← Blog
End-to-End Encryption, Explained Honestly
2026-10-21 · MurMur team
What end-to-end encryption actually means
End-to-end encryption (E2EE) is a term that gets used a lot and explained rarely. The idea is simple: a message is encrypted on your device and can only be decrypted on the device of the person you're talking to. Everyone in between — the server relaying the message, the network it travels through, the operator running that server — sees only scrambled data with no way to unscramble it.
MurMur is built this way from the ground up. There is no registration with a phone number or email: your identity is a cryptographic key, displayed as an npub. Your messages and your calls are encrypted between the two devices. The relay — a small server written in Rust, located in Europe — passes encrypted data along and can store it only in encrypted form for a limited time. It never holds the plaintext.
What E2EE protects
- Message content from the server. The relay physically cannot read what you write, even though it stores and forwards your messages.
- Content from network interceptors. Someone on the same Wi-Fi, your provider, or any intermediate node sees ciphertext, not conversation.
- Call audio and video. E2EE applies to calls, not only text.
- Stored messages after a leak. If the relay's disk is copied, what leaks is encrypted data with an unknown key and a short retention window.
What E2EE does not protect
This is the part that matters most, and it's usually glossed over.
- Metadata. Encryption hides what you said, not that you said it. The relay still sees which keys connect, when, how often, and roughly how much data moves. It cannot read plaintext, but traffic patterns are real information.
- Your counterpart. The person you're talking to can screenshot, forward, or copy the conversation. E2EE protects you from third parties, never from the recipient.
- A compromised device. If malware is on your phone or someone is watching your screen, encryption doesn't help — the attacker reads the message before it's encrypted or after it's decrypted. E2EE secures the channel, not your hardware.
- Lost keys. There is no SMS recovery, no "forgot password" link. In MurMur, your key is your account. Lose it without a backup, and the account is gone along with access to past conversations.
- Bugs. Encryption is code, and code has defects. A protocol can be sound and an implementation still flawed.
| Threat | Does E2EE help? |
|---|
| The relay operator reading your messages | Yes — that's the core point |
| Interception on Wi-Fi or by the provider | Yes |
| A leak of stored messages from the server | Mostly — only ciphertext leaks, kept for a limited time |
| Learning who talks to whom and when | No |
| Malware or someone with physical access to your phone | No |
| You losing your key | No — and there is no SMS-based recovery |
An honest note about MurMur
MurMur is a young, open-source project with a small audience. It has not gone through an independent security audit yet. The code is public, so anyone can review it — and we'd genuinely welcome such review — but "anyone can check" is not the same as "someone has checked and signed off". If your threat model requires audited software today, that's a legitimate reason to wait. We'd rather state this plainly than imply otherwise.
Two practical limitations are also worth knowing up front. As a PWA, MurMur depends on the browser it runs in: browser updates and quirks affect it like any web app. And because identity is a key rather than a phone number, backing that key up is your responsibility — it's both the strength of the model and its main sharp edge.
FAQ
- Does E2EE mean the MurMur relay can't see anything at all?
- It can't read message or call content. It does see connection-level facts: which key pairs are exchanging traffic and when, and it holds encrypted messages temporarily for delivery. That's metadata, and E2EE doesn't hide it.
- What happens if I lose my key?
- You lose the account. There's no SMS or email recovery because there's no phone number or email attached. A key backup is the only safety net.
- Why does an encrypted messenger need a server at all?
- To deliver messages when the recipient is offline, to route calls, and to deliver push notifications. The relay's job is transport and temporary encrypted storage — not reading. That's why "end-to-end" and "has a server" are not contradictory.
- Is E2EE the same as the padlock in my browser?
- No. Regular HTTPS (the padlock) encrypts traffic between you and the server, so the server can read everything. E2EE keeps the content encrypted all the way through, so only the two endpoints can read it.
- Has MurMur been security audited?
- Not yet by an external party. The source code is public on GitHub, and independent review is welcome. We consider this an open item, not a closed one.
E2EE is a strong and necessary layer, but it's one layer, not a guarantee of total safety. Knowing exactly where it ends is what makes it useful. If that trade-off set — no registration, no phone number, a relay that can't read plaintext, in exchange for key responsibility and a young, unaudited codebase — sounds reasonable to you, try MurMur at murmurchat.org. It installs as a PWA on iPhone and Android without an app store, and the source is on GitHub.