Guides

WhatsApp Architecture Explained: How WhatsApp Delivers Messages Securely

By Ravindra Bagale, AWS & DevOps trainer · LinkedIn · Published: 18 October 2026 · Last updated: 18 October 2026

Short answer: WhatsApp's chat servers are written mainly in Erlang, a language built for millions of long-lived connections. Messages are protected with end-to-end encryption based on the Signal protocol, so WhatsApp's servers pass along messages they cannot read. Photos and videos are encrypted on your phone and uploaded to a blob store. Since Meta bought WhatsApp in 2014, it runs in Meta's data centres. In 2024 to 2026 Meta added new privacy systems (IPLS for contacts, encrypted backups) and a Rust media library on devices.

Suppose you send a photo to your mother on WhatsApp

You are in Bengaluru and send a photo of your new flat to your mother in Kolhapur. Here is what happens:

1. Your phone already has a secure session with your mother's phone, set up with the Signal protocol.
2. Your phone encrypts the photo with a fresh random key and uploads the encrypted file to WhatsApp's blob store.
3. Your phone then sends an end-to-end encrypted message to your mother with the key and a pointer to the file.
4. This message travels over your phone's always-open connection to a WhatsApp chat server (Erlang).
5. If your mother's phone is online, the server pushes the message to it at once. If not, the encrypted message waits on the server until she comes online.
6. Her phone downloads the encrypted photo, decrypts it with the key and shows it. You see two ticks, then two blue ticks.

What architecture style does WhatsApp use?

WhatsApp is famous for doing a lot with a small team and a simple, focused design.

1. Connection servers in Erlang: each phone keeps a long-lived connection to a chat server. In 2012 one server handled over 2 million connections at once.
2. End-to-end encryption by default: the server routes messages but does not hold the keys. In 2023 WhatsApp added key transparency so people can check they are talking to the right keys.
3. Privacy-first storage (2024 to 2026): IPLS stores contact lists so that even WhatsApp cannot read them (2024), and Meta strengthened end-to-end encrypted backups (2026).
4. Rust on billions of devices (2026): WhatsApp rewrote its media-checking library in Rust to protect users from malicious files.
5. Shared Meta infrastructure: WhatsApp now runs in Meta's data centres. The detailed current server layout is not publicly shared.

WhatsApp architecture diagram (public parts)

This diagram shows only what WhatsApp or its partners have shared publicly. Press Play to follow a request step by step.

What does WhatsApp use? Main technologies

Which cloud provider does WhatsApp use?

WhatsApp uses no public cloud for its main service that is publicly known. It became part of Facebook (now Meta) in 2014 and runs in Meta-owned data centres. As of 2026 WhatsApp delivers end-to-end encrypted messaging to over 3 billion people.

How it started: Erlang and FreeBSD (2011 to 2014)

1. In January 2012 one server passed 2 million simultaneous TCP connections, after tuning FreeBSD and Erlang.
2. By 2014 WhatsApp had scaled Erlang on FreeBSD servers, split services into partitions and handled hundreds of millions of users with a small team.
3. Since then, WhatsApp has moved onto Meta's shared infrastructure. Details of that move are not publicly shared.

How does WhatsApp store data?

1. Messages are stored on your phone. The server keeps an encrypted message only until it is delivered.
2. Media is encrypted on your phone and stored as an encrypted blob.
3. Contacts can be stored privately with IPLS (2024).
4. Backups can be end-to-end encrypted (Meta, 2026).
5. Database technology for the servers today is not publicly shared.

How does WhatsApp monitor its systems?

How WhatsApp monitors its servers today is not publicly shared in detail. As part of Meta, it can use Meta's shared monitoring tools, but WhatsApp's own alerting setup is not publicly shared.

If we built an app like WhatsApp on AWS (illustrative)

Suppose you want to build "KattaChat", a chat app for a college. Here is a simple AWS layout. Real end-to-end encryption needs a proven library such as the Signal protocol; never invent your own.

1. Network: VPC, subnets, route tables, gateways

1. Create one VPC with CIDR 10.0.0.0/16 in the Mumbai region (ap-south-1).
2. Use two Availability Zones (A and B), so one AZ failing does not stop the app.
3. In each AZ make three subnets: public (load balancer, NAT gateway), private app (your code) and private data (databases, cache).
4. Attach one internet gateway (IGW) to the VPC. Public route table: 0.0.0.0/0 → IGW. This route is what makes a subnet public.
5. Private app route table: 0.0.0.0/0 → NAT gateway, so servers can download updates but nobody can connect in from the internet.
6. Private data route table: only the local VPC route. Use VPC endpoints to reach S3, DynamoDB and SQS without going over the internet.

2. Compute: where the code runs

1. ALB with WebSocket support in the public subnets.
2. Chat servers on EKS in private subnets, keeping a WebSocket per phone.
3. Workers read SQS and send push notifications.

3. Storage and databases

1. S3 stores encrypted photos; CloudFront delivers them.
2. DynamoDB holds undelivered encrypted messages, deleted after delivery.
3. ElastiCache remembers which server each online user is connected to.
4. Aurora for accounts and groups.

4. Monitoring

1. CloudWatch alarms on connection count and message delay.
2. X-Ray traces.
3. Never log message contents.

Request flow diagram

Press Play. The numbered list below the diagram lights up with each step.

WhatsApp versus our AWS design