End-to-end encrypted AI chat: how it works, and how Morse checks it

The Morse teamUpdated October 19, 20264 min read

Most AI chat apps say your conversations are "encrypted." Usually that means encrypted on the way to their servers (HTTPS) and encrypted on their disks. Both are good, and neither stops the company, or anyone who can make the company hand data over, from reading what you wrote. The server has to decrypt your message to send it to the model.

End-to-end encryption (E2EE) is a stronger promise: only you and the thing answering you can read the message. In a messaging app, the other end is a person's phone. In an AI chat, the other end is the computer running the model.

Why ordinary encryption isn't enough for AI chat

A language model can't answer text it can't read. So somewhere, your message has to be decrypted next to the model. With most services, that happens on hardware the provider fully controls: its engineers, its logs, and its legal obligations all sit next to your words.

What people ask AI is personal: health questions, money trouble, legal problems, and drafts they'd never show anyone. The companies holding those chats have been changing the rules, from keeping chats longer to testing ads chosen from conversations.

How a secure enclave makes E2EE possible for AI

A trusted execution environment (TEE), or secure enclave, is hardware that runs code in sealed memory. Not even the operator of the machine can look inside while it runs. The hardware can also produce an attestation: a signed statement of exactly what software is running inside, which anyone can check against the chip maker's keys.

That gives AI chat a real "other end" for end-to-end encryption:

1. The model runs inside an enclave.
2. The enclave proves what it is with an attestation.
3. Your device checks the proof, then encrypts the message with a key that exists only inside that enclave.

If the proof doesn't check out, nothing is sent. The guarantee rests on the enclave hardware and its proof working as designed, which is a far smaller thing to trust than a company's promise, and one your device checks for itself.

What Morse checks before it sends a word

In Morse's E2EE mode, the work happens in your browser, not on our servers:

• Checked before it's sent. Your browser asks the enclave for its attestation and verifies the cryptographic proof itself, including that the software inside matches the version pinned in the Morse app.
• Sealed before it leaves. Only after the checks pass does your browser encrypt the message, for that enclave alone. Our servers relay encrypted text they have no key for.
• Only you can read the reply. The enclave encrypts the response back to you, and it's decrypted only once it reaches your browser.

Every E2EE reply carries a lock you can open to see each check that passed, and a full report you can download.

The enclaves are run by third-party providers, not by Morse. To check an attestation, your browser may fetch certificate data straight from an attestation service. That service may see your IP address, but never your messages or your account.

How Morse keeps every chat private

Morse has three privacy modes you choose per chat, from the most protection to the least:

• E2EE, for anything no one should read. Your browser verifies the enclave, encrypts the message for it alone, and opens the reply on your device. Open-weight models like GLM, Kimi, and DeepSeek answer inside the enclave, and our servers relay text they have no key for. E2EE chats come with Pro, at $19 a month.
• Private, for everyday chats and web search. Open-weight models like DeepSeek, Kimi, and GLM, plus xAI's Grok, run on hosts that agreed to keep nothing, including for web search. Where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't. Private is the default for a new chat.
• Anonymous, for GPT, Claude, and Gemini. Our proxy strips your account, email, and IP address and sends the message under Morse's own account, so the provider answers without knowing it's you. The provider still sees the message, and may keep it for a limited time to check for abuse, under its own policy.

Where your chats live afterwards

E2EE protects a message on its way to the model and back. In Morse, what happens to the chat after that is the same in every mode. Your chat history is stored only in your browser, encrypted, and locked when you sign out. Morse's account holds your plan and balance, not your conversations. Unlocking the history takes two keys, one that never leaves your device and one our server gives you when you sign in, so a copy of your browser data alone can't be read. Because the history is yours alone, clearing your browser deletes it for good.

Try an end-to-end encrypted chat

If a chat is one you'd never want anyone to read, start it in E2EE, open the lock on the reply, and see every check your browser made. You can try a chat from the home page without an account, or start free with no card needed, and move to Pro, at $19 a month, for E2EE.