Encryption in chat
Direct messages in meil are end-to-end encrypted from the very first message. Messages are locked on your device and can only be opened by you and the person you're writing to — not by the server, not by meil and not by WAYSCloud. Rooms can be encrypted the same way when you create them.
What is encrypted
| Conversation | Encryption |
|---|---|
| Direct message | Always end-to-end encrypted. |
| Room with End-to-end encryption ticked | End-to-end encrypted. The choice can't be changed once the room has been created. |
| Room without it ticked | Standard room. The messages are stored readable on the server. |
| Project room (beta) | Standard room. |
Encrypted conversations have a padlock in the conversation list and the badge Only you two can read this at the top of the conversation. Unencrypted rooms show Standard room. Attachments can only be sent in encrypted conversations — see Files, images and audio.
Choose encryption when you create the room
The End-to-end encryption (secure room — can't be changed later) tick box in New room is the only place you decide this. A standard room can't be encrypted afterwards, and a secure room can't be turned into a standard one.
Set up recovery
Because you are the only one with the keys, set up recovery the first time you use Chat. Otherwise your message history can be lost if you lose all your devices.
- Click Set up now in the “Your chat is encrypted.” banner, then Set up encryption in the Secure your messages dialog.
- Chat creates a recovery key and shows it once, under Save your recovery key. Click Copy and keep it in a password manager or somewhere else safe.
- Tick I've saved my recovery key somewhere safe and click Done.
You can send and receive messages before the setup is finished; the banner stays put until you're done. Remind me later hides it for this visit.
The key can't be brought back
If you lose your recovery key and every signed-in device, nobody — not meil, not WAYSCloud — can recover your history. If you have a phone and a PC, sign in on both; an extra device makes recovery far easier.
The status at the top of the conversation list
At the top of Conversations, a status button shows how recovery stands. Click it to do whatever is missing.
| Status | What it means |
|---|---|
| Protected | Recovery is set up. |
| Recovery missing | Your messages are encrypted, but you can lose the history if you lose the device. Set up recovery. |
| Verify | This device has to be verified before it can unlock the history. |
| Key backup missing | The device is trusted, but the encrypted key backup is missing. Chat doesn't create a new one automatically. Click Try again, and contact support if it's still missing. |
| Check recovery | Chat couldn't confirm that the key backup is healthy. Click Try again; nothing changes automatically. |
Protected is about recovery, not about whether the messages are encrypted. Encrypted conversations are encrypted no matter which status is shown.
A new device: verify it
When you sign in to Chat on a new device, it doesn't have the keys to your earlier messages. Older messages appear as “Waiting for encryption key…” until the device has been verified. Click Verify in the banner and pick one of the two ways in the Verify this device dialog:
Approve from another device
- Click Approve from another device. The new device shows “Waiting for approval…”.
- Open Chat on a device you already use. A new device wants access appears there. Click Approve only if it was you who just signed in — otherwise Reject.
- Both devices show a set of symbols under Do these symbols match? Check that they are exactly the same, then click They match on both. If they differ, click They don't match.
Enter your recovery key
Paste the whole key into the Recovery key field and click Verify. If it isn't accepted, check that you copied the entire key.
Once the device is verified you see “Device verified”, and the message history unlocks on the new device.
Lost your key?
If you still have a verified device, you can approve new devices from it and don't need the key. With neither the key nor a verified device, the history can't be recovered. The Lost your key? Set up a new one link in the verification dialog creates a fresh setup, so new messages are protected from here on.
Email encryption is a different matter and is covered under Encrypted email.