What Is MLS Encryption? Messaging Layer Security, Explained
Part of: Encryption basics, without the jargonChecked against the IETF standard and the announcements of the companies using it.
For most of the last decade, "end-to-end encrypted" quietly meant "end-to-end encrypted, as long as the group stays small". The clever two-person protocols that made private messaging normal were never designed for a 400-person community, and they groan under it. MLS is the industry's answer: an open standard, built for groups from the start, that has gone from paper to your phone's text messages in under three years.
Short answer: MLS (Messaging Layer Security) is an open IETF standard, RFC 9420, published in July 2023, for end-to-end encrypted messaging in groups of two to thousands. In 2026 it secures encrypted RCS texts between iPhone and Android, the group keys of Discord's encrypted calls, and newer apps such as Germ on Bluesky. It protects content; like any E2EE, it does not hide metadata.
What is MLS encryption?
MLS, short for Messaging Layer Security, is a protocol for end-to-end encrypted group messaging, standardised by the Internet Engineering Task Force as RFC 9420 in July 2023. It lets every member of a group share one secret that is updated as people join, leave or refresh their keys, so the work stays manageable even in very large groups.
The full specification is public and free to read (RFC 9420). Because it is a standard rather than one company's design, independent teams can implement it, test it and check each other's work.
How does MLS work?
MLS arranges a group's keys in a tree. Each member holds the secrets on their own path through the tree, and changing one member's keys only touches that path. So adding or removing someone costs work that grows with the logarithm of the group size, instead of with every member, as in pairwise designs.
In plain terms, three things happen:
- Members publish "key packages" (public keys) to the service in advance, so they can be added while offline.
- Changes are "commits". When someone joins, leaves or refreshes keys, a commit moves the whole group to a new epoch with a fresh shared secret. Newcomers receive a welcome that lets them in from that point on.
- Messages use the current epoch's keys. The service delivers commits and messages in order but holds no keys, so it cannot read them.
Why is MLS better for large groups?
Older protocols encrypt each message separately for each member or keep a separate secret per pair, so costs grow quickly as groups grow. MLS keeps one evolving group secret and updates it efficiently. It also gives forward secrecy and post-compromise security across the whole group: old keys can't open new messages, and the group heals after a compromise.
That matters most for social networks, which are mostly groups: families, neighbourhoods, classes, clubs. Discord, for example, said it chose MLS for call keys because its group-based approach scaled better than pairwise alternatives (Discord, Sept 2024).
Who uses MLS in 2026?
MLS now protects encrypted RCS texts between iPhone and Android (iOS 26.5, supported carriers and the latest Google Messages), the key exchange in Discord's DAVE call encryption, and newer apps such as Germ, which brings end-to-end encrypted messages to Bluesky users. It is part of the GSMA's RCS Universal Profile 3.0.
| Where (checked 5 Nov 2026) | What MLS does | Source |
|---|---|---|
| RCS texts, iPhone ↔ Android | End-to-end encrypts cross-platform texts (beta in iOS 26.5; lock icon; supported carriers only) | MacRumors, 11 May 2026 |
| Discord calls (DAVE) | Group key exchange for every voice and video call except Stage channels | Discord, 18 May 2026 |
| Germ on Bluesky | End-to-end encrypted messages for Bluesky users | TechCrunch, 30 Jul 2025 |
| Nadeemi (public beta) | Private messages, group chats, Circles and voice notes, encrypted on the device (labelled "coming" until audited) | What we can and can't see |
Is MLS the same as the Signal Protocol?
No. Both are strong, open end-to-end encryption designs, but the Signal Protocol was built around conversations between pairs of devices, with groups layered on top, while MLS was designed for groups from the start and standardised at the IETF. Signal and WhatsApp use the Signal Protocol; RCS and Discord calls use MLS.
Neither is "the secure one" on its own. What decides your safety is how an app uses it: encryption on by default, keys that stay on your devices, a way to verify contacts, and an independent audit.
What does MLS not protect?
MLS protects message content and group secrets. It does not hide metadata, such as who is in a group and when messages are sent, which the delivery service handles. It cannot protect a compromised or unlocked device, and it cannot make a badly designed app safe. The standard is the foundation, not the whole house.
How does Nadeemi use MLS?
Nadeemi runs OpenMLS, an open-source MLS implementation, inside your browser or app, so private messages, group chats, Circles and voice notes are encrypted on your device. Our server is the delivery service: it orders and stores ciphertext and refuses anything unencrypted. Until an independent audit is published, we label all of it "end-to-end encryption coming".
Honest limits we publish:
- Metadata: our server knows who is in a chat and when messages are sent.
- Web vs apps: a web app depends on code the server sends each time, so it is weaker for high-risk users than a signed app.
- Public posts are public by design: encrypted in transit and at rest, readable by our server.
Details: what we can and can't see.
FAQ
What does MLS stand for? Messaging Layer Security, an IETF standard (RFC 9420, July 2023) for end-to-end encrypted group messaging.
Is MLS end-to-end encryption? Yes. Only group members' devices hold the keys; the delivery service cannot read messages.
What is RCS MLS encryption? It is how RCS Universal Profile 3.0 end-to-end encrypts texts between iPhone and Android. On iPhone it arrived in iOS 26.5, in beta, with supported carriers and the latest Google Messages.
Does Google Messages use MLS? For encrypted RCS chats with iPhones under Universal Profile 3.0, yes, according to the iOS 26.5 launch coverage.
Is MLS quantum resistant? Not by default. RFC 9420 uses today's public-key cryptography; post-quantum options are being worked on separately.
Which apps use MLS? In 2026: encrypted RCS texts, Discord calls (DAVE), Germ for Bluesky, and Nadeemi's private chats in its public beta.
Sources (checked 5 November 2026)
- IETF, RFC 9420, The Messaging Layer Security (MLS) Protocol (July 2023): https://www.rfc-editor.org/rfc/rfc9420
- MacRumors, iOS 26.5 RCS end-to-end encryption (11 May 2026): https://www.macrumors.com/2026/05/11/ios-26-5-rcs-e2ee-launch/
- Discord, every voice and video call is now E2EE (18 May 2026): https://discord.com/blog/every-voice-and-video-call-on-discord-is-now-end-to-end-encrypted
- Discord, Meet DAVE (Sept 2024): https://discord.com/blog/meet-dave-e2ee-for-audio-video
- TechCrunch, Germ brings E2EE messages to Bluesky (30 July 2025): https://techcrunch.com/2025/07/30/germ-brings-end-to-end-encrypted-messages-to-bluesky
- OpenMLS project: https://openmls.tech/
Names of other apps are trademarks of their owners, used only for comparison. Nadeemi is not affiliated with any of them.
Drafted with AI help and checked by a person on the date above.