---
title: "Configure E2E Encryption"
slug: "configure-e2e-encryption"
description: "Set up end-to-end encryption in Rocket Chat. Protect mission-critical communications with fully encrypted messaging and zero-trust security."
updated: 2026-08-24T13:46:15Z
published: 2026-08-24T13:46:15Z
canonical: "docs.rocket.chat/configure-e2e-encryption"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rocket.chat/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure E2E Encryption

End-to-End Encryption (E2EE) uses encryption keys to ensure that only message senders and intended recipients can read messages and files. Rocket.Chat supports E2EE for private [rooms](/v1/docs/rooms) and direct messages. This guide explains how to configure the default E2EE behavior across the workspace.

> [!WARNING]
> Important considerations before enabling E2EE
> 
> - Encrypted messages do not appear in search results.
> - Encrypted content cannot be audited or monitored.
> - Bots may be unable to access encrypted messages unless they explicitly support E2EE.
> 
> Found a bug? Please [report it to Rocket.Chat.](https://developer.rocket.chat/docs/contribute-through-bug-reporting)

## Accessing the E2EE settings

Before users can enable E2EE in conversations, a workspace administrator must first configure it at the workspace level.

To configure the E2EE settings:

1. Go to **Manage → Workspace → Settings → End-to-end encryption**.
2. Update the following settings based on your organization's privacy, usability, and compliance requirements:

| Field | Description |
| --- | --- |
| **End-to-end encryption** | Enables or disables E2EE across the workspace. When turned on, users can create encrypted rooms and enable encryption in existing direct messages and private rooms. The remaining settings on this page take effect only while this setting is on. |
| **Unencrypted messages in encrypted rooms** | Allows users to send plain text messages in encrypted rooms. These messages are not encrypted. |
| **Encrypt direct messages** | Turns encryption on by default each time a new direct message room is created. |
| **Encrypt private rooms** | Turns encryption on by default when a new private channel, private team, or private discussion is created. The room creator can still turn encryption off. |
| **Force end-to-end encryption on private rooms** | Makes encryption mandatory for every private room created from that point on. The server rejects any attempt to create an unencrypted private room. |
| **Encrypt files** | Encrypts uploaded files that are shared inside encrypted rooms. If encryption is later disabled in a room, new files are no longer encrypted. File behavior may also be affected by your [File Upload settings](https://docs.rocket.chat/docs/file-upload). |
| **Mentions** | Allows mentions (`@username`, `@all`, etc.) to work inside encrypted content. Mentioned users are notified if notifications are enabled. |
| **Restore defaults** | Resets all E2EE-related settings on this page to their original defaults. Use with caution. |

## Force encryption on private rooms

By default, encryption is optional for new private rooms: users choose whether to turn it on when creating a room. If your organization cannot leave that to individual choice, for example in regulated or high-security environments, you can make encryption a requirement instead of an option.

When **Force end-to-end encryption on private rooms** is enabled (available from Rocket.Chat 8.8.0), every private channel, private team, and private discussion created from that point on is encrypted. The room creator cannot turn encryption off, and the server rejects any attempt to create an unencrypted private room, whether from the app or through the API. Public rooms are not affected.

To enable it:

1. Go to **Manage → Workspace → Settings → End-to-end encryption**.
2. Enable **End-to-end encryption** if it is not already on. The force setting stays inactive until it is.
3. Enable **Force end-to-end encryption on private rooms**.
4. Click **Save changes**. The change applies to rooms created after you save. Private rooms that already exist keep the encryption state they were created with.

In practice, here is what changes for users when the setting is on:

- New private channels, private teams, and private discussions are always created encrypted. Encryption cannot be turned off during room creation.
- Creating a discussion under an unencrypted private parent room fails. To create the discussion, make the parent room public or enable encryption on it.
- Public channels and public teams keep their existing encryption behavior.
- Federated rooms are exempt, because federation does not support end-to-end encryption.

### How it differs from Encrypt private rooms

The workspace already has a setting that pre-selects encryption for new private rooms. This setting removes the choice instead of pre-filling it.

| Setting | Default | Effect on new private rooms |
| --- | --- | --- |
| **Encrypt private rooms** | Disabled | The encryption toggle is switched on in the create-room dialog, and the creator can switch it off. |
| **Force end-to-end encryption on private rooms** | Disabled | The encryption toggle is locked on for private rooms, and the server refuses any request that asks for an unencrypted private room. |

## Next steps

After configuring workspace-level settings:

- See the [**End-to-End Encryption User Guide**](https://docs.rocket.chat/docs/end-to-end-encryption-user-guide) for instructions on using E2EE in conversations.
- For a deeper technical explanation of key generation, encryption mechanisms, and client behavior, refer to the [**End-to-End Encryption Specifications**](https://docs.rocket.chat/docs/end-to-end-encryption-specifications) document.