In Ukraine's most popular messaging app, regular chats are not protected by end-to-end encryption. It works only in a separate Secret Chats mode, which must be activated manually, and is available only for conversations between two people. Groups and channels do not support it at all. This is not a rumor but an officially documented characteristic, and it was precisely this characteristic that formed the basis for the decision by government authorities regarding work devices.

What Is End-to-End Encryption

The key issue is who holds the key. With end-to-end encryption, a message is encrypted on your device and decrypted only on the recipient's device. The keys are stored by the participants in the conversation, meaning that the service transmitting the data cannot read it, even in theory. Server-side encryption works differently. The data is also encrypted, but the service itself holds the key, meaning that it is technically capable of accessing the content. The difference between these two approaches is the main issue in this entire topic, and it is precisely this difference that is obscured by statements such as the claim that all data is securely encrypted.

How It Works in the Three Main Messaging Apps

Signal applies end-to-end encryption by default to all individual and group chats, as well as voice and video calls, without requiring any switches to be turned on. For registration, it collects minimal data, essentially only a phone number and the date of the last activity. Its code is open source, and the protocol itself has undergone independent audits and became the basis for encryption in other services. In 2025, a mechanism designed to provide resilience against future quantum attacks was added. WhatsApp uses the same protocol, and end-to-end encryption also works by default for all chats and calls there. The main difference lies in metadata, since the company that owns the service collects information about whom you communicate with and how often, even though it does not have access to the content of the messages. Telegram applies end-to-end encryption only in Secret Chats. Regular chats are stored on the company's servers, and although they are encrypted while stored, the keys are held by the service. Groups and channels do not have end-to-end encryption at all, which is important because a significant part of work-related and everyday communication takes place in groups.

Ukraine's Official Position

In September 2024, the National Cybersecurity Coordination Center adopted a decision to restrict the installation and use of this messaging app on the work devices of government employees, military personnel, and employees of critical infrastructure facilities. The grounds for this decision were specifically related to the way data is stored. According to reports, in early 2026, the relevant authorities recommended that civil servants and military personnel use Signal or WhatsApp for official communications. However, there are no restrictions on ordinary citizens using the app on their personal devices. In other words, the issue concerns official use, not a ban.

What Encryption Does Not Do

Here is a section missing from most articles, even though it is the most important one. End-to-end encryption protects the content of a message while it is being transmitted, and that is where its capabilities end. It does not hide metadata, meaning the fact that communication took place, its timing and frequency, or the participants. This is often enough to analyze relationships between people, even without access to the content. It does not protect you if the device itself has been compromised. If malicious software is running on your phone, it can see messages after they have been decrypted and displayed on the screen. In other words, channel encryption does not help at all in this situation. It does not prevent the other person from taking a screenshot or forwarding your conversation. It does not protect against account theft either. If someone gains access to your account, encryption is already working for them. Nor does it protect backups. If your chats are uploaded to the cloud without separate encryption, this workaround remains possible regardless of how well the communication channel itself is protected.

What Threatens an Ordinary User

For the vast majority of people, the interception of encrypted traffic is a theoretical risk, while real problems lie elsewhere. Account theft through phishing occurs when a person enters a verification code on a fake page or dictates it to a scammer. Social engineering involves messages supposedly sent by an acquaintance asking for money. This scheme works in exactly the same way in any messaging app. Access to an unlocked phone is another risk, since the easiest way to read someone else's messages requires no technology at all. Malicious software installed by the user themselves is another threat. For this reason, switching to a secure messaging app does not replace basic security measures, such as two-factor authentication, a screen lock code, and caution when dealing with links. I wrote about these topics in detail in my articles on account security and recognizing scams.

A Practical Approach Instead of Migrating

The most common advice is to switch to the most secure messaging app. In practice, this rarely works because communication depends not on you but on where the people you communicate with are available. The practical approach is not migration but segmentation, meaning a deliberate decision about what to write and where. For news, public channels, and everyday communication, a regular messaging app is perfectly acceptable because there is nothing there that you need to hide. For work negotiations, documents, financial matters, and any sensitive information, it is worth using a messaging app with encryption enabled by default. For genuinely sensitive topics, it is also worth enabling automatic message deletion, because the safest information is information that no longer exists. This approach does not require you to convince all your acquaintances to switch to another app, while still addressing real risks.

What to Configure Right Now

Regardless of which messaging app you choose, there are several things worth doing immediately. Enable two-factor authentication, meaning an additional password required to log in. This is the main protection against account theft. Check the list of active sessions and terminate any you do not recognize. Restrict who can add you to groups and who can see your phone number. Turn off message content previews on the lock screen. Enable backup encryption if your messaging app stores backups in the cloud. Configure automatic message deletion for chats containing sensitive information. Never share your verification code with anyone, because this code is the main target of most account attacks.


Sources

The decision of the National Cybersecurity Coordination Center dated September 19, 2024; materials from the Kyiv city authorities on the risks of using the messaging app; publications by Speka and Detector Media; and KR Labs research on secure messaging apps.