Skip to main content

Security & Privacy

Matrix is designed with security in mind. Understanding these features helps you make informed decisions about your privacy.

End-to-End Encryption (E2EE)​

How It Works​

Matrix uses the Olm and Megolm cryptographic protocols:

  • Olm: For 1:1 device-to-device encryption
  • Megolm: For efficient group encryption

What's Encrypted​

EncryptedNot Encrypted
Message contentRoom membership
File contentsRoom names/topics
ReactionsTimestamps
EditsSender information
RepliesMessage type

Device Verification​

Verify devices to ensure you're talking to the right person:

  1. Emoji Verification: Compare emojis displayed on both devices
  2. QR Code: Scan a QR code on the other device
  3. Cross-Signing: Your verified devices vouch for each other
✓ Verified device    - Messages are secure
⚠ Unverified device  - Could be an attacker
✗ Blocked device     - Will not receive messages

Key Management​

Secure Backup​

Critical! Set up secure backup to protect your keys:

  1. Settings → Security → Secure Backup
  2. Choose recovery method:
    • Security Key: Save a long code
    • Security Phrase: Remember a passphrase
  3. Store safely - Losing this means losing message history

Cross-Signing​

Cross-signing lets your devices trust each other:

Master Key
    │
    ├── Self-Signing Key (signs your devices)
    │       └── Device A ✓
    │       └── Device B ✓
    │
    └── User-Signing Key (signs other users)
            └── Friend's Master Key ✓

Key Requests​

When you can't decrypt a message:

  1. Client requests key from your other devices
  2. Other devices share the session key
  3. Message becomes decryptable

Privacy Considerations​

Metadata​

Even with E2EE, some information is visible:

VisibleTo Whom
Who's in roomsServer admins, other members
When messages sentServer admins
Who you messageServer admins
Room names/topicsServer admins, members

Homeserver Trust​

Your homeserver sees metadata. Choose carefully:

HomeserverTrust Level
Self-hostedFull control
Trusted providerRead their privacy policy
matrix.orgLarge, public

IP Addresses​

Your IP is visible to:

  • Your homeserver
  • Federated servers (in some cases)
  • Turn servers (for VoIP)

Use a VPN for additional privacy.

Room Security​

Private vs Public Rooms​

SettingPrivate RoomPublic Room
JoinInvite onlyAnyone
DirectoryHiddenListed
HistoryMembers onlyConfigurable

History Visibility​

Control who sees past messages:

SettingWho Can See
world_readableAnyone, even non-members
sharedAll members (current and past)
invitedFrom when they were invited
joinedOnly from when they joined

Server ACLs​

Block entire servers from a room:

{
  "type": "m.room.server_acl",
  "content": {
    "allow": ["*"],
    "deny": ["evil.server.com"],
    "allow_ip_literals": false
  }
}

Best Practices​

For Users​

  1. Enable E2EE for sensitive conversations
  2. Verify devices of important contacts
  3. Set up key backup immediately
  4. Review sessions regularly
  5. Use strong passwords or SSO
  6. Be cautious about room invites

For Admins​

  1. Enable registration limits to prevent abuse
  2. Configure rate limiting against spam
  3. Monitor federation for problematic servers
  4. Regular backups of signing keys
  5. Keep software updated
  6. Use TLS everywhere

Security Tools​

Mjolnir/Draupnir​

Moderation bots for community protection:

  • Ban list management
  • Spam detection
  • Server ACLs

Pantalaimon​

E2EE proxy for bots:

  • Allows bots to work in encrypted rooms
  • Handles key management

Reporting Security Issues​

Found a vulnerability?

Resources​

Next: Account Security →