GUIDELINE 03

Use end-to-end encryption intentionally

Encrypt private payloads for the recipient before they leave the browser, while treating routing metadata as visible unless the protocol explicitly hides it.

← All guidelines

Use E2E when

Only the intended wallet holder should read the content.
Storage nodes, relays, and application servers do not need the plaintext.
You have designed key recovery and device-change behavior.

Do not promise more than it provides

Encryption does not validate that you selected the correct recipient address.
Wallet addresses, timing, sizes, and other metadata may remain observable.
Losing the decrypting key can make the content unrecoverable.
Escape decrypted user content before rendering it; encryption does not make HTML safe.

Encrypt for a recipient wallet

const encoder = new TextEncoder();
const decoder = new TextDecoder();

const encrypted = itza.encrypt_payload(
  recipientAddress,
  encoder.encode(message)
);

// Send/store encrypted, never message.
const plaintext = decoder.decode(
  itza.decrypt_payload(recipientWallet.keypair, encrypted)
);
output.textContent = plaintext;

Bottom line

Encrypt at the edge, decrypt only for the intended user, and explain both metadata exposure and recovery limits in the product.