WhatsApp publishes its own encryption design. Use of the Signal Protocol does not mean every Signal feature or rollout is present in WhatsApp.
Evidence to collect
- Check WhatsApp’s current encryption whitepaper and product-specific deployment statements.
- Separate personal chats, linked devices, business messaging, calls, and backup protection.
- An encryption verification code or application version alone does not identify the KEM used by a session.
- Without an explicit product statement and session evidence, retain unknown for post-quantum readiness. A TLS check of WhatsApp infrastructure cannot prove chat encryption.
Record the scope and result
Record the tested component, client, peer, protocol, selected algorithm, and date. Keep observed negotiation, documented capability, and unknown distinct. A failed check can reflect local tooling, certificate validation, network policy, or configuration; it does not prove that all PQC is unsupported.
Official references
Guidance reviewed 24 September 2026. Verify documentation for your deployed release; vendor capabilities and defaults change.