Discord adds end-to-end encryption to voice and video calls by default


Discord adds end-to-end encryption to voice and video calls by default

Pierluigi Paganini
May 21, 2026

Discord now enables end-to-end encryption by default for all voice and video calls, making conversations inaccessible even to the platform itself.

No announcement fanfare, no opt-in required, no settings to dig through. Discord flipped a switch on Monday and end-to-end encryption is now the default for every voice and video call on the platform. If you used Discord to call someone today, that conversation was encrypted in a way that even Discord cannot access.

“End-to-end Encryption is now standard for every voice and video call on Discord, outside of stage channels. No opt-in required.” announced Discord.

That is a bigger deal than it might sound, especially right now.

The timing is notable. Earlier this month, Meta quietly removed end-to-end encryption from Instagram’s direct messaging feature, a step backward that drew criticism but not much sustained attention. TikTok also confirmed it would not be adding end-to-end encryption to direct messages. Two of the largest social platforms in the world are moving away from private communications, while Discord moves toward it. The contrast is hard to miss.

Discord has been building toward this for a while. The company launched end-to-end encrypted voice and video calling back in 2024, initially as an opt-in feature.

“It’s been quite a journey since then. In September 2024, Stephen Birarda introduced the DAVE protocol: an open, audited end-to-end encryption protocol for audio and video. We began migrating calls on desktop and mobile and started proving that E2EE could operate at Discord’s scale without compromising the experience people expect from us.” reads the announcement. “In 2025, Clément Brisset extended DAVE to every remaining platform, including web browsers, gaming consoles, support for Discord bots/apps, and our Social SDK, helping close the gaps that had kept some calls from being fully encrypted. And at the beginning of March 2026, we completed that migration. “

Monday’s change simply made it the default for everyone, automatically, with no action needed on the user’s side. Stage channels are the only exception, those are designed for broadcast-style communication where the expectation of privacy is different.

Discord said its DAVE encryption protocol was designed to support voice and video calls across diverse devices like PCs, phones, consoles, and browsers with minimal latency. The protocol and implementation are open-source, externally audited by Trail of Bits, and covered by a bug bounty program. Discord also worked with Mozilla to fix a Firefox issue affecting encrypted calls, aiming for a seamless transition for users.

“As of early March 2026, every voice and video call on Discord, whether in DMs, group DMs, voice channels, or Go Live streams, is end-to-end encrypted by default. To complete that migration, we required all clients to support DAVE before joining a call.” continues the announcement. “We are now in the process of removing the client code that supports unencrypted fallback. After that is done, it will not be possible to fall back to unencrypted connections.”

For a platform with hundreds of millions of users, many of them younger people using Discord as their primary way to hang out with friends online, this is a meaningful baseline privacy upgrade that most of them will never have to think about. It just works, in the background, on every call.

The broader context here is worth sitting with for a moment. End-to-end encryption for messaging and calling has been a live debate for years, caught between genuine privacy advocates, law enforcement agencies that argue it hampers investigations, and platform companies navigating both. Discord has landed clearly on one side of that debate, at least for voice and video, and has done it in the most user-friendly way possible: by making it the default rather than something you have to seek out in a settings menu.

It is unclear whether Discord extends the same protection to text messages. For now, the voice and video change alone puts it ahead of most mainstream social platforms on this specific privacy dimension, at a moment when several of those platforms are going in the opposite direction.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, end-to-end encryption)







Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


U.S. CISA adds a flaw in Ivanti Endpoint Manager Mobile (EPMM) to its Known Exploited Vulnerabilities catalog

Pierluigi Paganini
May 07, 2026

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in Ivanti Endpoint Manager Mobile (EPMM) to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a flaw in the Ivanti Endpoint Manager Mobile (EPMM), tracked as CVE-2026-6973 (CVSS score of 7.1), to its Known Exploited Vulnerabilities (KEV) catalog.

Ivanti warns customers of a high‑severity zero‑day vulnerability, tracked as CVE‑2026‑6973, in Endpoint Manager Mobile that is already being exploited.

“At the time of disclosure, we are aware of very limited exploitation of CVE-2026-6973, which requires admin authentication for successful exploitation.” reads the advisory. “We are not aware of any customers being exploited by the other vulnerabilities disclosed today.”

The flaw, caused by improper input validation, allows attackers with admin privileges to execute arbitrary code on systems running EPMM 12.8.0.0 and earlier. Customers are urged to patch immediately to prevent compromise.

Ivanti EPMM 12.6.1.1, 12.7.0.1, and 12.8.0.1 address the vulnerability. The vulnerability doesn’t affect Ivanti Neurons for MDM, Ivanti’s cloud-based unified endpoint management solution, Ivanti EPM (a similarly named, but different product), Ivanti Sentry, or any other Ivanti products.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the vulnerability by May 10, 2026.

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, US CISA Known Exploited Vulnerabilities catalog)







Source link