How End-to-End Encrypted Video Calls Actually Work

Most "encrypted" video calls are not what you think

When Zoom, Google Meet, or Microsoft Teams say your calls are "encrypted," they usually mean encryption in transit, meaning your data is protected between your device and their server. But the server itself can decrypt and process your video and audio. This means the company, or anyone who compromises their server, can access your call content.

True end-to-end encrypted video calls are different. The media is encrypted on your device and can only be decrypted by the other participants. The server relays encrypted packets but never has access to the plaintext audio or video.

How Cloak encrypts video calls

Cloak uses the WebRTC Insertable Streams API to implement true end-to-end encryption for voice and video calls. Here is how it works:

1. Frame-level encryption: every individual audio and video frame is encrypted with AES-256-GCM before it leaves your device
2. Shared session keys: call participants exchange encryption keys using X25519 key exchange, so only participants can decrypt the media
3. Encrypted server relay: on every plan, encrypted frames are forwarded through Cloak's relay. The relay never holds a key and never decrypts the content; it just routes encrypted packets
4. Hidden IP addresses: your device only ever talks to the relay, so your IP address is never exposed to the other people in the call

Every video call takes the same encrypted path

There is no connection mode to pick and nothing to configure. Every Cloak call, free or paid, travels the same way: your device encrypts each frame, the relay forwards it, and only the other participants can decrypt it. The relay never holds a key.

That gives you a privacy win people usually have to pay for. Because your device only ever connects to the relay, your IP address is never exposed to the other people in the call, on every plan.

What changes between plans is how much video you can send and receive, never how it is encrypted:

Only one stream is ever served at top quality, the one you are focused on. Everyone else arrives at the quality your plan allows.

Why frame-level encryption matters

Some platforms claim E2EE for calls but only encrypt the signaling layer, not the actual media. Cloak encrypts every frame, meaning even if someone intercepts the raw WebRTC stream, they get unintelligible encrypted data.

Combined with Cloak's zero-knowledge architecture, this means:

• Cloak cannot listen to your calls
• Cloak cannot watch your video
• Cloak cannot see your screen shares
• Even if Cloak's servers are compromised, call content remains encrypted

Encrypted screen sharing too

Screen sharing on Cloak uses the same frame-level encryption as video calls. Whether you are sharing a presentation, a code editor, or your entire desktop, every frame is encrypted before transmission. No other major chat platform offers encrypted screen sharing with this level of security.

Free plans share the screen at 720p30 and send either your camera or your screen at a time (in a one to one call you can send both), in voice channels of up to 10 people. Paid plans share at up to 1080p60 and can send camera and screen share together. Sharing your screen is a desktop and web feature. On mobile you can turn on your camera and watch everyone else.

Try encrypted calls on Cloak

Cloak's encrypted voice and video calls are on every plan, including the free one, and your IP address stays hidden from the other participants either way. Available on Windows, macOS, and Linux.

Download Cloak and experience truly private video calls, where not even the platform can listen in.

Related reading

• What Is Zero-Knowledge Encryption?
• Why Cloak Is the Best Private Discord Alternative
• The Best Private Chat Apps in 2026