Configure E2E Encryption

End-to-End Encryption (E2EE) uses encryption keys to ensure that only message senders and intended recipients can read messages and files. Rocket.Chat supports E2EE for private rooms and direct messages. This guide explains how to configure the default E2EE behavior across the workspace.

Important considerations before enabling E2EE
Encrypted messages do not appear in search results.
Encrypted content cannot be audited or monitored.
Bots may be unable to access encrypted messages unless they explicitly support E2EE.
Found a bug? Please report it to Rocket.Chat.

Accessing the E2EE settings

Before users can enable E2EE in conversations, a workspace administrator must first configure it at the workspace level.

To configure the E2EE settings:

Go to Manage → Workspace → Settings → End-to-end encryption.
Update the following settings based on your organization's privacy, usability, and compliance requirements:

Field	Description
End-to-end encryption	Enables or disables E2EE across the workspace. When turned on, users can create encrypted rooms and enable encryption in existing direct messages and private rooms. The remaining settings on this page take effect only while this setting is on.
Unencrypted messages in encrypted rooms	Allows users to send plain text messages in encrypted rooms. These messages are not encrypted.
Encrypt direct messages	Turns encryption on by default each time a new direct message room is created.
Encrypt private rooms	Turns encryption on by default when a new private channel, private team, or private discussion is created. The room creator can still turn encryption off.
Force end-to-end encryption on private rooms	Makes encryption mandatory for every private room created from that point on. The server rejects any attempt to create an unencrypted private room.
Encrypt files	Encrypts uploaded files that are shared inside encrypted rooms. If encryption is later disabled in a room, new files are no longer encrypted. File behavior may also be affected by your File Upload settings.
Mentions	Allows mentions (`@username`, `@all`, etc.) to work inside encrypted content. Mentioned users are notified if notifications are enabled.
Restore defaults	Resets all E2EE-related settings on this page to their original defaults. Use with caution.

Force encryption on private rooms

By default, encryption is optional for new private rooms: users choose whether to turn it on when creating a room. If your organization cannot leave that to individual choice, for example in regulated or high-security environments, you can make encryption a requirement instead of an option.

When Force end-to-end encryption on private rooms is enabled (available from Rocket.Chat 8.8.0), every private channel, private team, and private discussion created from that point on is encrypted. The room creator cannot turn encryption off, and the server rejects any attempt to create an unencrypted private room, whether from the app or through the API. Public rooms are not affected.

To enable it:

Go to Manage → Workspace → Settings → End-to-end encryption.
Enable End-to-end encryption if it is not already on. The force setting stays inactive until it is.
Enable Force end-to-end encryption on private rooms.
Click Save changes. The change applies to rooms created after you save. Private rooms that already exist keep the encryption state they were created with.

In practice, here is what changes for users when the setting is on:

New private channels, private teams, and private discussions are always created encrypted. Encryption cannot be turned off during room creation.
Creating a discussion under an unencrypted private parent room fails. To create the discussion, make the parent room public or enable encryption on it.
Public channels and public teams keep their existing encryption behavior.
Federated rooms are exempt, because federation does not support end-to-end encryption.

How it differs from Encrypt private rooms

The workspace already has a setting that pre-selects encryption for new private rooms. This setting removes the choice instead of pre-filling it.

Setting	Default	Effect on new private rooms
Encrypt private rooms	Disabled	The encryption toggle is switched on in the create-room dialog, and the creator can switch it off.
Force end-to-end encryption on private rooms	Disabled	The encryption toggle is locked on for private rooms, and the server refuses any request that asks for an unencrypted private room.

Next steps

After configuring workspace-level settings:

See the End-to-End Encryption User Guide for instructions on using E2EE in conversations.
For a deeper technical explanation of key generation, encryption mechanisms, and client behavior, refer to the End-to-End Encryption Specifications document.