"A privacy layer has to be available where you need it, otherwise it's useless" — true, but where matters less than what it protects. The packet journey below shows your message passing four checkpoints: your Wi-Fi, your ISP, the app's server, and the recipient. Toggle the protection level and watch who can read it change.
Drag to rotate. The orange cube is your message; a teal shell means it's encrypted at that hop. Red cones are observers — they light up when they can read content.
The three protection levels
Transport encryption (TLS)
What the padlock in your browser means. Content is sealed between your device and the server — the coffee-shop snooper and your ISP see only where you're connecting, not what you say. But the app's server decrypts everything to process it. Roughly 95%+ of web traffic is already TLS-protected.
End-to-end encryption (E2EE)
Keys live only on the two endpoint devices (Signal protocol, WhatsApp, iMessage). The server relays ciphertext it mathematically cannot open — a breach or subpoena of the server yields gibberish. The trade-off: the provider can't offer server-side search, spam filtering, or cloud AI features on your content.
VPN / network relays
A VPN re-routes traffic through a relay, hiding your IP address from the destination and your destinations from your ISP. Crucially, it does not encrypt content beyond the relay — it shifts trust from your ISP to the VPN operator. Multi-hop systems (Tor, iCloud Private Relay) split that trust so no single party sees both who you are and where you're going.
Why "everywhere" matters
A privacy layer only works if it covers every surface you use — web, mobile, extensions. One unprotected client (say, an unencrypted desktop app syncing the same account) reintroduces a plaintext copy, and the weakest platform defines your real protection. This is why security auditors evaluate the whole client matrix, not one flagship app.