Security

Messages in encrypted rooms are encrypted on your device before they leave it, and only the devices of the people in the room can read them; the server only sees ciphertext. New private rooms and direct chats are encrypted from the start, and encryption cannot be turned off for a room again.

The recovery key lets a new sign-in prove it is you and read messages from before it existed. Setting up recovery creates three things: cross-signing keys, which vouch for your devices; a backup of message keys on the server, encrypted so the server cannot read it; and the recovery key itself, which is shown once. Write it down or copy it somewhere safe. If you set up recovery in another app, such as Element, use that app's recovery key or passphrase.

Verification compares seven emoji on two devices to prove that no one is in between. Both devices must show the same emoji in the same order; if they differ, cancel, and nothing is trusted. A device you verified receives the cross-signing and backup keys, so it does not need the recovery key. You can also verify other people, so you know their devices are really theirs.

⋮ → Security and recovery at the top of the room list shows this device's encryption keys and the account's state, and offers what is missing:

• Set up recovery, when the account has none yet. The server may ask for your password first.
• Unlock encrypted history: messages sent before this device signed in are encrypted with keys the device does not have. Enter the recovery key or passphrase, from this app or another one such as Element, and choose Recover. The app restores the keys from the backup, shows the messages, and verifies this device.
• Verify with another device where you are signed in: accept the request there, and when both show the same emoji, choose They match on both.

When another device asks to verify this one, the app shows the request; choose Accept and compare the emoji the same way.

Below that, Devices lists where you are signed in. Verify asks a device that is not verified yet to compare emoji, and Sign out… signs a lost or old device out after you enter your password.

To verify another person, open the room's ⋮ menu and choose Verify next to their name. They accept on their device, and you both compare the emoji. In your direct chat with them, the request is a message in the chat, as Element sends it, and Element shows it there too; elsewhere it goes to their devices. When someone asks to verify you from their app, the request shows in your direct chat and the app asks you to accept it.

At the end, Blocked users lists the people you have blocked, with Unblock, and Delete account… deletes your account, as Getting started tells.