Zoom End-to-End Encryption: How It Works

Yes, Zoom offers end-to-end encryption (E2EE) for meetings, but it is not enabled by default and it does not apply to every feature. When you turn it on, meeting audio, video, and screen sharing are encrypted on your device and only decrypted on the devices of other participants, so even Zoom’s servers cannot see the content. This article explains exactly how Zoom’s E2EE works, how to enable it, what it protects, and its limitations.

What End-to-End Encryption Means in Zoom

End-to-end encryption ensures that data is encrypted on the sender’s device and only decrypted on the recipient’s device. In Zoom’s case, when E2EE is enabled, the encryption keys are generated on the participants’ devices, not on Zoom’s servers. This means that even if Zoom’s servers were compromised, the meeting content would be unreadable. This is different from Zoom’s default transport encryption, where data is encrypted between your device and Zoom’s servers, but Zoom has the ability to decrypt it (for legitimate purposes like recording or lawful interception).

How to Enable End-to-End Encryption in Zoom

Zoom’s E2EE is available for all users, including free accounts, but it must be turned on by the host. Here’s how to do it:

1. Sign in to the Zoom web portal (zoom.us) as the account owner or admin.
2. Go to Account Management > Account Settings (or Group Settings if you’re a group admin).
3. Scroll to the Security section and toggle on End-to-End Encryption.
4. Choose the default encryption type: Enforce end-to-end encryption or Allow users to select. The latter lets each host choose per meeting.
5. If you want to require E2EE for all meetings, select “Enforce” and save.

Once enabled, when you schedule or start a meeting, you’ll see a shield icon with a lock in the meeting toolbar. Click it and select End-to-End Encryption to enable it for that meeting. All participants must be on Zoom desktop client version 5.4.0 or later, or the mobile app version 5.4.0 or later, to join an E2EE meeting.

What Is and Isn’t Protected by E2EE

Zoom’s E2EE protects the core meeting content: real-time audio, video, and screen sharing. However, many other features are not available when E2EE is on. Here’s a list of what is not protected or supported:

• Cloud recording – You cannot record to the cloud because Zoom would need to decrypt the stream.
• Live transcription – This requires Zoom’s servers to process audio, so it’s disabled.
• Breakout rooms – Not available in E2EE meetings (as of this writing).
• Polling – In-meeting polls are disabled.
• Reactions and emoji – These are not encrypted and are disabled.
• Phone dial-in – Participants joining by phone cannot join an E2EE meeting because phone audio is not encrypted end-to-end.
• Third-party apps and integrations – Most are disabled because they would need access to meeting data.

Also, E2EE only protects the meeting content itself. It does not encrypt chat messages sent during the meeting (chat is encrypted in transit, but not end-to-end). It also does not protect against screen capture by a participant, or against a participant recording the meeting locally with their own device.

How Zoom’s E2EE Differs from Default Encryption

Zoom’s default encryption is transport encryption (TLS) plus AES-256 for the media stream. In this mode, Zoom’s servers have the keys and can decrypt the content if needed. This is similar to how most cloud services work. With E2EE, Zoom uses a key exchange protocol based on public-key cryptography. Each participant generates a key pair, and the meeting host’s public key is used to encrypt the session key. Zoom’s servers act as a relay but never hold the private keys, so they cannot decrypt the data.

One important detail: Zoom’s E2EE does not provide perfect forward secrecy by default. That means if a participant’s device is compromised, past meetings could be decrypted. Zoom has said they are working on adding this, but it’s not available yet. For most users, this is a minor concern, but it’s worth knowing if you’re handling highly sensitive information.

Common Problems and Misconceptions

• “E2EE is on by default” – False. You must enable it in settings and then turn it on for each meeting.
• “E2EE means my meeting is completely private” – Not entirely. Zoom still knows who is in the meeting, the meeting duration, and metadata. Also, participants can screenshot or record locally.
• “I can’t use E2EE because I have a free account” – Actually, E2EE is available for free and paid accounts.
• “E2EE works with phone dial-in” – No, it doesn’t. Phone audio is not encrypted end-to-end.
• “If I enable E2EE, all my meetings will be encrypted” – Only if you enforce it. Otherwise, you must select it per meeting.

If you encounter issues, the most common cause is that a participant is using an outdated client. Update Zoom to the latest version, and ensure that your account admin hasn’t disabled E2EE.

How to Verify That E2EE Is Active

When E2EE is active in a meeting, you’ll see a green shield with a lock icon in the top-left corner of the meeting window. Clicking on it shows a green “Verified” label and a code. Participants can compare this code verbally or via a secure channel to ensure no one is intercepting. This is called the security code and it’s a hash of the meeting’s encryption keys. If the codes match on all devices, you can be confident that the meeting is end-to-end encrypted.

Note that the security code is only displayed when E2EE is on. If you see a blue shield, that means transport encryption is active, but not E2EE.

Alternatives and Comparison

Zoom is not the only platform with E2EE for video calls. Here’s a quick comparison:

• Zoom – E2EE available, but not default, and lacks forward secrecy. Free tier included.
• Microsoft Teams – Offers E2EE for one-on-one calls, but not for group meetings (as of this writing).
• Google Meet – Does not offer E2EE; uses transport encryption.
• Signal – Provides E2EE for all calls, including group calls, and is open-source. But it’s less feature-rich for business use.
• WhatsApp – E2EE for all calls, but limited to 32 participants and no screen sharing on some platforms.

If you need E2EE for a business meeting, Zoom is a solid choice, but be aware of the feature limitations. If you need absolute privacy and don’t require advanced features, Signal is the most secure option.

Frequently Asked Questions

Does Zoom have end-to-end encryption?

Yes, but it’s optional. You must enable it in your account settings and then turn it on for each meeting. Once enabled, it protects audio, video, and screen sharing from being seen by Zoom’s servers.

Is Zoom’s E2EE available for free accounts?

Yes, E2EE is available for both free and paid accounts. There’s no extra cost, but you need to use a Zoom client version 5.4.0 or later.

Can I use breakout rooms with E2EE?

No, breakout rooms are not available in E2EE meetings. This is a significant limitation for educators and facilitators. You’ll need to use transport encryption if you need breakout rooms.

Does E2EE protect my chat messages?

No, in-meeting chat is not end-to-end encrypted. It is encrypted in transit, but Zoom’s servers can access it. If you need private chat, use a separate encrypted messaging app.

Why can’t I see the E2EE option in my Zoom settings?

Your account admin may have disabled it. If you’re the admin, check your account settings under Security. Also, ensure you’re using a supported client version.

Can I record an E2EE meeting locally?

Yes, local recording is allowed, but the recording will be stored on the host’s device and is not encrypted by Zoom. Cloud recording is not available because it would require Zoom to decrypt the stream.

Related

• McAfee vs Norton: Which Antivirus Is Better?
• MCP vs CLI for Agent Tools: Fair Token Cost
• The Pirate Bay Now Lets You Stream Movies?