Say Exactly What Encrypted Means

Security & Access · encryption, privacy, microcopy

Updated 2026-08-04

Never use encrypted as a standalone claim. It is true of almost every product on the internet and it tells the reader nothing about who can read their data.
Name which of the three you actually do, because they protect against different things:

Encrypted in transit over TLS, which protects data while it moves and lets your servers read it.
Encrypted at rest, which protects stored copies and lets your running systems read it.
End to end, which means only the participants hold the keys and you cannot read it.

Only claim end to end if you genuinely cannot read the content. It is the one claim users understand precisely, and it is the one that is most often overstated.
Say what you can still see when the content is protected. Who talked to whom, when, and how often are usually visible even in an end to end product, and users assume otherwise.
Explain the consequences the user will meet, before they meet them. Losing the key means losing the data, search may not work across protected content, and support cannot recover a message they cannot read.
Put the claim next to the thing it covers rather than only in a policy. A padlock on a chat header answers a question the privacy page never gets asked.
Avoid security theater. A lock icon on a field that is not specially protected devalues every honest indicator in the product.
Write the limits in plain language. "We cannot read your messages. We can see who you messaged and when." is worth more than a page of accurate cryptography nobody finishes.

Users cannot evaluate your cryptography, so the only thing they can judge is whether your description of it turns out to be true.