End-to-end encryption, often shortened to E2EE, protects a message so that it is encrypted on the sender's device and decrypted only on the intended recipient's device. The service carrying the message should not possess the keys needed to read its contents in normal operation.
In a messaging app, for example, the provider's servers can relay encrypted data without seeing the conversation. This differs from transport encryption alone, which protects traffic on the network but may still allow the service itself to read messages on its servers.
End-to-end encryption does not make every part of an exchange private. Metadata such as who contacted whom or when may still be visible, and compromised devices, unsafe backups or recipients sharing screenshots can expose content. Key verification and implementation design also matter.
When evaluating a service, check which content types and backups are actually end-to-end encrypted, how keys are managed and whether the system has undergone independent security review. Do not treat the label as a guarantee against all surveillance or compromise.