How encryption works on Circles

Last updated October 20, 2026

This is a plain-language guide to how Circles protects private content, what our servers can and can't see, and — just as important — where the protection stops. We think you should be able to judge it for yourself.

Public versus private

Circles has two kinds of content on purpose. Public content — public profiles, public circle landing pages, public posts and the previews creators pick for paid items — is plain text so it can be found, shared and checked for abuse. Private content is end-to-end encrypted. In the app, the teal lock marks encrypted things.

Your keys

Circles follows the per-user-key design published and reviewed by Keybase:

1. Every device has its own key pair, created in your browser. The private half stays on that device.
2. Your account has a key (the “per-user key”) that is encrypted separately to each of your approved devices. Each new version of it is signed by the previous one, forming a chain anyone can verify.
3. A new device gets your account key either from a device you already use — you approve it — or from your recovery key. Knowing your password alone is not enough to read anything.
4. Removing a device creates a new account key and shares it only with the devices you keep, so the removed device can't read anything new.
5. Your recovery key encrypts a backup of your account key (using Argon2id, a deliberately slow key-derivation function). We store only the encrypted backup. It's different from your password, and we can't reset it for you.

Conversations and circles

Each conversation and encrypted circle has a shared key, encrypted individually to each member's account key and signed by whoever created it. When someone leaves or is removed, a remaining member's device creates a new key for everyone else, so the person who left can't read anything posted afterwards. Messages and posts are encrypted with XChaCha20-Poly1305.

Photos, video and files

Every file gets its own random key. Your browser compresses video, removes photo metadata such as location, then encrypts the file in roughly 4 MB pieces before it leaves your device. Each piece is split into three shards stored in separate storage buckets, any two of which are enough to rebuild it — so losing one storage location doesn't lose your files. Video streams play by downloading and decrypting pieces as you watch.

Duplicate detection works only within your own account: the fingerprint of a file is computed with a key derived from your account key, so the same file uploaded by two people produces unrelated fingerprints.

Calls and livestreams

Calls and encrypted livestreams use frame-level encryption in the browser. Our media server forwards encrypted frames to participants without being able to decrypt them. Browsers that don't support this can't join encrypted calls — Circles refuses rather than quietly falling back to unencrypted.

Paid content

Because the server never has content keys, it can't hand them to buyers itself. After Stripe confirms a payment, the server records the purchase and asks the creator's devices (or a small service the creator can run themselves) to encrypt the key to the buyer's account key. That happens automatically while one of the creator's devices is online.

Verifying who you're talking to

The first time you talk to someone, Circles remembers their identity key (“trust on first use”) and warns you if it ever changes outside the signed key chain. To rule out an impostor completely, compare your safety number with them in person or on a call — open the chat and choose “Verify safety number”. If the numbers match, nobody is in the middle.

Reporting abuse without breaking encryption

If someone sends you something abusive, you can report it and choose to disclose that single item to our moderators. Every encrypted item carries a cryptographic commitment to its key, stored by the server. The server checks the disclosed key against that commitment and decrypts its own stored copy, so moderators see exactly what was sent — a reporter can't fabricate evidence, and the disclosure reveals nothing else. Automated scanning for known child-abuse images runs on public content only, when the operator has licensed a scanning service.

What the server can see

• Your account details: email, username, profile, birth year, and anything you make public.
• Your social graph: who you follow, your friends and blocks, which circles and conversations you're in.
• Metadata about encrypted items: who sent them, to which conversation or circle, when, their encrypted size, media type and duration.
• IP addresses and browser details for sign-ins, used for security and rate limiting.
• Payments and payouts, through Stripe.

Other protections

• Passwords are hashed with Argon2id. Optional two-factor authentication with an authenticator app.
• Session tokens are random, stored only as hashes, in secure HTTP-only cookies; you can see and sign out sessions in Settings.
• Rate limits on sign-in, messaging, uploads, reports and payments.
• A strict content security policy and no third-party scripts on signed-in pages.
• An append-only audit log of security and moderation actions, including staff viewing reports.

Known limitations

No system is perfect. These are the trade-offs we know about today:

• No per-message forward secrecy yet. Keys rotate when membership changes, so people who leave can't read new content. But within one key period, someone who steals a current key could read everything encrypted under it, past and future, until the next rotation. We plan to move conversations to MLS (the IETF Messaging Layer Security standard, RFC 9420) using an audited implementation.
• Automatic key delivery trusts the server's word. When paid or new members receive keys automatically, the creator's device relies on the server's statement that the person paid or was admitted. A malicious server operator could add a fake member and receive keys. Creators who need protection from the operator can switch key delivery to manual approval for their circle.
• Metadata is visible. As listed above, the server knows who communicates with whom, when and how much — not what was said.
• Identity is trust-on-first-use. If the very first key you see for someone is already an impostor's, only comparing safety numbers will reveal it.
• Your devices are part of the system. Anyone with access to an unlocked device of yours can read what it can read. Remove lost devices promptly in Settings → Encryption & devices.
• Public is public. Previews, public posts and public profiles are not encrypted by design.

Related: Privacy policy · Terms of service