What is End-to-End
(E2E) Encryption?
E2E (end-to-end) encryption encrypts data on the sender's device so only the recipient's device can decrypt it. No intermediate server can read the content. Simple Memo takes a different privacy approach: never storing data on servers at all.
End-to-End Encryption (E2E) is an encryption scheme where data can only be decrypted at the two endpoints of a communication channel. Data is encrypted on the sender's device and is decrypted using keys held by the communicating endpoints. Servers relaying the message, network providers, and even the service operator itself cannot read the data. WhatsApp, Signal, and Proton Mail use this approach.
How E2E Encryption Works — 4 Steps
E2EE keeps decryption keys away from the relay service. The following is a conceptual overview of key agreement and message encryption, not an implementation recipe for Signal. Real protocols also need authentication and key-update mechanisms.
In-Transit vs At-Rest vs End-to-End Encryption
"We encrypt your data" can mean three different things with very different coverage. HTTPS (TLS) protects only the hop between your device and the server; at-rest encryption protects only the disks — in both cases the operator can still read the content. Only E2EE makes content unreadable to the operator.
| Aspect | In transit (TLS / HTTPS) | At rest | End-to-end |
|---|---|---|---|
| What is protected | The hop between device and server | Data on servers and disks | The whole path from sender device to recipient device |
| Who holds the key | Both device and server | The service operator | Only the two users' devices |
| Can the operator read it? | Yes (plaintext once it arrives) | Yes (the operator manages the key) | No |
| Eavesdropping on the wire | Prevented | Not addressed | Prevented |
| Server breach / insider access | Not prevented | Not prevented if keys sit alongside the data | Prevented (only ciphertext leaks) |
| Server-side search, co-editing, AI | Possible | Possible | Generally impossible (server cannot read content) |
| Typical examples | Almost every web service | Cloud storage in general | Signal, WhatsApp, iMessage, Standard Notes |
E2EE Support in Common Services
Services differ on whether E2EE is on by default, only when you enable a setting, or not part of the design at all. This summary is based on each vendor's public documentation as of September 2026; specifications change, so re-check official sources before an important decision.
| Service | E2EE | Notes |
|---|---|---|
| Signal | E2EE by default | Signal Protocol; messages, calls and attachments |
| E2EE by default | Uses the Signal Protocol; encrypted cloud backups are opt-in | |
| iMessage | E2EE between Apple devices | iCloud backups are decryptable by Apple until Advanced Data Protection is enabled |
| LINE | E2EE for 1:1 text chats | Letter Sealing (on by default); some content types are not covered |
| Gmail and ordinary email | Not E2EE | TLS in transit, provider-managed encryption at rest; the provider can read content |
| Proton Mail | E2EE between Proton users | Password-protected emails extend E2EE to external recipients |
| Standard Notes | E2EE by default | All notes are E2EE; a lost password is unrecoverable |
| Apple Notes | Depends on settings | Regular notes: Apple holds the key (E2EE with Advanced Data Protection). Locked notes are encrypted with a password-derived key |
| Notion | Not E2EE | Encryption in transit and at rest only; co-editing and search run server-side |
| Obsidian Sync | E2EE (with your own encryption password) | Obsidian cannot decrypt; the local vault itself is not encrypted |
| Simple Memo - for Obsidian | Not E2EE | On-device Outbox and send history encrypted with AES-GCM-256; bodies delivered over standard SMTP to your own inbox, never stored persistently on servers |
What E2EE Does Not Protect
E2EE protects the middle of the path, not the endpoints or their surroundings. Even with an E2EE app, leaks in practice come from these four places.
How Much Encryption Do You Need? Decide by Threat Model
Neither "anything short of E2EE is unsafe" nor "TLS is enough" is right in general. Decide who you are protecting against first, and the required level falls into three tiers.
Is Simple Memo E2E encrypted?
No. Simple Memo is not End-to-End Encrypted (E2EE). Memo bodies are delivered through standard SMTP so you (the recipient) can read them in your normal mail client (Gmail / Apple Mail / Outlook). The privacy model is "on-device encryption + data minimization" instead. For workloads requiring true E2EE, consider purpose-built services such as Standard Notes, Signal, or ProtonMail.
FAQ: E2E Encryption
What is E2E encryption?
End-to-end encryption encrypts data on the sender's device so only the recipient can decrypt it. No server or network provider in between can read the content.
Does Simple Memo use E2E encryption?
No. Memo bodies are delivered through standard SMTP so you (the recipient) can read them in your regular mail client. The privacy model is on-device AES-GCM-256 encryption for the Outbox and send history, plus a no-persistent-server-storage policy for memo bodies — data minimization, not end-to-end encryption. For workloads needing true E2EE, consider Standard Notes, Signal, or ProtonMail.
What is the difference between E2E encryption and AES-GCM?
E2E encryption is an architectural concept (who can decrypt). AES-GCM is an encryption algorithm (how to encrypt). E2E implementations may use AES-GCM internally.
How is E2EE different from TLS (HTTPS)?
TLS protects only the hop between your device and the server; once data arrives, the operator can read it. With E2EE, nobody on the path — the operator included — can read the content until it reaches the recipient's device.
Is E2EE completely secure?
No. It protects against leaks on the path and at the operator. It does not protect against a compromised device, unencrypted cloud backups, metadata, or a recipient who forwards or screenshots the content.
Is email (Gmail etc.) end-to-end encrypted?
Ordinary email uses TLS in transit and provider-managed encryption at rest, but it is not E2EE. Making it E2EE requires PGP, S/MIME, or a system where both ends participate, such as Proton Mail to Proton Mail.
References
