Discord's Encryption Model: What Each Communication Type Uses
Discord's encryption model depends on the communication type. The table below shows what each category uses.
Not E2EE
Encrypted in transit (TLS) and at rest (AES), but Discord servers can read content for moderation and safety tooling.
E2EE ✓
End-to-end encrypted via Discord's DAVE protocol using MLS. Covers DMs, Group DMs, voice channels, and Go Live. Fully deployed March 2026.
Not E2EE (Exception)
Designed for large public broadcasts. Transport-encrypted only. DAVE does not apply to Stage channels.
Uniform Zero-Knowledge E2EE
Text, group channels, voice, and video are all encrypted end-to-end. Servers hold only ciphertext. Keys never leave endpoint devices.
Text Message Confidentiality
Discord's moderation infrastructure requires server-side text access. For organizations where written communication confidentiality is the primary concern, this is the architectural distinction to evaluate.
Sources: Discord official DAVE documentation • Discord blog (March 2026 rollout) • Discord safety documentation
Based on Discord's official DAVE protocol documentation and safety/moderation documentation. Last verified: March 2026.
Architectural Comparison: Lupyd vs Discord
| Evaluation Dimension | Lupyd Architecture | Discord Architecture | Architectural Impact |
|---|---|---|---|
| Text Message Encryption | End-to-End Encrypted (Zero-Knowledge MLS) | Encrypted in Transit/At Rest (Not E2EE) | Discord text messages are stored server-side in plaintext to support moderation, AutoMod, and safety tooling. There are no current plans to change this. |
| Voice & Video (DAVE Protocol) | E2EE via Firefly MLS / Endpoint Keys | E2EE via DAVE Protocol (MLS, Rolled out Mar 2026) | Discord's DAVE protocol provides E2EE for voice/video in DMs, Group DMs, voice channels, and Go Live. Stage channels remain transport-encrypted only. This is a significant security improvement. |
| Key Management (Voice/Video) | Endpoint hardware (server has zero access) | Client-held DAVE keys; relay has no plaintext access for AV | For voice/video, both platforms use client-side key management. The architectural distinction is primarily in text messaging and group chat. |
| Text Data Retention | Server stores only encrypted ciphertext | Server stores readable text for moderation | Discord's design deliberately preserves server-side text access to run its safety infrastructure. This is an explicit architectural choice, not a vulnerability. |
| Group Chat Encryption Model | MLS TreeKEM: all group messages E2EE | Group text: server-readable; Group AV: DAVE E2EE | For organizations where text channel confidentiality matters, this distinction is the primary architectural difference to evaluate. |
Comparison reflects documented architectural properties of each platform as of 2026. Source: Discord DAVE documentation, Discord safety documentation, Lupyd zero-knowledge open specifications.
Discord is a capable communication platform, and its security architecture has evolved considerably. Understanding how Discord compares to Lupyd requires looking at exactly what Discord encrypts, where it uses end-to-end encryption, and where it intentionally does not.
What Discord Actually Encrypts
Discord's encryption works differently depending on the type of communication. The easiest way to understand the architecture is to separate it into two categories:
- Text messages: Encrypted in transit (TLS) and encrypted at rest on Discord's servers using standard AES. But they are not end-to-end encrypted. Discord's servers can read text messages, and this is intentional.
- Voice and video: End-to-end encrypted via Discord's DAVE protocol since its full rollout in early 2026. Discord's relays forward encrypted media packets but do not hold decryption keys for audio and video.
This distinction matters a great deal when evaluating Discord for private team communication.
Discord's DAVE Protocol: How Voice/Video E2EE Works
DAVE stands for Discord Audio & Video End-to-End Encryption. It is Discord's own open protocol for protecting audio and video communications, and it is built on the same IETF MLS (Messaging Layer Security) standard that underpins Lupyd's Firefly engine.
Specifically, DAVE uses MLS to manage group key exchange for voice sessions. Participants in a voice channel or Group DM hold the decryption keys on their devices. Discord's servers route the encrypted audio and video frames without being able to decode their content.
As of March 2026, Discord has fully deployed DAVE across:
- Direct Message (DM) voice and video calls
- Group DM voice and video calls
- Voice channel sessions within servers
- Go Live streams within eligible sessions
One important exception: Stage channels are not covered by DAVE. Stage channels are designed for large public broadcasts to thousands of simultaneous listeners, an operational context where private group key management does not apply.
Text Messages: The Deliberate Exception
Discord's text messages are explicitly not end-to-end encrypted, and Discord has been direct about why: the platform's content moderation infrastructure, AutoMod safety system, and many other server-side safety tools depend on Discord's ability to read message content. Rebuilding these features for an encrypted-text architecture is a significant engineering challenge, and Discord has not announced plans to pursue it.
This is not an accidental oversight; it is an intentional design decision reflecting Discord's primary use case: large open communities where platform-level moderation is part of the value proposition.
For teams communicating about sensitive research, private business discussions, or confidential coordination, this architectural limitation is worth understanding. It means that Discord text channels, by design, are accessible to Discord's servers and therefore to legal processes, internal support tools, and potentially rogue insider access in the same way as any centralized platform.
Lupyd's Architecture: Text, Voice, and Groups
Lupyd applies zero-knowledge end-to-end encryption uniformly across all communication types: direct text messages, group channels, and voice/video sessions all share the same property: Lupyd's servers handle only encrypted ciphertext and never possess decryption keys.
This is implemented via the Firefly MLS engine, which uses the IETF MLS protocol (the same underlying standard as Discord's DAVE) for group key management. The difference is scope: Lupyd extends this protection to text and group channel content, not only to audio and video.
What Teams Should Evaluate
The most important question is: what type of communication needs the most protection?
- If your team primarily needs private voice and video sessions with end-to-end encryption, Discord now provides that through DAVE, backed by an audited implementation.
- If your team needs text channel confidentiality (keeping written discussions, shared documents, and sensitive decisions unreadable to outside parties), Discord's architecture does not provide this by design.
- If your team needs uniform protection across all communication types, including text, Lupyd's zero-knowledge architecture is designed specifically for that requirement.
Neither platform is categorically superior in every scenario. The right choice depends on your specific threat model and what exactly you need to protect.
- ✓ Discord text messages are NOT end-to-end encrypted. They are stored server-side in readable form so Discord can run content moderation, AutoMod, and safety tooling.
- ✓ Discord's DAVE (Discord Audio & Video End-to-End Encryption) protocol, built on MLS, provides E2EE for voice/video in DMs, Group DMs, voice channels, and Go Live streams (fully rolled out March 2026).
- ✓ Stage channels are an explicit exception: they remain transport-encrypted only, as they are designed for large public broadcasts rather than private conversations.
- ✓ Lupyd encrypts all communication, including text, group channels, and media, using zero-knowledge MLS. Servers handle only encrypted ciphertext and never possess decryption keys.
- ✓ The primary architectural difference between the two platforms is text message confidentiality: Discord cannot offer text E2EE without redesigning its moderation infrastructure.
