# How Secure Messaging works

Secure Messaging is designed to let people communicate with journalists without leaving evidence that they have done so. 

This protects sources from being identified either by the organisations they want to inform us about, or by other parties – even those with sophisticated surveillance capabilities.

It works by hiding real messages among automatically generated decoy messages.

DIVIDER

### Every Guardian app user provides cover for our sources

In order to receive content, news apps exchange data with the app providers’ servers. With the introduction of the Secure Messaging system, the Guardian app automatically inserts tiny quantities of specially encrypted information along with that regular network activity. Every Guardian app does this, whether they’re being used for Secure Messaging or not. These automatic “messages” don’t actually contain real information. But they provide what we call ~“cover”~ for when real messages do get sent to and from our journalists.

### Real messages look no different

To tip off the Guardian about a news story, you can create a Secure Messaging conversation in the Guardian mobile app. When you hit “send”, some of the “cover” data will be replaced with the text of your Secure Message. These real messages are encrypted and stored in exactly the same way as the “cover” messages. They are the same size, and they get transmitted at the same times. This makes them indistinguishable from the cover messages generated by everyone using the Guardian app.

However, once the Guardian receives both cover and real messages, our Secure Messaging system removes an outer layer of encryption to identify which are the real messages and which journalist or team they are for. The real messages are then delivered to our journalists, who decrypt the inner layer of encryption to read the content.

### Our replies are also under cover

Replies from journalists are similarly hidden in “cover” traffic from the Guardian to our mobile apps. But genuine replies can only be identified and decrypted in the app used by the person who started the conversation.

Consequently, confidential communication with the Guardian looks exactly the same as completely normal use of the Guardian mobile app to view our content.

### Sources can say they're just readers

If someone were to be accused of being a source, their Guardian app would not look different from any other Guardian app. Millions of people have the Guardian app installed simply to read our content, so having the app doesn’t prove anything.

DIVIDER

BUTTON
Frequently asked questions
Read more
button_faq
