WhatsApp is safe for everyday messages and calls, and its encryption is strong. It is not a private diary. The content of your chats is locked, but WhatsApp still knows who you are, who you talk to and roughly where you are. Most of the harm people suffer on the app doesn't break the encryption at all. It comes from someone talking them into handing over a code.
This guide covers what WhatsApp protects, what it doesn't, the real incidents of the last two years and the settings that make the most difference.
TL;DR
- Personal messages, calls, photos and videos are end-to-end encrypted by default. WhatsApp says it cannot read them.
- WhatsApp does collect metadata, including your phone number and IP address, which it uses to estimate your general location. Backups are only end-to-end encrypted if you turn that on.
- By default, one-to-one calls connect devices directly, so the other person can see your IP address. A setting relays the call through WhatsApp's servers instead.
- The biggest real risks are scams and account takeover through verification codes and linked devices, not broken encryption.
- Turn on two-step verification, check your linked devices, silence unknown callers and consider encrypted backups. Together they take about ten minutes.
Is WhatsApp safe?
WhatsApp is safe for private conversation in the sense that matters most: strangers on your network, your internet provider and WhatsApp's own servers can't read your messages. It uses end-to-end encryption built on the Signal Protocol, which is on by default and can't be switched off. It is less safe than people assume when it comes to metadata, backups and account security.
The question to ask isn't "is the app safe?" but "what am I trying to keep private, and from whom?" The table below answers it.
| What you want to protect | Protected? | Notes |
|---|---|---|
| Message and call content | Yes | End-to-end encrypted by default |
| That you use WhatsApp and when | No | WhatsApp sees account and usage data |
| Who you talk to | Partly | Metadata exists, content doesn't |
| Chat backups | Only if you opt in | End-to-end encrypted backups are optional |
| Your IP address in calls | Only if you turn on a setting | Direct connections are the default |
| Your account from takeover | Only with your help | Depends on two-step verification and what you share |
What WhatsApp protects well
Content. On WhatsApp's own privacy page, the company says your personal messages, photos, calls and more stay between you and the people you choose, so not even WhatsApp can see them. Messages are encrypted on your device and decrypted on the recipient's. Kaspersky describes the Signal Protocol behind it as open, which means researchers can examine the design. For a deeper look at what that covers, see is WhatsApp encrypted.
Delivered messages. WhatsApp's privacy policy says it builds its services so that delivered messages aren't stored by it.
Spam and scams, partly. WhatsApp says it catches and removes most spam and scam accounts before they reach you, and prompts you to verify your identity when it detects suspicious attempts to take over your account.
What WhatsApp doesn't protect
Metadata. Encryption covers what you say, not the surrounding facts. WhatsApp's privacy policy says it uses IP addresses and phone number area codes to estimate your general location, even if you don't use location features. WhatsApp is part of Meta, and the policy explains how information is shared across Meta companies in some regions.
Backups. Chat backups saved to iCloud or Google Drive are not end-to-end encrypted unless you turn on encrypted backups. WhatsApp's privacy page describes encrypted backups as something you turn on. If you skip this, anyone who gets into your cloud account can read the backup.
Reported messages. When you report a chat, WhatsApp receives recent messages from it. The company's help center says it receives up to the last five messages. That's a deliberate exception, and it applies only when someone reports.
Business chats. Messages with businesses that use the WhatsApp Business platform can be stored and processed by the business, and some business setups aren't end-to-end encrypted. Don't send a business a password or card number in a chat.
Your phone. If someone has your unlocked phone, encryption doesn't matter. Use a device lock and chat lock.
Your IP address and calls
By default, a one-to-one WhatsApp call connects the two phones directly, which gives the best quality. The cost is that each participant can see the other's IP address. WhatsApp's engineering team explained this when it introduced a fix in 2023: with peer-to-peer connections, "the IP addresses are visible to both callers on a 1:1 call", and an IP can reveal broad location or your internet provider.
The fix is a setting called Protect IP address in calls. When it's on, calls are relayed through WhatsApp's servers, so the other person can't see your address. Calls stay end-to-end encrypted. The trade-off is lower call quality. Group calls are always relayed by default. You'll find it in Settings > Privacy > Advanced. Read WhatsApp's help page for details.
This matters if you take calls from people you don't fully trust. It also means you don't need a VPN just to hide your address from the other side of a call, because WhatsApp can do it for you.
What has actually gone wrong: a short timeline
These cases show where the risk really sits.
- January 2025: Paragon spyware. WhatsApp notified about 90 Android users in over two dozen countries, including journalists, that they had been targeted with Paragon's Graphite spyware. Attackers added victims to a group and sent a PDF that exploited a zero-click flaw. WhatsApp patched it on the server side without a client update, BleepingComputer reported.
- October 2025: NSO Group. A US judge issued a permanent injunction barring NSO from targeting WhatsApp users with Pegasus. In June 2026, WhatsApp said it caught new NSO-linked phishing and asked the court to hold NSO in contempt.
- December 2025: GhostPairing. Security firm Gen Digital described a campaign in which victims were tricked into entering a pairing code, which added the attacker's browser as an invisible linked device. Gen's write-up says there was no password theft or SIM swap involved.
- January 2026: a lawsuit claims Meta can read messages. Meta called the claim categorically false. In July 2026, a judge dismissed the suit with permission to refile. We cover this in is WhatsApp encrypted.
The pattern: the encryption holds, while people and linked devices get attacked. See can WhatsApp be hacked for what to do about it.
Ten minutes of settings that matter
Do these on your phone.
- Two-step verification. Settings > Account > Two-step verification > Enable. Set a PIN you don't share. This protects your account if someone gets your SMS code.
- Linked devices. Settings > Linked Devices. Remove anything you don't recognise. This is where GhostPairing-style attacks live.
- Silence unknown callers. Settings > Privacy > Calls. Calls from unknown numbers stop ringing.
- Protect IP address in calls. Settings > Privacy > Advanced. Turn it on if you take calls from people outside your circle.
- Disable link previews. Settings > Privacy > Advanced. WhatsApp says this protects your IP address from sites whose links you send. Receiving previews doesn't expose it.
- Groups. Settings > Privacy > Groups > My contacts, so strangers can't add you.
- Encrypted backups. Settings > Chats > Chat backup > End-to-end encrypted backup, if you back up to iCloud or Google Drive.
- App lock and chat lock. Use them if others handle your phone.
- Strict Account Settings. Announced in January 2026 for people at higher risk, such as journalists. It locks the account to the most restrictive settings and blocks media and attachments from unknown senders. Settings > Privacy > Advanced.
Strict Account Settings changes how the app works, so use it if you're a likely target and skip it otherwise.
Where a VPN fits
A VPN is not part of WhatsApp's security. It is a separate layer, and it helps with a narrow set of things.
| Concern | Does a VPN help? |
|---|---|
| Someone reading your messages | No, they're already end-to-end encrypted |
| Scams and account takeover | No |
| Your IP being seen by a caller | Yes, but the built-in setting does the same |
| Your internet provider seeing that you use WhatsApp | Partly, they see the VPN connection instead |
| WhatsApp blocked on your network | Sometimes, depending on the network |
| Public Wi-Fi snooping on connection details | Yes, a VPN hides them |
If you often use airport, hotel or café Wi-Fi, our guide to what a Wi-Fi owner can see explains what a shared network learns even when your messages are encrypted. That's where Atomic VPN adds something. For the chats themselves, WhatsApp's own encryption already does the job.
The takeaway
Trust the encryption, don't trust the code request. Treat any message asking for a verification code, a pairing code or money as a scam until you've confirmed it another way. Set up two-step verification, and review linked devices.
Your messages are already encrypted. A VPN covers what a shared network can see around them.
