Encryption

What is end-to-end encryption? A plain guide to who holds the keys

Almost every cloud service says your files are encrypted. What matters is who can decrypt them, and what stays visible even when the content doesn't.

Updated 5 October 2026 · 5 min read

“Your files are encrypted” appears on nearly every cloud storage page. It's usually true and rarely tells you much, because there are several kinds of encryption. What separates them is one question: who holds the key that turns the data back into something readable?

Three kinds of encryption

The Electronic Frontier Foundation's Surveillance Self-Defense guide distinguishes three situations:

• In transit (transport-layer encryption, the HTTPS padlock). It protects data while it travels from your device to the service's servers, and from there to the recipient. In the middle, the EFF explains, the service “can see unencrypted copies” of what you send.
• At rest: data stored somewhere, such as a phone, a laptop, a server or an external drive, is kept encrypted on that disk. Whether this protects you from the provider depends on who manages the key: if the provider does, the provider can decrypt.
• End-to-end: the information is turned into a secret message by its original sender and decoded only by its final recipient. In the EFF's words, no one, “including the servers of the app you are using”, can listen in. For cloud storage, the two ends are usually you and you: your device when you upload, your device when you download.

A real example: Apple's two settings

Apple's iCloud documentation shows the difference within a single service. With Standard data protection, the default, iCloud data is encrypted, but “the encryption keys are secured in Apple data centers so we can help you with data recovery”, and only certain data is end-to-end encrypted. With Advanced Data Protection, “your trusted devices retain sole access to the encryption keys for the majority of your iCloud data”. Apple adds that end-to-end encrypted data “can be decrypted only on your trusted devices”.

In both cases the data is encrypted. What changes is who can open it, and Apple's wording shows the trade-off: when the company holds the keys, it can help you recover your data; when only your devices hold them, that help isn't available in the same way.

What end-to-end encryption protects, and what it doesn't

It protects the content: the photo, the text of a contract, the figures in a spreadsheet. A server that stores end-to-end encrypted files holds data it cannot read.

It doesn't automatically hide the metadata, the information about your data. The EFF notes that metadata, such as when something was sent or an IP address, may still be collected. For cloud storage, metadata can include file names, sizes, dates, folder structure, your email address and where you connect from.

To be concrete about our own service: at LifetimeCloud, when you upload from the website, the content of your files is encrypted on your device before it leaves. The full list of the data we process is in our privacy policy. One more detail, for completeness: when you log in, your password is sent to our server, which checks it against a stored hash (it keeps only the hash, not the password).

Why a lost password can mean lost data

If only you hold the key, nobody else can hand it back to you. At LifetimeCloud the key that opens your files is protected with a key derived from your password, in your browser. There is no password reset by email for your files, and support has no way to reset your password and keep your files readable.

The way out is the recovery key: 64 characters in 8 groups, offered after your first upload. With it, “Lost your password? Recover account” on the login page lets you choose a new password and your files stay readable. Without your password and without the recovery key, nobody can open the encrypted files again: not you, not our support, not us. Read why the recovery key matters before you need it.

How to check whether a service is really end-to-end

You don't need to read source code. These questions get you most of the way:

1. Can they reset your password and keep your files? If a forgotten password is fixed with an email link and all your files are still there and readable, the company, or a system it runs, can reach your key. That's closer to Apple's standard model than to end-to-end.
2. Does the website ever show you your files without your password? If your files open after a login that never asked for your password or another secret only you hold (for example, only a code sent by email), ask the company where the key comes from in that case.
3. Is there a recovery key? A service that cannot recover your data needs to give you a way to do it yourself, such as a key you save. If recovery is easy and needs nothing you stored, ask why.
4. What does the privacy policy say they can see? Look for a list of metadata: file names, sizes, dates, IP addresses. A service that is clear about what it encrypts should also be clear about what it doesn't.
5. Are uploads through other routes covered? Apps, sync clients and protocols such as WebDAV may not follow the same rules as the website. At LifetimeCloud, files uploaded through WebDAV (rclone, Cyberduck, a network drive) are stored as they arrive: protected in transit by HTTPS, but not end-to-end encrypted, and share links for those files serve them unencrypted. If you use WebDAV, encrypt before uploading with an rclone “crypt” remote, which encrypts file names too by default, or upload from the website instead.

Run the same questions on the service you use today. For one common case, see is Google Drive private?

Where LifetimeCloud fits

When you upload from the website, the content of your files is encrypted on your device before it leaves, with AES-256-GCM and a key derived from your password (PBKDF2). When you share, each link gets its own key, placed after the # in the address, a part the browser doesn't send to the server; you can add a password, an expiry and a download limit, as explained in how to share large files privately.

The free plan gives you 1 GB with no card, so you can check all of this yourself. Paid plans are a one-time payment with no subscription; current prices are on the plans page.