HTTPS is Not End-to-End Encryption

Many people tend to think HTTPS is end-to-end encrypted. But it is Not.

Click here If you are not a Medium member

There is a misconception among developers that using HTTPS provides end-to-end encryption. let’s try to clarify this misunderstanding by learning what each technology does.

What HTTPS really does

HTTPS protocol encrypts the communication layer between the client and the server. It protects users from several attacks including man in the middle attack, and packet sniffing.

HTTPS Protocol

When client sends some data (message, image, text or anything) to the server via HTTPS protocol, in-transit data is encrypted and therefore nobody can see what is being transmitted.

But after this data reached the server, it is again decrypted, therefore anyone having access to the server can read or see those data.

Problem with HTTPS is ; protected at transit but not protected at rest

How does End-to-End encryption work

Data is encrypted at the client and only the end recipient can read that data. Even the server can not read it.

end-to-end encryption

Server just becomes a message router and it can not read any message. A good example is WhatsApp. Also note that client-writer and client-reader have secret keys to encrypt and decrypt messages and server has no awareness about these keys.

Use Cases

When HTTPS is enough:

• Browsing websites
• Calling REST APIs
• Online shopping/payments
• Login forms

When E2EE is needed:

• Messaging apps
• Health data
• Financial data
• Sensitive notes
• Password managers

Which one to use

Short answer:

Use HTTPS for all web traffic. Add E2EE on top only when your system must not see user data.

Summary

• HTTPS is not end-to-end encryption
• Use end-to-end encryption only when necessary.
• HTTPS and end-to-end encryption can be used together to strengthen application security.