You’ve heard messages are “end-to-end encrypted” but don’t know what that means? Here it is without the tech.
A mailbox with a lock
Imagine sending a friend a letter. You put it into a box that only they can unlock. The postman carrying the box can see it but can’t open it. In PockyAPP the postman is our server and the box is an encrypted message. It is locked right in your phone and unlocked only in the recipient’s phone.
Who has the key
The key lives only on the devices of the people who are writing to each other. The server doesn’t have it and neither do we. That’s why we can’t read your messages, and if anyone asks us to hand them over, we have nothing to give.
New chats and groups are encrypted right away, you don’t have to turn anything on. You recognise an encrypted chat by the lock next to the name in the header and in the chat list.
Is it really the right person?
Encryption protects messages on the way, but it can’t tell whether the real friend sits on the other end. That’s what verification is for: both phones show the same row of emoji, you compare them, ideally in person or on a call, and confirm. Then you can be sure you are writing to the right person.
I lost my phone
The keys live only on devices, so if you lose all of them, you can’t get back to old messages without a backup. Turn on key backup in the app and save the recovery key outside your phone, for instance in a password manager. It’s like a spare key to your flat.
Don’t send the recovery key to anyone, not even us.
What encryption doesn’t do
The server still knows that two people are writing and when, and it sees names and profile photos. It doesn’t see the content of messages, photos and location. Whoever takes your unlocked phone can read what’s on it, which is why the app has a lock with a PIN or fingerprint.
PockyAPP is in beta and hasn’t passed an independent security audit yet. You’ll find the details on the Encryption and safety page.