Problem framing: a blind relay at planet scale
What WhatsApp is and why end-to-end encryption changes the whole design
Problem framing: a blind relay at planet scale
WhatsApp moves on the order of a hundred billion messages a day for billions of users, and the single fact that reshapes the entire design is end-to-end encryption (E2EE): the server can never read message content. That inverts the usual chat architecture. In a server-readable system like Messenger, the backend stores plaintext, fans out, searches, and previews; in WhatsApp the backend is a blind relay — it routes and store-and-forwards opaque ciphertext, and the keys live only on the devices.
So the spine of the answer is: phone-number identity, the Signal protocol (double ratchet plus prekeys) for per-pair sessions, a store-and-forward queue that holds ciphertext only until every device acknowledges delivery and then deletes it, multi-device companion sessions, group messaging via sender-keys, and delivery/read receipts that are themselves encrypted control messages. Minimal server overhead is not a nice-to-have; because the server cannot do content work, it does very little per message, which is exactly how a tiny engineering team historically ran it at this scale.
State the blind-relay framing up front, because every later decision — no server-side search, encrypted backups, receipts as messages, fan-out per recipient device — follows from the server never holding a key.
Key Highlights
- •E2EE means the server is a blind relay that never reads content
- •Phone-number identity + Signal protocol (double ratchet + prekeys) per pair
- •Store-and-forward holds ciphertext only until delivered, then deletes
- •Minimal per-message server work is what makes planet scale cheap
- •Every downstream choice follows from keys living only on devices
Section Rescue Kit
Buzzwords to use:
Safe statements:
- "Because the server cannot read content, it does minimal per-message work, which is what makes this affordable at planet scale."
- "I will treat receipts and presence as encrypted control messages, not server-readable state."