What is end-to-end encryption?

End-to-end encryption is a design in which data is encrypted by the sender and decrypted only by the intended recipients, so every system in between, including the service's own server, handles nothing but ciphertext.

What counts as an end

The term comes from messaging, where the ends are people's phones and laptops. In a secrets vault the ends are wherever a value is legitimately used: a teammate's browser, a developer's terminal, a production machine, a CI job. Everything else is the middle, and the middle should never see plaintext.

How it usually works

1. Each end has a key pair. The public half is published; the private half never leaves the device.
2. The data is encrypted with a fresh symmetric key.
3. That symmetric key is encrypted separately for each recipient's public key.
4. The server stores and forwards the results without being able to open them.

Signatures usually sit next to encryption. They let a recipient check that the data came from a legitimate author and was not replaced on the way, which encryption alone does not prove.

What it does not cover

• Metadata. The server still sees who shares with whom, when, and roughly how much.
• The ends themselves. Malware, a hostile browser extension or root access on a device sees what the user sees.
• The code. If the same server delivers the app that performs encryption, a compromised server could deliver altered code.
• Copies. A recipient can copy a value after decrypting it. No protocol can take that back.

How Crunu applies it

In Crunu, encryption runs only in the browser, through WebCrypto, and in the crunu agent. Each environment has its own key, sealed separately to every recipient with X25519. Contents are encrypted with AES-256-GCM, and each version is signed by its author with Ed25519. The server stores ciphertext, public keys and signed documents, and holds no decryption key at any point in the protocol.

Crunu is direct about the gaps listed above. The server sees metadata such as organization, project, environment and machine names, email addresses, the audit log, and the size and time of each version. The main remaining risk is a tampered web client, which is why releases are signed and a local crunu.html file can check the site against the signed release. Details are in how encryption works and what the server sees.