flex{flex-wrap: wrap;align-items: center;}.is-layout-flex > :is(*, div){margin: 0;}body .is-layout-grid{display: grid;}.is-layout-grid > :is(*, div){margin: 0;}:where(.wp-block-columns.is-layout-flex){gap: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-color{color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-color{color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-color{color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-color{color: var(--wp--preset--color--vivid-purple) !important;}.has-black-background-color{background-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-background-color{background-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-background-color{background-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-background-color{background-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-background-color{background-color: var(--wp--preset--color--vivid-purple) !important;}.has-black-border-color{border-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-border-color{border-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-border-color{border-color: var(--wp--preset--color--white) !important;}.has-pale-pink-border-color{border-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-border-color{border-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-border-color{border-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-border-color{border-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-border-color{border-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-border-color{border-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-border-color{border-color: var(--wp--preset--color--vivid-purple) !important;}.has-vivid-cyan-blue-to-vivid-purple-gradient-background{background: var(--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple) !important;}.has-light-green-cyan-to-vivid-green-cyan-gradient-background{background: var(--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan) !important;}.has-luminous-vivid-amber-to-luminous-vivid-orange-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange) !important;}.has-luminous-vivid-orange-to-vivid-red-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-orange-to-vivid-red) !important;}.has-very-light-gray-to-cyan-bluish-gray-gradient-background{background: var(--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray) !important;}.has-cool-to-warm-spectrum-gradient-background{background: var(--wp--preset--gradient--cool-to-warm-spectrum) !important;}.has-blush-light-purple-gradient-background{background: var(--wp--preset--gradient--blush-light-purple) !important;}.has-blush-bordeaux-gradient-background{background: var(--wp--preset--gradient--blush-bordeaux) !important;}.has-luminous-dusk-gradient-background{background: var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !important;}.has-midnight-gradient-background{background: var(--wp--preset--gradient--midnight) !important;}.has-small-font-size{font-size: var(--wp--preset--font-size--small) !important;}.has-medium-font-size{font-size: var(--wp--preset--font-size--medium) !important;}.has-large-font-size{font-size: var(--wp--preset--font-size--large) !important;}.has-x-large-font-size{font-size: var(--wp--preset--font-size--x-large) !important;} :where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;} :where(.wp-block-columns.is-layout-flex){gap: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;} :root :where(.wp-block-pullquote){font-size: 1.5em;line-height: 1.6;} </style> <link rel='stylesheet' id='all-css-12' href='https://engineering.fb.com/_static/??-eJyNjt0KwjAMRl/ILm5FxAvxUaRLahftH0uH+PZ204HijXfJ4TtfAvesMMViY4HsJ8dRoCJHeZy5zJxYCszkDRoU2cCHWAYbrAAmsurSVxxeTs0BDuxJLYkmcPxxw6TWu1dbssGbanVzgJBo8rVUBjNaMkSPZeTo/q44c0SQhGy88skl+VrWb07h2O51t9W7VndPwmFiqw==' type='text/css' media='all' /> <script type="text/javascript" src="https://engineering.fb.com/wp-content/plugins/wp-gdpr-consent/dist/gdprconsent.js?ver=2.0.0" id="gdprconsent-js"></script> <script type="text/javascript" id="gdprconsent-js-after"> /* <![CDATA[ */ if (window.gdprSafeTrack) { window.gdprSafeTrack('https://www.googletagmanager.com/gtag/js?id=391063774'); window.gdprSafeTrack(function() { var google_analytics_g4 = decodeURIComponent( '391063774' ); window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', google_analytics_g4); }); } if (window.gdprSafeTrack) { window.gdprSafeTrack(function() { var google_tag_manager = decodeURIComponent( 'GTM-KZRLGZ8' ); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer',google_tag_manager); }); } if (window.gdprSafeTrack) { window.gdprSafeTrack(function() { var facebook_pixel = decodeURIComponent( '660742068067366' ); !function(f,b,e,v,n,t,s) {if(f.fbq)return;n=f.fbq=function(){n.callMethod? n.callMethod.apply(n,arguments):n.queue.push(arguments)}; if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0'; n.queue=[];t=b.createElement(e);t.async=!0; t.src=v;s=b.getElementsByTagName(e)[0]; s.parentNode.insertBefore(t,s)}(window, document,'script', 'https://connect.facebook.net/en_US/fbevents.js'); fbq('init', facebook_pixel); fbq('track', 'PageView'); }); } /* ]]> */ </script> <script type="text/javascript" src="https://engineering.fb.com/_static/??-eJx9y0EKgCAQheELZZZBraKzSA2l5DiNI9HtM2jRKnjwNt+vT1IO5z0vkLQvOzLw9V4dHNY+VfoPqeBWtgJfPEcUQNGyQShJxgU4CVt6aopEwC+fwtgOnTFN35jO3/exM/Y=" ></script><link rel="https://api.w.org/" href="https://engineering.fb.com/wp-json/" /><link rel="alternate" title="JSON" type="application/json" href="https://engineering.fb.com/wp-json/wp/v2/posts/20811" /><link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://engineering.fb.com/xmlrpc.php?rsd" /> <meta name="generator" content="WordPress 6.7.1" /> <link rel='shortlink' href='https://wp.me/pa0Lhq-5pF' /> <link rel="alternate" title="oEmbed (JSON)" type="application/json+oembed" href="https://engineering.fb.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fengineering.fb.com%2F2023%2F12%2F06%2Fsecurity%2Fbuilding-end-to-end-security-for-messenger%2F" /> <link rel="alternate" title="oEmbed (XML)" type="text/xml+oembed" href="https://engineering.fb.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fengineering.fb.com%2F2023%2F12%2F06%2Fsecurity%2Fbuilding-end-to-end-security-for-messenger%2F&format=xml" /> <link rel="preload" href="https://engineering.fb.com/wp-content/themes/code-fb-com/fonts/FacebookReader-Medium.woff2" as="font" type="font/woff2" crossorigin="anonymous"><link rel="preload" href="https://engineering.fb.com/wp-content/themes/code-fb-com/fonts/FacebookReader-Regular.woff2" as="font" type="font/woff2" crossorigin="anonymous"><link rel="preload" href="https://engineering.fb.com/wp-content/themes/code-fb-com/fonts/Optimistic_Display_W_Md.woff2" as="font" type="font/woff2" crossorigin="anonymous">  <meta property="og:type" content="article" /> <meta property="og:title" content="Building end-to-end security for Messenger" /> <meta property="og:url" content="https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/" /> <meta property="og:description" content="We are beginning to upgrade people’s personal conversations on Messenger to use end-to-end encryption (E2EE) by default. Meta is publishing two technical white papers on end-to-end encryption: Our …" /> <meta property="article:published_time" content="2023-12-07T02:00:08+00:00" /> <meta property="article:modified_time" content="2023-12-07T15:54:09+00:00" /> <meta property="og:site_name" content="Engineering at Meta" /> <meta property="og:image" content="https://engineering.fb.com/wp-content/uploads/2023/08/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-103-Navy-1.jpg" /> <meta property="og:image:width" content="1920" /> <meta property="og:image:height" content="1080" /> <meta property="og:image:alt" content="" /> <meta property="og:locale" content="en_US" /> <meta name="twitter:text:title" content="Building end-to-end security for Messenger" /> <meta name="twitter:image" content="https://engineering.fb.com/wp-content/uploads/2023/08/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-103-Navy-1.jpg?w=640" /> <meta name="twitter:card" content="summary_large_image" />  <link rel="shortcut icon" href="https://engineering.fb.com/wp-content/themes/code-fb-com/favicon.ico" /> </head> <body class="post-template-default single single-post postid-20811 single-format-standard group-blog"> <div class="hfeed site" id="page">  <div class="wrapper-fluid wrapper-navbar" id="wrapper-navbar"> <a class="skip-link screen-reader-text sr-only" href="#content"> Skip to content </a> <nav class="navbar navbar-expand-std"> <div class="nav-container">  <div class="nav-top-row"> <h1 class="navbar-brand mb-0"> <a rel="home" href="https://engineering.fb.com/" title="Engineering at Meta"> <img class="navbar-brand-logo" src="https://engineering.fb.com/wp-content/themes/code-fb-com/img/logo-meta.svg" class="navbar-brand-logo" alt="Engineering at Meta" width="215" height="40" loading="lazy"> </a> </h1>  <label for="search" class="screen-reader-text">Search this site</label> <input type="text" id="search" name="search" class="form-control-lg navbar-search" autocomplete="off"> <button class="navbar-toggler navbar-searchbar-toggler" type="button" data-toggle="collapse" data-target="#searchbarDropdown" aria-controls="searchbarDropdown" aria-expanded="false" aria-label="Toggle navigation"> <img src="https://engineering.fb.com/wp-content/themes/code-fb-com/img/icon-search.svg" class="navbar-mobile-search-icon" loading="lazy" width="24" height="25" /> </button>  <div class="notranslate nice-select navbar-language form-control"> </div> <button class="navbar-toggler collapsed navbar-menu-toggler" type="button" data-toggle="collapse" data-target="#navbarNavDropdown" aria-controls="navbarNavDropdown" aria-expanded="false" aria-label="Toggle navigation"> <span class="icon-bar"></span> <span class="icon-bar"></span> <span class="icon-bar"></span> </button> </div> <div class="navbar-border"></div>  <div id="navbarNavDropdown" class="collapse navbar-collapse"><ul id="main-menu" class="navbar-nav"><li id="menu-item-60" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item menu-item-60 dropdown"><a title="Open Source" href="#" data-toggle="dropdown" class="nav-link dropdown-toggle">Open Source <span class="caret"></span><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" viewBox="0 0 129 129" enable-background="new 0 0 129 129" width="12px" height="15px"> <polyline points="40 50 80 90 120 50" stroke="#adb1b8" stroke-width="10" stroke-linecap="butt" fill="none" stroke-linejoin="miter"/> </svg></a> <ul class=" dropdown-menu" role="menu"> <li id="menu-item-12330" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-12330"><a title="Open Source" href="https://engineering.fb.com/category/open-source/" class="nav-link">Open Source</a></li> <li id="menu-item-12331" class="menu-item menu-item-type-custom menu-item-object-custom nav-item menu-item-12331"><a title="Meta Open Source" href="https://opensource.fb.com" class="nav-link">Meta Open Source</a></li> </ul> </li> <li id="menu-item-2686" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item menu-item-2686 dropdown"><a title="Platforms" href="#" data-toggle="dropdown" class="nav-link dropdown-toggle">Platforms <span class="caret"></span><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" viewBox="0 0 129 129" enable-background="new 0 0 129 129" width="12px" height="15px"> <polyline points="40 50 80 90 120 50" stroke="#adb1b8" stroke-width="10" stroke-linecap="butt" fill="none" stroke-linejoin="miter"/> </svg></a> <ul class=" dropdown-menu" role="menu"> <li id="menu-item-65" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-65"><a title="Android" href="https://engineering.fb.com/category/android/" class="nav-link">Android</a></li> <li id="menu-item-66" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-66"><a title="iOS" href="https://engineering.fb.com/category/ios/" class="nav-link">iOS</a></li> <li id="menu-item-67" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-67"><a title="Web" href="https://engineering.fb.com/category/web/" class="nav-link">Web</a></li> </ul> </li> <li id="menu-item-2682" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item menu-item-2682 dropdown"><a title="Infrastructure Systems" href="#" data-toggle="dropdown" class="nav-link dropdown-toggle">Infrastructure Systems <span class="caret"></span><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" viewBox="0 0 129 129" enable-background="new 0 0 129 129" width="12px" height="15px"> <polyline points="40 50 80 90 120 50" stroke="#adb1b8" stroke-width="10" stroke-linecap="butt" fill="none" stroke-linejoin="miter"/> </svg></a> <ul class=" dropdown-menu" role="menu"> <li id="menu-item-218" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-218"><a title="Core Infra" href="https://engineering.fb.com/category/core-infra/" class="nav-link">Core Infra</a></li> <li id="menu-item-219" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-219"><a title="Data Infrastructure" href="https://engineering.fb.com/category/data-infrastructure/" class="nav-link">Data Infrastructure</a></li> <li id="menu-item-220" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-220"><a title="DevInfra" href="https://engineering.fb.com/category/developer-tools/" class="nav-link">DevInfra</a></li> <li id="menu-item-226" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-226"><a title="Production Engineering" href="https://engineering.fb.com/category/production-engineering/" class="nav-link">Production Engineering</a></li> <li id="menu-item-227" class="menu-item menu-item-type-taxonomy menu-item-object-category current-post-ancestor current-menu-parent current-post-parent nav-item menu-item-227"><a title="Security" href="https://engineering.fb.com/category/security/" class="nav-link">Security</a></li> <li id="menu-item-18607" class="menu-item menu-item-type-custom menu-item-object-custom nav-item menu-item-18607"><a title="Research Publications" href="https://research.facebook.com/publications/research-areas/systems-infrastructure/" class="nav-link">Research Publications</a></li> </ul> </li> <li id="menu-item-2683" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item menu-item-2683 dropdown"><a title="Physical Infrastructure" href="#" data-toggle="dropdown" class="nav-link dropdown-toggle">Physical Infrastructure <span class="caret"></span><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" viewBox="0 0 129 129" enable-background="new 0 0 129 129" width="12px" height="15px"> <polyline points="40 50 80 90 120 50" stroke="#adb1b8" stroke-width="10" stroke-linecap="butt" fill="none" stroke-linejoin="miter"/> </svg></a> <ul class=" dropdown-menu" role="menu"> <li id="menu-item-215" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-215"><a title="Connectivity" href="https://engineering.fb.com/category/connectivity/" class="nav-link">Connectivity</a></li> <li id="menu-item-216" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-216"><a title="Data Center Engineering" href="https://engineering.fb.com/category/data-center-engineering/" class="nav-link">Data Center Engineering</a></li> <li id="menu-item-217" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-217"><a title="Networking & Traffic" href="https://engineering.fb.com/category/networking-traffic/" class="nav-link">Networking & Traffic</a></li> <li id="menu-item-18608" class="menu-item menu-item-type-custom menu-item-object-custom nav-item menu-item-18608"><a title="Research Publications" href="https://research.facebook.com/publications/research-areas/networking-connectivity/" class="nav-link">Research Publications</a></li> </ul> </li> <li id="menu-item-2684" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item menu-item-2684 dropdown"><a title="Video Engineering & AR/VR" href="#" data-toggle="dropdown" class="nav-link dropdown-toggle">Video Engineering & AR/VR <span class="caret"></span><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" viewBox="0 0 129 129" enable-background="new 0 0 129 129" width="12px" height="15px"> <polyline points="40 50 80 90 120 50" stroke="#adb1b8" stroke-width="10" stroke-linecap="butt" fill="none" stroke-linejoin="miter"/> </svg></a> <ul class=" dropdown-menu" role="menu"> <li id="menu-item-225" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-225"><a title="Video Engineering" href="https://engineering.fb.com/category/video-engineering/" class="nav-link">Video Engineering</a></li> <li id="menu-item-223" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-223"><a title="Virtual Reality" href="https://engineering.fb.com/category/virtual-reality/" class="nav-link">Virtual Reality</a></li> <li id="menu-item-13388" class="menu-item menu-item-type-custom menu-item-object-custom nav-item menu-item-13388"><a title="Research Publications" href="https://research.facebook.com/publications/research-areas/augmented-reality-virtual-reality/" class="nav-link">Research Publications</a></li> </ul> </li> <li id="menu-item-2685" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item menu-item-2685 dropdown"><a title="Artificial Intelligence" href="#" data-toggle="dropdown" class="nav-link dropdown-toggle">Artificial Intelligence <span class="caret"></span><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" viewBox="0 0 129 129" enable-background="new 0 0 129 129" width="12px" height="15px"> <polyline points="40 50 80 90 120 50" stroke="#adb1b8" stroke-width="10" stroke-linecap="butt" fill="none" stroke-linejoin="miter"/> </svg></a> <ul class=" dropdown-menu" role="menu"> <li id="menu-item-222" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-222"><a title="ML Applications" href="https://engineering.fb.com/category/ml-applications/" class="nav-link">ML Applications</a></li> <li id="menu-item-221" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-221"><a title="AI Research" href="https://engineering.fb.com/category/ai-research/" class="nav-link">AI Research</a></li> <li id="menu-item-13387" class="menu-item menu-item-type-custom menu-item-object-custom nav-item menu-item-13387"><a title="Research Publications" href="https://ai.facebook.com/results/?content_types%5B0%5D=publication" class="nav-link">Research Publications</a></li> </ul> </li> <li id="menu-item-228" class="menu-item menu-item-type-custom menu-item-object-custom nav-item menu-item-228"><a title="Watch Videos" href="/videos" class="nav-link">Watch Videos</a></li> </ul></div> </div> <div class="search-container collapse" id="searchbarDropdown"> <div class="searchbar-search"> <div class="searchbar-container"> <div class="navbar-mobile-search-margin"></div> <input type="text" name="search" placeholder="Search" class="form-control-lg navbar-mobile-search" autofocus autocomplete="off"> <button class="searchbar-clear"> <span class="icon-bar"></span> <span class="icon-bar"></span> <span class="icon-bar"></span> </button> </div> </div> </div> </nav> </div> <div class="wrapper" id="single-wrapper"> <div class="single-container row" id="content" tabindex="-1">  <div class="content-area" id="primary"> <main class="site-main" id="main"> <article class="post-20811 post type-post status-publish format-standard has-post-thumbnail hentry category-security tag-messenger fb_content_type-article" id="post-20811"> <header class="entry-header"> <div class="entry-meta"> POSTED ON <span class="posted-on entry-date"><time class="published updated" datetime="2023-12-06">DECEMBER 6, 2023</time></span> TO <span class="cat-links"><a href="https://engineering.fb.com/category/security/" rel="category tag">Security</a></span> <h1 class="entry-title"><div>Building end-to-end security for Messenger</div></h1> </div> </header> <figure id="post-feat-image-container"> <img width="1920" height="1080" src="https://engineering.fb.com/wp-content/uploads/2023/08/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-103-Navy-1.jpg" class="wp-post-image" alt="" title="Eng-Blog-Self-Serve-Hero-Images-PRIVACY-103-Navy (1)" /> </figure> <div class="entry-authors-social"> <div class="entry-authors"> By <a href="https://engineering.fb.com/author/jon-millican/" title="Posts by Jon Millican" class="author url fn" rel="author">Jon Millican</a>, <a href="https://engineering.fb.com/author/reed-riley/" title="Posts by Reed Riley" class="author url fn" rel="author">Reed Riley</a> </div> <div class="entry-social"> <div class="entry-facebook"> <button onclick="return fbShare()" aria-label="Share this post on Facebook"> <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"><path d="M9 8h-3v4h3v12h5v-12h3.642l.358-4h-4v-1.667c0-.955.192-1.333 1.115-1.333h2.885v-5h-3.808c-3.596 0-5.192 1.583-5.192 4.615v3.385z"/></svg> </button> </div> <div class="entry-twitter"> <button onclick="return twitterSharePopup('https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/')" aria-label="Share this post on Twitter"> <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"><path d="M24 4.557c-.883.392-1.832.656-2.828.775 1.017-.609 1.798-1.574 2.165-2.724-.951.564-2.005.974-3.127 1.195-.897-.957-2.178-1.555-3.594-1.555-3.179 0-5.515 2.966-4.797 6.045-4.091-.205-7.719-2.165-10.148-5.144-1.29 2.213-.669 5.108 1.523 6.574-.806-.026-1.566-.247-2.229-.616-.054 2.281 1.581 4.415 3.949 4.89-.693.188-1.452.232-2.224.084.626 1.956 2.444 3.379 4.6 3.419-2.07 1.623-4.678 2.348-7.29 2.04 2.179 1.397 4.768 2.212 7.548 2.212 9.142 0 14.307-7.721 13.995-14.646.962-.695 1.797-1.562 2.457-2.549z"/></svg> </button> </div> <div class="entry-hacker-news"> <button onclick="return shareHackerNews('https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/')" aria-label="Share this post on Hacker News"> <svg width="24" height="24" xmlns="http://www.w3.org/2000/svg"><path d="M13.693 14.659L21.507 0h-3.29l-4.612 9.165c-.47.94-.901 1.841-1.293 2.703l-1.234-2.703L6.525 0H3l7.726 14.482V24h2.967v-9.341z" fill-rule="nonzero"/></svg> </button> </div> </div> </div> <div class="entry-content"> <ul> <li aria-level="1"><span style="font-weight: 400;">We are beginning to upgrade people’s personal conversations on Messenger to use end-to-end encryption (E2EE) by default.</span></li> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">Meta is publishing two technical white papers on end-to-end encryption:</span> <ul> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">Our <a href="https://engineering.fb.com/wp-content/uploads/2023/12/MessengerEnd-to-EndEncryptionOverview_12-6-2023.pdf" target="_blank" rel="noopener">Messenger end-to-end encryption whitepaper </a>describes the core cryptographic protocol for transmitting messages between clients.</span></li> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">The <a href="https://engineering.fb.com/wp-content/uploads/2023/12/TheLabyrinthEncryptedMessageStorageProtocol_12-6-2023.pdf" target="_blank" rel="noopener">Labyrinth encrypted storage protocol whitepaper</a> explains our protocol for end-to-end encrypting stored messaging history between devices on a user’s account.</span></li> </ul> </li> </ul> <p><span style="font-weight: 400;">Today, we’re announcing that we’ve begun to upgrade people’s personal conversations on Messenger to use E2EE by default. Our aim is to ensure that everyone’s personal messages on Messenger can only be accessed by the sender and the intended recipients, and that everyone can be sure the messages they receive are from an authentic sender.</span></p> <p><span style="font-weight: 400;">This is the most significant milestone yet for this project, which began in earnest after </span><a href="https://www.facebook.com/notes/2420600258234172/" target="_blank" rel="noopener"><span style="font-weight: 400;">Mark Zuckerberg outlined his vision for it in 2019</span></a><span style="font-weight: 400;">. Bringing E2EE to Messenger has been a complex process, with every feature and product goal revealing further challenges that required careful consideration.</span></p> <p><span style="font-weight: 400;">Enabling E2EE on Messenger meant fundamentally rebuilding many aspects of the application protocols to improve privacy, security, and safety while simultaneously maintaining the features that have made Messenger so popular. </span></p> <h2><span style="font-weight: 400;">Why we’re bringing E2EE to Messenger</span></h2> <p><span style="font-weight: 400;">Messenger first</span> <a href="https://about.fb.com/news/2016/07/messenger-starts-testing-end-to-end-encryption-with-secret-conversations/" target="_blank" rel="noopener"><span style="font-weight: 400;">built end-to-end encrypted chats in 2016 </span></a><span style="font-weight: 400;">as a feature called Secret Conversations. Since then, we’ve learned a great deal in regards to rolling out E2EE for a wider user base. For example, we recently published an updated</span> <span style="font-weight: 400;">white paper, “</span><a href="https://messengernews.fb.com/wp-content/uploads/2021/12/Metas-approach-to-safer-private-messaging-on-Messenger-and-Instagram-DMs-Sep-23.pdf" target="_blank" rel="noopener">Meta’s Approach to Safer Private Messaging on Messenger and Instagram Direct Messaging</a>,” t<span style="font-weight: 400;">hat sets out the industry-leading safety systems and tools available on Messenger.</span></p> <p><span style="font-weight: 400;">End-to-end encryption isn’t about the technology at its core. It’s about protecting people’s communications, so they can feel safe expressing themselves with their friends and loved ones. To achieve this, we typically focus on two aims:</span></p> <ol> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">Only the sender and recipients of an E2EE message can see its contents.</span></li> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">Nobody (not even Meta) should be able to forge messages to appear to have been sent from someone they weren’t.</span></li> </ol> <p><span style="font-weight: 400;">In other words, the aim is that only you and the people you’re corresponding with can read your messages – not even the app’s provider (in this case, Meta) could interfere with their contents – and you can be confident in who sent the messages. </span></p> <h2><span style="font-weight: 400;">Understanding these goals</span></h2> <p><span style="font-weight: 400;">These two aims are broad. However, when we reflect on our approach to addressing them, they end up breaking down into eight overlapping concepts that we believe achieve a cohesive approach to meaningful E2EE: </span></p> <h3><span style="font-weight: 400;">1. Confidentiality in transit</span></h3> <p><span style="font-weight: 400;">Message contents are authentically and securely transmitted between your devices and those of the people you’re talking to. This is, perhaps, the primary goal of E2EE, and is where much E2EE research and design work is targeted, such as the Signal protocol we use in our products (such as WhatsApp, Messenger, and Instagram Direct), or the </span><a href="https://datatracker.ietf.org/doc/rfc9420/" target="_blank" rel="noopener"><span style="font-weight: 400;">IETF’s Messaging Layer Security protocol</span></a><span style="font-weight: 400;">, which we helped to design and was recently standardized.</span></p> <h3><span style="font-weight: 400;">2. Confidentiality in storage</span></h3> <p><span style="font-weight: 400;">Typically, E2EE messaging services rely on local storage and encryption keys to secure encrypted messages. Messenger, however, has a long history of storing people’s messages for them so that they can access them whenever they need without having to store them locally. That’s why we’ve designed a server-based solution where encrypted messages can be stored on Meta’s servers while only being readable using encryption keys under the user’s control. </span></p> <h3><span style="font-weight: 400;">3. Control over endpoints</span></h3> <p><span style="font-weight: 400;">For something to be “end-to-end encrypted,” it is necessary to have a notion of what the “ends” are. For an E2EE messaging app this means that users should have the ability to verify and manage their set of endpoint devices that are receiving their messages, as well as visibility into when this set of devices changes.</span></p> <h3><span style="font-weight: 400;">4. Private feature designs</span></h3> <p><span style="font-weight: 400;">Product features in an E2EE setting typically need to be designed to function in a device-to-device manner, without ever relying on a third party having access to message content. This </span><a href="https://messengernews.fb.com/2023/08/22/expanding-testing-for-end-to-end-encryption-on-messenger/"><span style="font-weight: 400;">was a significant effort for Messenger</span></a><span style="font-weight: 400;">, as much of its functionality has historically relied on server-side processing, with certain features difficult or impossible to exactly match with message content being limited to the devices.</span></p> <h3><span style="font-weight: 400;">5. Logging limitations</span></h3> <p><span style="font-weight: 400;">Maintaining the confidentiality of message content extends to avoiding accidentally leaking it back to us in telemetry. In a product of Messenger’s scale, complexity, and iteration speed, this creates particular challenges as telemetry is vital in ensuring that the product is working well for people, and in debugging when things go wrong.</span></p> <h3><span style="font-weight: 400;">6. Application security</span></h3> <p><span style="font-weight: 400;">It’s a common saying that, “You can’t have privacy without security,” and this is absolutely true in the end-to-end encrypted domain. Security is important for any consumer product, but E2EE exacerbates the challenges in two important ways: it reduces the provider’s ability to protect the user from attacks, and, in fact, it expands the threat model to include the service provider itself. Our security team is keenly aware of these challenges and works closely with product teams to secure design and implementation of E2EE functionality. For example, we’ve been working to improve the memory safety of our apps; and our E2EE surfaces are covered by our <a href="https://www.facebook.com/whitehat" target="_blank" rel="noopener">bug bounty program</a>.</span></p> <h3><span style="font-weight: 400;">7. Being deliberate about what’s being protected</span></h3> <p><span style="font-weight: 400;">E2EE protects message content. However, this is a complex term to define, and, while certain things are relatively clear – such as the strings contained in a text message, or a photograph sent from your camera roll – in a sufficiently complex messaging application, it turns out there’s a surprisingly large grey area. Our focus is on determining the appropriate boundaries, ensuring that we remain true to our commitments, setting the correct user expectations, and avoiding creating meaningful privacy risks, while still ensuring that the product retains its usefulness to our users.</span></p> <h3><span style="font-weight: 400;">8. Third-party scrutiny</span></h3> <p><span style="font-weight: 400;">E2EE implies confidentiality even if the provider wants to access the contents of a communication. We aim for this to be verifiable externally, and, to this end, have published two white papers to provide transparency into our operations. We describe the properties of some features in our Help Center, and we encourage submissions to our <a href="https://www.facebook.com/whitehat" target="_blank" rel="noopener">bug bounty program</a>. Throughout the project, we have consulted with a diverse range of external parties to ensure that we’re making the right set of tradeoffs. To improve people’s ability to scrutinize us, we also support </span><a href="https://engineering.fb.com/2022/03/10/security/code-verify/" target="_blank" rel="noopener"><span style="font-weight: 400;">the Code Verify browser extension</span></a><span style="font-weight: 400;"> for our web-based end-to-end encrypted messaging, to give security researchers greater confidence that the code version that they are assessing is being used globally. </span></p> <h2><span style="font-weight: 400;">High-level approach</span></h2> <p><span style="font-weight: 400;">With all of this in mind, our high-level approach was to build off of Meta’s prior learnings in E2EE, from both <a href="https://engineering.fb.com/2021/09/10/security/whatsapp-e2ee-backups/" target="_blank" rel="noopener">WhatsApp</a> and Messenger’s Secret Conversations, and then to iterate on our most challenging problems. </span></p> <p><span style="font-weight: 400;">Working from the baseline of these two approaches, we then had to address a series of significant technical challenges, including:</span></p> <ol> <li><span style="font-weight: 400;"><strong>Multi-device capability</strong>: Messenger’s model of multi-device reflects the Facebook network, which allows people to authenticate on new devices with a username and password, in order to send and receive messages. Since <a href="https://engineering.fb.com/2021/07/14/security/whatsapp-multi-device/" target="_blank" rel="noopener">WhatsApp’s multi-device capability</a> relies on a single primary device that must cryptographically authenticate companion devices, we adopted the Secret Conversations model of multi-device, while ensuring that it functions well for all of our users.</span></li> <li><span style="font-weight: 400;"><strong>Feature support</strong>: Messenger has a number of messaging features that either don’t exist in WhatsApp, or function differently. Some of these just had to be rebuilt from scratch, while others required deploying new applied privacy technology. For example, we used </span><a href="https://datatracker.ietf.org/wg/ohai/about/" target="_blank" rel="noopener"><span style="font-weight: 400;">OHAI</span></a><span style="font-weight: 400;"> and </span><a href="https://engineering.fb.com/2022/03/30/security/de-identified-authentication-at-scale/" target="_blank" rel="noopener"><span style="font-weight: 400;">Anonymous Credentials</span></a><span style="font-weight: 400;"> to support searches of Facebook’s first-party sticker library, without revealing to us who is sending them.</span></li> <li><span style="font-weight: 400;"><strong>Message history</strong>: Messenger has always allowed clients to operate off of a small stored local cache, relying on a server-side database for their message history. Neither WhatsApp nor Secret Conversations operated in this manner, and we didn’t want all users to have to rely on a device-side storage system. Instead, we designed an entirely new encrypted storage system called <a href="https://engineering.fb.com/wp-content/uploads/2023/12/TheLabyrinthEncryptedMessageStorageProtocol_12-6-2023.pdf" target="_blank" rel="noopener">Labyrinth</a>, with ciphertexts uploaded to our servers and loaded on-demand by clients, while operating in a multi-device manner and supporting key rotation when clients are removed.</span></li> <li><span style="font-weight: 400;"><strong>Web support</strong>: We needed to support E2EE within our existing web surfaces, including the main Facebook site. The Web platform carries significantly different constraints from native apps, meaning that we needed to take custom approaches to many different aspects of the product. Further, Web users often add and remove devices in very different patterns from mobile-only users, increasing the complexity of our multi-device challenge.</span></li> </ol> <h2><span style="font-weight: 400;">Learn more about E2EE on Messenger</span></h2> <p><span style="font-weight: 400;">Today, we are sharing two white papers:</span></p> <ul> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">Our </span><a href="https://engineering.fb.com/wp-content/uploads/2023/12/MessengerEnd-to-EndEncryptionOverview_12-6-2023.pdf"><span style="font-weight: 400;">Messenger end-to-end encryption whitepaper</span></a><span style="font-weight: 400;">, which describes the core cryptographic protocol for transmitting messages between clients.</span></li> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">The </span><a href="https://engineering.fb.com/wp-content/uploads/2023/12/TheLabyrinthEncryptedMessageStorageProtocol_12-6-2023.pdf"><span style="font-weight: 400;">Labyrinth encrypted storage protocol whitepaper</span></a><span style="font-weight: 400;">, describing our protocol for end-to-end encrypting stored messages history between devices on a user’s account.</span></li> </ul> <p><span style="font-weight: 400;">These add to a number of publications that we have shared which cover Messenger’s E2EE, including:</span></p> <ul> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">Our recently updated </span><a href="https://messengernews.fb.com/wp-content/uploads/2021/12/Metas-approach-to-safer-private-messaging-on-Messenger-and-Instagram-DMs-Sep-23.pdf" target="_blank" rel="noopener"><span style="font-weight: 400;">Safety whitepaper</span></a></li> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">The independent </span><a href="https://about.fb.com/news/2022/04/expanding-end-to-end-encryption-protects-fundamental-human-rights/" target="_blank" rel="noopener"><span style="font-weight: 400;">E2EE Human Rights Impact Assessment</span></a></li> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">Our </span><a href="https://engineering.fb.com/wp-content/uploads/2022/07/Meta-Security-Principles-for-Private-Messaging-White-Paper-July-2022-2.pdf" target="_blank" rel="noopener"><span style="font-weight: 400;">Security Principles whitepaper</span></a></li> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">The </span><a href="https://engineering.fb.com/2022/03/10/security/code-verify/" target="_blank" rel="noopener"><span style="font-weight: 400;">Code Verify browser extension</span></a></li> </ul> <h2><span style="font-weight: 400;">Beyond E2EE for Messenger</span></h2> <p><span style="font-weight: 400;">The journey to bring E2EE to Messenger has been a long one, but it’s not yet finished. While we are globally launching default E2EE for personal one-to-one messages on Messenger, we are still in the testing phase for group messaging and some other products, like Instagram Direct Messages. On Instagram, we are currently testing “disappearing messages” for one-to-one Instagram Direct conversations in select countries. Disappearing messages are ephemeral and, as with those in Messenger, expire 24 hours after being sent. They are built leveraging our E2EE infrastructure and provide an increased level of privacy. We plan to expand this work as well as conduct additional testing around E2EE on Instagram over the next year.</span></p> <div class="sharedaddy sd-sharing-enabled"><div class="robots-nocontent sd-block sd-social sd-social-icon-text sd-sharing"><h3 class="sd-title">Share this:</h3><div class="sd-content"><ul><li class="share-facebook"><a rel="nofollow noopener noreferrer" data-shared="sharing-facebook-20811" class="share-facebook sd-button share-icon" href="https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/?share=facebook" target="_blank" title="Click to share on Facebook" ><span>Facebook</span></a></li><li class="share-custom share-custom-threads"><a rel="nofollow noopener noreferrer" data-shared="" class="share-custom share-custom-threads sd-button share-icon" href="https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/?share=custom-1706294701" target="_blank" title="Click to share on Threads" ><span style="background-image:url("https://engineering.fb.com/wp-content/uploads/2024/01/threads-app-icon.png");">Threads</span></a></li><li class="share-x"><a rel="nofollow noopener noreferrer" data-shared="sharing-x-20811" class="share-x sd-button share-icon" href="https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/?share=x" target="_blank" title="Click to share on X" ><span>X</span></a></li><li class="share-linkedin"><a rel="nofollow noopener noreferrer" data-shared="sharing-linkedin-20811" class="share-linkedin sd-button share-icon" href="https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/?share=linkedin" target="_blank" title="Click to share on LinkedIn" ><span>LinkedIn</span></a></li><li class="share-custom share-custom-hackernews"><a rel="nofollow noopener noreferrer" data-shared="" class="share-custom share-custom-hackernews sd-button share-icon" href="https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/?share=custom-1699562127" target="_blank" title="Click to share on Hacker News" ><span style="background-image:url("https://news.ycombinator.com/y18.svg");">Hacker News</span></a></li><li class="share-email"><a rel="nofollow noopener noreferrer" data-shared="" class="share-email sd-button share-icon" href="mailto:?subject=%5BShared%20Post%5D%20Building%20end-to-end%20security%20for%20Messenger&body=https%3A%2F%2Fengineering.fb.com%2F2023%2F12%2F06%2Fsecurity%2Fbuilding-end-to-end-security-for-messenger%2F&share=email" target="_blank" title="Click to email a link to a friend" data-email-share-error-title="Do you have email set up?" data-email-share-error-text="If you're having problems sharing via email, you might not have email set up for your browser. You may need to create a new email yourself." data-email-share-nonce="98f58cca79" data-email-share-track-url="https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/?share=email"><span>Email</span></a></li><li class="share-end"></li></ul></div></div></div> </div> </article> <footer class="entry-footer"> <div>TAGS:      <a href="https://engineering.fb.com/tag/messenger/" rel="tag">Messenger</a></div> </footer> <div class="fb-like" data-href="https://engineering.fb.com/2023/12/06/security/building-end-to-end-security-for-messenger/" data-width="" data-layout="standard" data-action="like" data-size="small" data-share="true"> </div> <div class="related-articles"> <div class="related-articles__header"> <h3 class="related-articles__header__headline">Read More in Security</h3> <a aria-label="View all articles in this Security" class="related-articles__header__link" href="https://engineering.fb.com/category/security/" > View All </a> </div> <div class="article-grids related-articles__grid"> <div class="row"> <div class="article-grid col-12 col-md-4"> <article class="post post-20811 type-post status-publish format-standard has-post-thumbnail hentry category-security tag-messenger fb_content_type-article" id="post-21935"> <img width="580" height="326" src="https://engineering.fb.com/wp-content/uploads/2024/11/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-103-Teale-x2_small.png?w=580&h=326&crop=1" class="attachment-thumbnail size-thumbnail" alt="" /> <header class="entry-header"> <div class="entry-header__top"> <span class="posted-on"> <time class="entry-date published" datetime="2024-11-12T09:00:10-08:00"> NOV 12, 2024 </time> </span> </div> <div class="entry-title"> <div> <a href="https://engineering.fb.com/2024/11/12/security/how-meta-built-large-scale-cryptographic-monitoring/" rel="bookmark" aria-label="Read More about How Meta built large-scale cryptographic monitoring"> How Meta built large-scale cryptographic monitoring </a> </div> </div> </header> </article> </div> <div class="article-grid col-12 col-md-4"> <article class="post post-20811 type-post status-publish format-standard has-post-thumbnail hentry category-security tag-messenger fb_content_type-article" id="post-21812"> <img width="580" height="326" src="https://engineering.fb.com/wp-content/uploads/2024/10/WhatsApp-IPLS-image-3_crop.png?w=580&h=326&crop=1" class="attachment-thumbnail size-thumbnail" alt="" /> <header class="entry-header"> <div class="entry-header__top"> <span class="posted-on"> <time class="entry-date published" datetime="2024-10-22T05:59:46-07:00"> OCT 22, 2024 </time> </span> </div> <div class="entry-title"> <div> <a href="https://engineering.fb.com/2024/10/22/security/ipls-privacy-preserving-storage-for-your-whatsapp-contacts/" rel="bookmark" aria-label="Read More about IPLS: Privacy-preserving storage for your WhatsApp contacts"> IPLS: Privacy-preserving storage for your WhatsApp contacts </a> </div> </div> </header> </article> </div> <div class="article-grid col-12 col-md-4"> <article class="post post-20811 type-post status-publish format-standard has-post-thumbnail hentry category-security tag-messenger fb_content_type-article" id="post-21662"> <img width="580" height="326" src="https://engineering.fb.com/wp-content/uploads/2024/08/Meta-Tech-Podcast-Post-quantum-readiness.webp?w=580&h=326&crop=1" class="attachment-thumbnail size-thumbnail" alt="" loading="lazy" /> <header class="entry-header"> <div class="entry-header__top"> <span class="posted-on"> <time class="entry-date published" datetime="2024-08-28T09:19:35-07:00"> AUG 28, 2024 </time> </span> </div> <div class="entry-title"> <div> <a href="https://engineering.fb.com/2024/08/28/security/post-quantum-cryptography-meta/" rel="bookmark" aria-label="Read More about Meta is getting ready for post-quantum cryptography"> Meta is getting ready for post-quantum cryptography </a> </div> </div> </header> </article> </div> <div class="article-grid col-12 col-md-4"> <article class="post post-20811 type-post status-publish format-standard has-post-thumbnail hentry category-security tag-messenger fb_content_type-article" id="post-21618"> <img width="580" height="326" src="https://engineering.fb.com/wp-content/uploads/2024/08/PAI-EngFair-Blog-Header-Final.png?w=580&h=326&crop=1" class="attachment-thumbnail size-thumbnail" alt="" loading="lazy" /> <header class="entry-header"> <div class="entry-header__top"> <span class="posted-on"> <time class="entry-date published" datetime="2024-08-27T09:00:50-07:00"> AUG 27, 2024 </time> </span> </div> <div class="entry-title"> <div> <a href="https://engineering.fb.com/2024/08/27/security/privacy-aware-infrastructure-purpose-limitation-meta/" rel="bookmark" aria-label="Read More about How Meta enforces purpose limitation via Privacy Aware Infrastructure at scale"> How Meta enforces purpose limitation via Privacy Aware Infrastructure at scale </a> </div> </div> </header> </article> </div> <div class="article-grid col-12 col-md-4"> <article class="post post-20811 type-post status-publish format-standard has-post-thumbnail hentry category-security tag-messenger fb_content_type-article" id="post-21222"> <img width="580" height="326" src="https://engineering.fb.com/wp-content/uploads/2024/05/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-103-Orange.jpg?w=580&h=326&crop=1" class="attachment-thumbnail size-thumbnail" alt="" loading="lazy" title="Eng-Blog-Self-Serve-Hero-Images-PRIVACY-103-Orange" /> <header class="entry-header"> <div class="entry-header__top"> <span class="posted-on"> <time class="entry-date published" datetime="2024-05-22T09:35:59-07:00"> MAY 22, 2024 </time> </span> </div> <div class="entry-title"> <div> <a href="https://engineering.fb.com/2024/05/22/security/post-quantum-readiness-tls-pqr-meta/" rel="bookmark" aria-label="Read More about Post-quantum readiness for TLS at Meta"> Post-quantum readiness for TLS at Meta </a> </div> </div> </header> </article> </div> <div class="article-grid col-12 col-md-4"> <article class="post post-20811 type-post status-publish format-standard has-post-thumbnail hentry category-security tag-messenger fb_content_type-article" id="post-20955"> <img width="580" height="326" src="https://engineering.fb.com/wp-content/uploads/2024/03/Woman-with-smartphone_EU-flag_smaller.jpg?w=580&h=326&crop=1" class="attachment-thumbnail size-thumbnail" alt="" loading="lazy" /> <header class="entry-header"> <div class="entry-header__top"> <span class="posted-on"> <time class="entry-date published" datetime="2024-03-06T01:00:14-08:00"> MAR 6, 2024 </time> </span> </div> <div class="entry-title"> <div> <a href="https://engineering.fb.com/2024/03/06/security/whatsapp-messenger-messaging-interoperability-eu/" rel="bookmark" aria-label="Read More about Making messaging interoperability with third parties safe for users in Europe"> Making messaging interoperability with third parties safe for users in Europe </a> </div> </div> </header> </article> </div> </div> </div> </div>  </main> </div>  <div class="col-md-4 widget-area" id="right-sidebar" role="complementary"> <aside id="fb_related_post_widget-4" class="widget widget_fb_related_post_widget"><h3 class="widget-title">Related Posts</h3><hr> <div class="aside-related-projects"><div class="article-grid-redesign"> <article class="post-18907 post type-post status-publish has-post-thumbnail hentry" id="post-18907"> <a href="https://engineering.fb.com/2022/07/28/security/five-security-principles-for-billions-of-messages-across-metas-apps/" rel="bookmark" aria-label="Read More about Five security principles for billions of messages across Meta’s apps"> <img width="580" height="326" src="https://engineering.fb.com/wp-content/uploads/2022/06/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-101-Navy.jpg?w=580&h=326&crop=1" class="wp-post-image" alt="" srcset="https://engineering.fb.com/wp-content/uploads/2022/06/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-101-Navy.jpg?w=580&h=326&crop=1 580w, https://engineering.fb.com/wp-content/uploads/2022/06/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-101-Navy.jpg?w=580&h=326&crop=1 326w" sizes="(max-width: 580px) 100vw, 580px" loading="lazy"> <header class="entry-header"> <span class="posted-on"><time class="entry-date published" datetime="Jul 28, 2022">Jul 28, 2022</time></span> <h4 class="entry-title">Five security principles for billions of messages across Meta’s apps</h4> </header> </a> </article> </div><div class="article-grid-redesign"> <article class="post-18540 post type-post status-publish has-post-thumbnail hentry" id="post-18540"> <a href="https://engineering.fb.com/2022/03/10/security/code-verify/" rel="bookmark" aria-label="Read More about Code Verify: An open source browser extension for verifying code authenticity on the web"> <img width="580" height="326" src="https://engineering.fb.com/wp-content/uploads/2022/03/WhatsApp-Code-Verify-Hero2.jpg?w=580&h=326&crop=1" class="wp-post-image" alt="" srcset="https://engineering.fb.com/wp-content/uploads/2022/03/WhatsApp-Code-Verify-Hero2.jpg?w=580&h=326&crop=1 580w, https://engineering.fb.com/wp-content/uploads/2022/03/WhatsApp-Code-Verify-Hero2.jpg?w=580&h=326&crop=1 326w" sizes="(max-width: 580px) 100vw, 580px" loading="lazy"> <header class="entry-header"> <span class="posted-on"><time class="entry-date published" datetime="Mar 10, 2022">Mar 10, 2022</time></span> <h4 class="entry-title">Code Verify: An open source browser extension for verifying code authenticity on the web</h4> </header> </a> </article> </div><div class="article-grid-redesign"> <article class="post-14063 post type-post status-publish has-post-thumbnail hentry" id="post-14063"> <a href="https://engineering.fb.com/2020/03/02/data-infrastructure/messenger/" rel="bookmark" aria-label="Read More about Project LightSpeed: Rewriting the Messenger codebase for a faster, smaller, and simpler messaging app"> <img width="580" height="326" src="https://engineering.fb.com/wp-content/uploads/2020/03/Lightspeed_Hero.jpeg?w=580&h=326&crop=1" class="wp-post-image" alt="" srcset="https://engineering.fb.com/wp-content/uploads/2020/03/Lightspeed_Hero.jpeg?w=580&h=326&crop=1 580w, https://engineering.fb.com/wp-content/uploads/2020/03/Lightspeed_Hero.jpeg?w=580&h=326&crop=1 326w" sizes="(max-width: 580px) 100vw, 580px" loading="lazy"> <header class="entry-header"> <span class="posted-on"><time class="entry-date published" datetime="Mar 02, 2020">Mar 02, 2020</time></span> <h4 class="entry-title">Project LightSpeed: Rewriting the Messenger codebase for a faster, smaller, and simpler messaging app</h4> </header> </a> </article> </div></div></aside><aside id="wpb_widget-3" class="widget widget_wpb_widget"><h3 class="widget-title">Related Positions</h3><hr><ul class="available-positions-list"><li class="available-positions-item"> <a href=https://www.metacareers.com/jobs/2349685008718613/> <div class="job-description"> Regulatory Readiness Program Manager </div> <div class="job-location"> LONDON, UK </div> </a> </li><li class="available-positions-item"> <a href=https://www.metacareers.com/jobs/9191951340829649/> <div class="job-description"> Privacy Program Manager - Privacy & Competition Governance, Risk and Compliance </div> <div class="job-location"> DUBLIN, IRELAND </div> </a> </li><li class="available-positions-item"> <a href=https://www.metacareers.com/jobs/9191951340829649/> <div class="job-description"> Privacy Program Manager - Privacy & Competition Governance, Risk and Compliance </div> <div class="job-location"> LONDON, UK </div> </a> </li><li class="available-positions-item"> <a href=https://www.metacareers.com/jobs/499915072799036/> <div class="job-description"> Product Security Engineer </div> <div class="job-location"> LONDON, UK </div> </a> </li><li class="available-positions-item"> <a href=https://www.metacareers.com/jobs/1027475188918044/> <div class="job-description"> Integrity Science Engineer </div> <div class="job-location"> MENLO PARK, US </div> </a> </li> </ul> <a href="https://www.metacareers.com"> <div class="btn available-positions-btn"> See All Jobs </div> </a> </aside> </div>   </div> </div> </div>  <div class="wrapper wrapper-community-outer"> <div class="wrapper-community"> <div class="community" tabindex="-1"> <div class="row">  <div id="wpb_widget-2" class="footer-widget widget_wpb_widget widget-count-3 col-md-4"><h3 class="widget-title">Available Positions</h3><hr><ul class="available-positions-list"><li class="available-positions-item"> <a href=https://www.metacareers.com/jobs/2349685008718613/> <div class="job-description"> Regulatory Readiness Program Manager </div> <div class="job-location"> LONDON, UK </div> </a> </li><li class="available-positions-item"> <a href=https://www.metacareers.com/jobs/9191951340829649/> <div class="job-description"> Privacy Program Manager - Privacy & Competition Governance, Risk and Compliance </div> <div class="job-location"> DUBLIN, IRELAND </div> </a> </li><li class="available-positions-item"> <a href=https://www.metacareers.com/jobs/9191951340829649/> <div class="job-description"> Privacy Program Manager - Privacy & Competition Governance, Risk and Compliance </div> <div class="job-location"> LONDON, UK </div> </a> </li><li class="available-positions-item"> <a href=https://www.metacareers.com/jobs/499915072799036/> <div class="job-description"> Product Security Engineer </div> <div class="job-location"> LONDON, UK </div> </a> </li><li class="available-positions-item"> <a href=https://www.metacareers.com/jobs/1027475188918044/> <div class="job-description"> Integrity Science Engineer </div> <div class="job-location"> MENLO PARK, US </div> </a> </li> </ul> <a href="https://www.metacareers.com"> <div class="btn available-positions-btn"> See All Jobs </div> </a> </div><div id="custom_html-2" class="widget_text footer-widget widget_custom_html widget-count-3 col-md-4"><h3 class="widget-title">Technology at Meta</h3><div class="textwidget custom-html-widget"><ul class="stay-connected-lists"> <li class="stay-connected-item"> <img class="footer-fb-engineering stay-connected-item-left" src="/wp-content/themes/code-fb-com/img/meta_logo.png" alt="footer-fb-engineering" loading="lazy" width="70" height="70"> <div class="stay-connected-item-right"> <div class="stay-connected-label"> Engineering at Meta - X </div> <a onclick='return twitterFollow("fb_engineering")'> <button class="btn stay-connected-btn"> Follow </button> </a> </div> </li> <li class="stay-connected-item"> <img class="footer-fb-engineering stay-connected-item-left" src="/wp-content/themes/code-fb-com/img/meta_logo.png" alt="footer-AI" loading="lazy" width="70" height="70"> <div class="stay-connected-item-right"> <div class="stay-connected-label"> AI at Meta </div> <a href="https://ai.meta.com/blog/"> <button class="btn stay-connected-btn"> Read </button> </a> </div> </li> <li class="stay-connected-item"> <img class="footer-fb-engineering stay-connected-item-left" src="/wp-content/themes/code-fb-com/img/meta_logo.png" alt="footer-developers" loading="lazy" width="70" height="70"> <div class="stay-connected-item-right"> <div class="stay-connected-label"> Meta Quest Blog </div> <a href="https://www.meta.com/blog/quest/"> <button class="btn stay-connected-btn"> Read </button> </a> </div> </li> <li class="stay-connected-item"> <img class="footer-fb-engineering stay-connected-item-left" src="/wp-content/themes/code-fb-com/img/meta_logo.png" alt="footer-developers" loading="lazy" width="70" height="70"> <div class="stay-connected-item-right"> <div class="stay-connected-label"> Meta for Developers </div> <a href="https://developers.facebook.com/"> <button class="btn stay-connected-btn"> Read </button> </a> </div> </li> <li class="stay-connected-item"> <img class="footer-fb-engineering stay-connected-item-left" src="/wp-content/themes/code-fb-com/img/meta_logo.png" alt="footer-bug-bounty" loading="lazy" width="70" height="70"> <div class="stay-connected-item-right"> <div class="stay-connected-label"> Meta Bug Bounty </div> <a href="https://bugbounty.meta.com/"> <button class="btn stay-connected-btn"> Learn more </button> </a> </div> </li> <li class="stay-connected-item"> <img class="stay-connected-item-left" src="/wp-content/themes/code-fb-com/img/rss.png" alt="footer-rss" loading="lazy" width="70" height="70"> <div class="stay-connected-item-right"> <div class="stay-connected-label"> RSS </div> <a href="https://code.facebook.com/posts/rss/"> <button class="btn stay-connected-btn"> Subscribe </button> </a> </div> </li> </ul> </div></div><div id="custom_html-3" class="widget_text footer-widget widget_custom_html widget-count-3 col-md-4"><h3 class="widget-title">Open Source</h3><div class="textwidget custom-html-widget"><p class="opensource-desc"> Meta believes in building community through open source technology. Explore our latest projects in Artificial Intelligence, Data Infrastructure, Development Tools, Front End, Languages, Platforms, Security, Virtual Reality, and more. </p> <ul class="opensource-cats"> <li class="opensource-cat"> <img src="/wp-content/themes/code-fb-com/img/android.png" alt="android" loading="lazy" width="50" height="59"> <div class="opensource-cap"> ANDROID </div> </li> <li class="opensource-cat"> <img src="/wp-content/themes/code-fb-com/img/ios.png" alt="ios" loading="lazy" width="48" height="58"> <div class="opensource-cap"> iOS </div> </li> <li class="opensource-cat"> <img src="/wp-content/themes/code-fb-com/img/web.png" alt="web" loading="lazy" width="55" height="49"> <div class="opensource-cap"> WEB </div> </li> <li class="opensource-cat"> <img src="/wp-content/themes/code-fb-com/img/backend.png" alt="backend" loading="lazy" width="56" height="51"> <div class="opensource-cap"> BACKEND </div> </li> <li class="opensource-cat"> <img src="/wp-content/themes/code-fb-com/img/hardware.png" alt="hardware" loading="lazy" width="55" height="44"> <div class="opensource-cap"> HARDWARE </div> </li> </ul> <button class="btn opensource-btn" onclick="window.location.href='https://opensource.fb.com/'"> Learn More </button> </div></div> </div> </div> </div> </div> <div class="wrapper-footer" id="wrapper-footer"> <div class="inner-container"> <div class="footer"> <div class="row"> <div class="col-md-12"> <footer class="meta-footer" id="meta-footer"> <div class="site-info row justify-content-between"> <div class="col-md-5 meta-logo-container"> <a href="https://about.facebook.com/"> <img src="https://engineering.fb.com/wp-content/themes/code-fb-com/img/meta_logo_full.svg" width="89" height="18" alt="Meta" /> </a> <div id="text-2" class="widget widget_text"> <div class="textwidget"><p>Engineering at Meta is a technical news resource for engineers interested in how we solve large-scale technical challenges at Meta.</p> </div> </div> </div> <div class="col-md-6 footer-meta-links-container"> <ul class="meta-footer-links"> <li class="footer-link"><a href="https://engineering.fb.com">Home</a></li><li class="footer-link"><a href="https://about.meta.com/">Company Info</a></li><li class="footer-link"><a href="https://www.metacareers.com/?ref=engineering.fb.com">Careers</a></li> </ul> </div> </div> </footer> </div> </div> </div> </div> <div class="footer"> <div class="row"> <div class="col-md-12"> <footer class="site-footer" id="colophon"> <div class="inner-container"> <div class="site-info row justify-content-between"> <div class="col-md-4 copyright-container"> <div class="copyright"> © 2024 Meta</div> </div>  <div class="col-md-7 footer-links-container"> <ul class="footer-links"> <li class="footer-link"><a href="https://www.facebook.com/policies">Terms</a></li><li class="footer-link"><a href="https://www.facebook.com/privacy/policy">Privacy</a></li><li class="footer-link"><a href="/privacy">Cookies</a></li><li class="footer-link"><a href="https://www.facebook.com/help">Help</a></li> </ul> </div> </div> </div> </footer> </div> </div> </div> </div> </div> <div class="gdprconsent-container" id="GDPRConsentBar"> <div class="gdprconsent-wrapper"> <div class="gdprconsent-content"> <p>To help personalize content, tailor and measure ads and provide a safer experience, we use cookies. By clicking or navigating the site, you agree to allow our collection of information on and off Facebook through cookies. Learn more, including about available controls: <a href="/privacy">Cookie Policy</a></p> <div class="gdprconsent-button"> <button type="button" data-gdpr-accept>Accept</button> </div> </div> </div> </div>  <script> if (window.gdprSafeTrack) { window.gdprSafeTrack(function() { !function(e,t,n,s,u,a){e.twq||(s=e.twq=function(){s.exe?s.exe.apply(s,arguments):s.queue.push(arguments); },s.version='1.1',s.queue=[],u=t.createElement(n),u.async=!0,u.src='//static.ads-twitter.com/uwt.js', a=t.getElementsByTagName(n)[0],a.parentNode.insertBefore(u,a))}(window,document,'script'); // Insert Twitter Pixel ID and Standard Event data below twq('init','o31u0'); twq('track','PageView'); }); } </script>  <script type="text/javascript"> window.WPCOM_sharing_counts = {"https:\/\/engineering.fb.com\/2023\/12\/06\/security\/building-end-to-end-security-for-messenger\/":20811}; </script> <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-KZRLGZ8" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript> <noscript><img height="1" width="1" style="display:none" src="https://www.facebook.com/tr?id=660742068067366&ev=PageView&noscript=1"/></noscript> <script type="text/javascript" id="video-analytics-js-after"> /* <![CDATA[ */ if (window.gdprSafeTrack) { window.gdprSafeTrack(function() { let youtube = document.querySelectorAll('[src*="youtube-nocookie"]'); for (let i = 0; i < youtube.length; i++) { youtube[i].src = youtube[i].src.replace('youtube-nocookie.com', 'youtube.com'); } let vimeo = document.querySelectorAll('[src*="vimeo"]'); for (let i = 0; i < vimeo.length; i++) { vimeo[i].src = vimeo[i].src.replace('&dnt=true', ''); } }); } /* ]]> */ </script> <script type="text/javascript" id="child-understrap-scripts-js-extra"> /* <![CDATA[ */ var loadmore_params = {"restfulURL":"https:\/\/engineering.fb.com\/wp-json\/fb\/v1\/loadmore","searchText":"","posts":"{\"page\":0,\"year\":2023,\"monthnum\":12,\"day\":6,\"name\":\"building-end-to-end-security-for-messenger\",\"category_name\":\"security\",\"error\":\"\",\"m\":\"\",\"p\":0,\"post_parent\":\"\",\"subpost\":\"\",\"subpost_id\":\"\",\"attachment\":\"\",\"attachment_id\":0,\"pagename\":\"\",\"page_id\":0,\"second\":\"\",\"minute\":\"\",\"hour\":\"\",\"w\":0,\"tag\":\"\",\"cat\":\"\",\"tag_id\":\"\",\"author\":\"\",\"author_name\":\"\",\"feed\":\"\",\"tb\":\"\",\"paged\":0,\"meta_key\":\"\",\"meta_value\":\"\",\"preview\":\"\",\"s\":\"\",\"sentence\":\"\",\"title\":\"\",\"fields\":\"\",\"menu_order\":\"\",\"embed\":\"\",\"category__in\":[],\"category__not_in\":[],\"category__and\":[],\"post__in\":[],\"post__not_in\":[],\"post_name__in\":[],\"tag__in\":[],\"tag__not_in\":[],\"tag__and\":[],\"tag_slug__in\":[],\"tag_slug__and\":[],\"post_parent__in\":[],\"post_parent__not_in\":[],\"author__in\":[],\"author__not_in\":[],\"search_columns\":[],\"ignore_sticky_posts\":false,\"suppress_filters\":false,\"cache_results\":true,\"update_post_term_cache\":true,\"update_menu_item_cache\":false,\"lazy_load_term_meta\":true,\"update_post_meta_cache\":true,\"post_type\":\"\",\"posts_per_page\":12,\"nopaging\":false,\"comments_per_page\":\"50\",\"no_found_rows\":false,\"order\":\"DESC\"}","current_page":"1","max_page":"0","post_type":"post"}; var search_params = {"ajaxurl":"https:\/\/engineering.fb.com\/wp-admin\/admin-ajax.php","posts":"{\"page\":0,\"year\":2023,\"monthnum\":12,\"day\":6,\"name\":\"building-end-to-end-security-for-messenger\",\"category_name\":\"security\",\"error\":\"\",\"m\":\"\",\"p\":0,\"post_parent\":\"\",\"subpost\":\"\",\"subpost_id\":\"\",\"attachment\":\"\",\"attachment_id\":0,\"pagename\":\"\",\"page_id\":0,\"second\":\"\",\"minute\":\"\",\"hour\":\"\",\"w\":0,\"tag\":\"\",\"cat\":\"\",\"tag_id\":\"\",\"author\":\"\",\"author_name\":\"\",\"feed\":\"\",\"tb\":\"\",\"paged\":0,\"meta_key\":\"\",\"meta_value\":\"\",\"preview\":\"\",\"s\":\"\",\"sentence\":\"\",\"title\":\"\",\"fields\":\"\",\"menu_order\":\"\",\"embed\":\"\",\"category__in\":[],\"category__not_in\":[],\"category__and\":[],\"post__in\":[],\"post__not_in\":[],\"post_name__in\":[],\"tag__in\":[],\"tag__not_in\":[],\"tag__and\":[],\"tag_slug__in\":[],\"tag_slug__and\":[],\"post_parent__in\":[],\"post_parent__not_in\":[],\"author__in\":[],\"author__not_in\":[],\"search_columns\":[],\"ignore_sticky_posts\":false,\"suppress_filters\":false,\"cache_results\":true,\"update_post_term_cache\":true,\"update_menu_item_cache\":false,\"lazy_load_term_meta\":true,\"update_post_meta_cache\":true,\"post_type\":\"\",\"posts_per_page\":12,\"nopaging\":false,\"comments_per_page\":\"50\",\"no_found_rows\":false,\"order\":\"DESC\"}","current_page":"1","max_page":"0","article_filter":"87fa5f87a1"}; var more_articles = {"next_article":{"label":"Next","permalink":"https:\/\/engineering.fb.com\/2023\/12\/19\/data-infrastructure\/hawkeye-ai-debugging-meta\/","title":"AI debugging at Meta with HawkEye","thumbnail":["https:\/\/engineering.fb.com\/wp-content\/uploads\/2023\/12\/HawkEye-Hero-2B.png?w=580&h=326&crop=1","580","326",true]},"prev_article":{"label":"Prev","permalink":"https:\/\/engineering.fb.com\/2023\/11\/21\/production-engineering\/writing-linting-python-at-scale-meta\/","title":"Writing and linting Python at scale","thumbnail":["https:\/\/engineering.fb.com\/wp-content\/uploads\/2023\/11\/MetaTechPodcastEp57_Hero.jpg?w=580&h=326&crop=1","580","326",true]}}; /* ]]> */ </script> <script type="text/javascript" src="https://engineering.fb.com/_static/??/wp-content/themes/code-fb-com/dist/js/child-theme.min.js,/wp-content/themes/code-fb-com/js/prism.js?m=1720616012j" ></script><script type="text/javascript" id="sharing-js-js-extra"> /* <![CDATA[ */ var sharing_js_options = {"lang":"en","counts":"1","is_stats_active":""}; /* ]]> */ </script> <script type="text/javascript" src="https://engineering.fb.com/wp-content/mu-plugins/jetpack-13.9/_inc/build/sharedaddy/sharing.min.js?ver=13.9.1" id="sharing-js-js"></script> <script type="text/javascript" id="sharing-js-js-after"> /* <![CDATA[ */ var windowOpen; ( function () { function matches( el, sel ) { return !! ( el.matches && el.matches( sel ) || el.msMatchesSelector && el.msMatchesSelector( sel ) ); } document.body.addEventListener( 'click', function ( event ) { if ( ! event.target ) { return; } var el; if ( matches( event.target, 'a.share-facebook' ) ) { el = event.target; } else if ( event.target.parentNode && matches( event.target.parentNode, 'a.share-facebook' ) ) { el = event.target.parentNode; } if ( el ) { event.preventDefault(); // If there's another sharing window open, close it. if ( typeof windowOpen !== 'undefined' ) { windowOpen.close(); } windowOpen = window.open( el.getAttribute( 'href' ), 'wpcomfacebook', 'menubar=1,resizable=1,width=600,height=400' ); return false; } } ); } )(); var windowOpen; ( function () { function matches( el, sel ) { return !! ( el.matches && el.matches( sel ) || el.msMatchesSelector && el.msMatchesSelector( sel ) ); } document.body.addEventListener( 'click', function ( event ) { if ( ! event.target ) { return; } var el; if ( matches( event.target, 'a.share-x' ) ) { el = event.target; } else if ( event.target.parentNode && matches( event.target.parentNode, 'a.share-x' ) ) { el = event.target.parentNode; } if ( el ) { event.preventDefault(); // If there's another sharing window open, close it. if ( typeof windowOpen !== 'undefined' ) { windowOpen.close(); } windowOpen = window.open( el.getAttribute( 'href' ), 'wpcomx', 'menubar=1,resizable=1,width=600,height=350' ); return false; } } ); } )(); var windowOpen; ( function () { function matches( el, sel ) { return !! ( el.matches && el.matches( sel ) || el.msMatchesSelector && el.msMatchesSelector( sel ) ); } document.body.addEventListener( 'click', function ( event ) { if ( ! event.target ) { return; } var el; if ( matches( event.target, 'a.share-linkedin' ) ) { el = event.target; } else if ( event.target.parentNode && matches( event.target.parentNode, 'a.share-linkedin' ) ) { el = event.target.parentNode; } if ( el ) { event.preventDefault(); // If there's another sharing window open, close it. if ( typeof windowOpen !== 'undefined' ) { windowOpen.close(); } windowOpen = window.open( el.getAttribute( 'href' ), 'wpcomlinkedin', 'menubar=1,resizable=1,width=580,height=450' ); return false; } } ); } )(); /* ]]> */ </script> </body> </html>