Discord Turns On Default Encryption for Calls, Leaves Text Behind

Discord switched on end-to-end encryption by default for every voice and video call this week, finishing a migration that began with the DAVE protocol’s debut in September 2024 and now reaches the platform’s 200 million monthly active users across desktop, mobile, browser, PlayStation, and Xbox. The change covers direct messages, group calls, voice channels, and Go Live streams, with no opt-in required.

The headline win sits next to a deliberate gap. Text messages, the part of Discord most users send the most of, remain unencrypted and will stay that way for the foreseeable future, a carve-out the company says is forced by a decade of architectural choices it cannot reverse quickly.

What Just Changed on Every Discord Call

The company quietly finished the technical work in March. Discord’s own announcement waited until this week, after months of at-scale testing convinced engineers they could begin removing the client code that supported unencrypted fallback. Starting March 1, 2026, older clients without DAVE support stopped being able to join calls at all.

The footprint is unusually broad for a default-on encryption rollout. Most consumer apps that ship E2EE limit it to one or two platforms. Discord’s implementation runs on the desktop app, the mobile apps, web browsers, the PlayStation and Xbox console clients, and the third-party Discord Social SDK. The company describes it as one of the most platform-diverse end-to-end encrypted voice and video systems on the consumer internet, and the claim is hard to argue with.

Tens of millions of calls a day now flow through DAVE, the company says, on a platform with 690 million registered users. For context on the rollout’s edges, Mozilla’s Firefox required a coordinated patch before its users could be admitted to encrypted calls at all, a story that ended faster than anyone planned.

Inside the DAVE Protocol

DAVE is short for Discord Audio and Video End-to-end encryption. The protocol was designed and audited in 2024 with the public DAVE protocol specification on GitHub and a parallel security review from Trail of Bits, the New York based offensive-security firm.

The protocol borrows the strongest available primitives rather than inventing new ones. Three components carry the load:

• Per-sender symmetric keys encrypt every individual audio and video frame. Only call participants hold the key; Discord’s servers never see it.
• Messaging Layer Security (MLS, an IETF standard for scalable group key exchange) refreshes group keys whenever a participant joins or leaves, so a person who drops off cannot decrypt what happens after they go.
• Ephemeral identity keys shorten the window in which a leaked credential could be replayed, and reduce the value of any single device compromise.

Audio and video frames are routed through WebRTC encoded transforms, a relatively new browser primitive that lets developers slot encryption into the media pipeline without breaking codec negotiation. Trail of Bits published both the design review and the implementation review at launch, and Discord’s bug bounty now treats DAVE vulnerabilities as in-scope.

The architectural choice that matters most for users is simple. Audio and video are short-lived data that nobody needs to search, moderate, or back up. They are the easiest content on a platform to encrypt without breaking other features. Text is the hardest.

The Firefox Detour That Almost Broke the Plan

The cleanest engineering story in the rollout is a one-day fix. As Discord extended DAVE to web clients, the team hit a recursive deadlock in Firefox’s FrameTransformerProxy, a browser-side component that handles encoded media. Video data was arriving before the transform was ready to accept it, and the call would hang.

Rather than block Firefox users or implement a fragile workaround, Discord built Firefox from source, traced the deadlock, and submitted a patch upstream. Mozilla merged it within a day. The minimum Firefox version required to join a Discord call is now v142.0, released in late 2025.

One technical curiosity surfaced in the same write-up. Discord measured its WebAssembly encryption path against the browser-native SubtleCrypto API and found audio encryption ran 28% faster in WebAssembly, while video encryption ran 192% slower. The team kept WebAssembly anyway, accepting the video penalty in exchange for a single unified codebase across all platforms. The decision tells you something about the priorities driving the rollout: consistency over per-platform optimization.

What’s Encrypted and What Isn’t

The boundary between covered and uncovered content is sharper than most press coverage has made it sound. Stage channels, the broadcast-style audio rooms designed for large public events, stay on conventional transport encryption between client and server. Discord’s reasoning is that a Stage with thousands of listeners is functionally a livestream, not a private call, and the threat model is different.

The bottom row is the one most users will care about, and the one Discord has been least eager to talk about in plain language.

Why Discord Won’t Encrypt Your DMs

Discord’s stated position on text is that there are no current plans to encrypt it. The reason is not philosophical. It is structural.

Text features on Discord were built from the start on the assumption that messages are readable server-side. Server-side message search, the bot ecosystem, automated moderation, content filtering for child safety and extremism, spam detection, the entire trust-and-safety stack, all of it inspects message content in plaintext on Discord’s infrastructure. Encrypt the messages and every one of those features either breaks or has to be rebuilt to run on encrypted data, which means client-side, on the user’s device, with all the performance and battery costs that implies.

Many of the features people use on Discord were built on the assumption that text isn’t end-to-end encrypted, and rebuilding them to work with encryption is a meaningful engineering challenge.

The line is from Mark Smith, Discord’s vice president of core technology, in remarks accompanying the announcement. The framing matters because it sets expectations. This is not a feature waiting on a roadmap; it is a multi-year platform rebuild that touches every part of the product, from how the bot API surfaces messages to how the safety team flags grooming behaviour to how a user searches their own DM history.

Signal can encrypt text because Signal does not run bots, moderation, or server-side search. Apple can encrypt iMessage because iMessage is a thin transport, not a community platform. Discord is a community platform first, and the cost of that identity is paid in the text layer.

What This Means for Law Enforcement Access

The change rewrites part of the legal-process calculus for U.S. and foreign authorities who serve Discord with subpoenas, warrants, or emergency disclosure requests. According to figures cited from Discord’s most recent transparency disclosures, U.S. government agencies asked the company for information on user accounts or servers 3,782 times in the first half of 2024 alone.

Call audio and video are now cryptographically out of reach. Discord cannot decrypt them; the per-sender symmetric keys live only on participants’ devices. A warrant for the content of a specific voice channel session is, in practice, a warrant for material the company no longer holds in readable form.

Text is a different story. Direct messages, server messages, and the moderation logs built on top of them remain accessible to Discord under court order, the same as before. The asymmetry will likely shape how investigators target Discord-resident cases. Voice evidence becomes harder. Text evidence stays where it was.

The Bet on a Multi-Year Text Rebuild

The internal logic of the rollout is consistent. Encrypt the layer that is easiest to encrypt and most asymmetric in the user’s favor, then spend the next several years figuring out whether the harder layer is even worth the trade. The DAVE specification is public, the audit reports are public, the protocol library is open source. None of that gets text closer to encrypted, because the obstacle was never cryptographic.

If Discord ever does turn on text encryption, the bot economy, the moderation contractors, and the regulators who have started leaning on platforms to detect content proactively will all have a say in what survives. The Digital Services Act and a generation of child-safety legislation in the U.S. and U.K. assume the platform can see what is happening on it. End-to-end encryption breaks that assumption by design.

For now, the practical advice is unchanged. Speak freely on a Discord call and the conversation stays between the people on it. Type the same thought into the same channel and it sits on Discord’s servers, in plaintext, exactly as it has for the last decade. If text encryption arrives, it will arrive after a platform rebuild bigger than the call rollout that just finished, and the calendar for that work has not been written.