Learn about call and meeting encryption in Google Meet

When you communicate in Google Meet, you can use either:

• Meetings: Create or join Google Meet meetings with a link. Meetings can be scheduled or instant and are cloud encrypted.
• Calls:
  • Legacy calls
    • Formerly known as Duo, lets users ring a personal account or phone number directly in an end-to-end encrypted manner.
  • Meet calls
    • Experience upgraded mobile calls that ring directly to a Google Workspace, personal account or phone number with cloud encryption.
    • Optional end-to-end encryption is available for personal users. Learn about the transition from legacy calls to Meet.

Shared secret keys stay on the callers' devices

Your device decrypts your call's audio and video with a shared secret key. This key is created on your device and your contact's device and is deleted after the call ends. It's not shared with any server.

What's needed for a shared key

To calculate the shared key, each device needs:

• A private key, which is saved only on your device
• A public key, which is saved on Duo's servers

The first time that you set up or link your calling account in Meet, your device creates several private/public key pairs. This way, you're ready for several end-to-end encrypted calls.

How shared secret keys are created

• The devices exchange their public keys but don't reveal their private keys.
• Next, each device uses its private key and the public key from the other device to calculate the shared secret key. They use a mathematical process called cryptography.

Google servers can't decode your call

When you call someone else on Duo, your call's audio and video typically go directly from your device to their device. This connection is called peer-to-peer. The call doesn't go through a Google server.

However, sometimes a peer-to-peer connection isn't available, like if a network setting blocks it. In this case, a Google relay server passes a call's audio and video between your device and the device that you called. The server can't decode your call because it doesn't have the shared secret key.

Group calls stay private on the server

Group calls are also end-to-end encrypted. To make sure that group calls are high quality, they go through a Google server.

That server routes everyone's call audio and video to others in the group. To route calls, the server uses info about your call, like which device the video is from. The server doesn't have access to the end-to-end encryption keys and can't decrypt the media.

Group calls use multiple keys

To be part of a call that goes through a server, each group member's device automatically uses:

• A sender key to encrypt the call's audio and video. When someone starts a group call, each device exchanges this key with the other devices.
• A client-to-server key to encrypt info about the call. Each device exchanges this key with the server.

What the keys do

The keys work to:

• Encrypt your call's audio and video so that only other people in the group can hear and see it.
• Decode the audio, video and info from other people in the group call.

Keys can change during group calls

Everyone's devices exchange new sender keys if either:

• Someone leaves a group.
• A person who wasn't part of the group gets added to it during the call.

If a person in the group doesn't immediately join the group call, their device can still use everyone's sender keys. This way, that person can join the call at any time while it's live.

When the group call ends, the keys are deleted.

Optional: To add end-to-end encryption, in the pre-call screen, turn on Additional encryption.

• The feature is only available for calls made between users with personal accounts. If you turn on 'Additional encryption' and try to make a call to a business or EDU account, you get this error message: 'This person's organisation doesn't let them receive end-to-end encrypted calls'.
• Additional encryption greys out the cloud-encrypted features that aren't supported in additional encryption mode, such as:
  • In-call messages
  • Reactions
  • Polls
  • Q&A
  • Add-ons
  • The ability to report abuse

These symbols indicate the encryption type:

• Cloud encryption:
  • When you tap an empty shield it says 'This call is cloud encrypted.'
• Additional encryption:
  • When you tap a shield with a lock inside it says 'This call is using additional encryption.'
  • If you are in a call, it's a blue lock badge .

The additional encryption toggle isn't available and calls are always cloud encrypted.