Account login, identity recovery and history recovery are three different outcomes; verify each separately.
The security of a WhatsApp backup must be understood from its actual settings, not from the phrase “stored in the cloud.” WhatsApp offers end-to-end encrypted backups for Google Account and iCloud. The claim that “all WhatsApp backups are plaintext” is therefore incorrect.
At the same time, encryption of live conversations must not automatically be extended to every backup, text export or gallery photo. Each copy has its own boundary and recovery method.
When is a cloud backup covered by E2EE?
WhatsApp’s official guide says that Google Account backups without the end-to-end encrypted backup option enabled are not protected by WhatsApp E2EE. “Without WhatsApp E2EE” is not the same as “a public file without any storage encryption.” The cloud provider’s access methods and protection are a separate issue.
In its introduction of end-to-end encrypted backups, WhatsApp explained that users can protect them with a password or encryption key. The October 2025 update also introduced a passkey-based option. Check the options available in your own version and account.
Distinguish four types of copy
| Copy | Main security question |
|---|---|
| Current conversation between devices | Is the content of this conversation type actually E2EE? |
| Backup in a cloud account | Is end-to-end encrypted backup enabled, and what unlocks it? |
| Local database on the phone | What are the device’s lock, storage and app-access conditions? |
| Exported file or gallery media | Is the new copy protected and backed up separately? |
The name SQLite alone does not determine a database’s protection status. Database format, app encryption, operating-system encryption and access to keys must be considered separately. A report about one particular version or operating system cannot establish a permanent rule for all devices either.
How should you check backup settings?
- In WhatsApp, open Settings → Chats → Chat backup → End-to-end encrypted backup; the localized name or exact location may vary by version.
- Read whether it is enabled or disabled and note the protection or recovery method, without recording the recovery secret in a public place.
- Check the date and result of the last successful backup. An enabled option does not prove that the latest transfer succeeded.
- Also review the security of your Google or Apple account and its recovery methods. An encrypted backup is no reason to neglect cloud-account security.
- Follow official instructions when testing recovery; do not conduct a destructive test on the only copy of important data.
Nobody should ask you to send a password, key or recovery code in a message to “enable encryption.” The WhatsApp end-to-end encrypted backup guide explains access limitations without the required password, key or passkey.
If the cloud account or phone is at risk
Unauthorized access to a cloud account is serious, but does not by itself prove that all end-to-end encrypted backups have been read. Review unfamiliar sessions, recovery methods and security alerts from a trusted device. At the same time, establish whether the attacker also had access to an unlocked phone, the backup secret or an exported copy.
A good response depends on the type of data actually exposed, not on a vague “Google Drive hack” headline. This article does not report a new, specific incident under that title.
Livara identity recovery is not a history backup
According to Livara’s security documentation, the v7 recovery package encrypts identity keys before upload and recovers identity, not chat history. Do not present it as a documented replacement for backing up every conversation.
For every messenger, ask three separate questions: Can I log into the account? Will my identity keys return? Will old messages and attachments be recovered? A positive answer to one is not an answer to the other two.
Bottom line: A secure backup depends on settings, keys and recovery testing. Do not make the same blanket claim about every cloud or every version of a messenger.
