Instagram DMs No Longer Encrypted Since 8 May 2026: What Now?

Instagram quietly ended its optional end-to-end encrypted chats in 2026. Here is what changed and how to keep your messages private in practice.

Last checked: 29 October 2026 against the sources listed at the end of this guide.

#What changed on 8 May 2026?

Meta's help page says end-to-end encrypted messaging on Instagram is no longer supported as of 8 May 2026, and affected chats were shown how to download their messages. Meta told The Verge the reason was that very few people were using it.

Meta's End-to-end encryption on Instagram help page says end-to-end encrypted messaging on Instagram is no longer supported as of 8 May 2026. If you have affected chats, Instagram shows instructions for downloading any media or messages you want to keep, and on an older version of the app you may need to update first. For Meta's other end-to-end encrypted chats, the page points to WhatsApp.

#Who can read my Instagram messages now?

You, the people in the chat, and anyone who logs into either account. With standard encryption, Meta can access content, for example to enforce its rules or respond to lawful requests, as BBC News reported.

WhatsApp's About end-to-end encryption page says personal messages and calls are kept between you and the person you're talking to, and that no one outside the chat, not even WhatsApp, can read, listen to or share them. This happens automatically, with no setting to turn on.

#How do I protect my DMs?

1. Turn on two-factor authentication.
2. Check Where you're logged in in Accounts Center and remove unknown devices.
3. Do not share your login with managers or friends.
4. Move sensitive conversations to an end-to-end encrypted app such as WhatsApp.
5. Delete old chats with sensitive details.

Related guides: Instagram DM Scams in 2026: Fake Prizes, Votes and "Copyright" Messages. What If I Already Clicked?.

Instagram's Secure your Instagram account page calls two-factor authentication the single most effective step to protect an account from hackers, because it asks for a code when someone logs in from a device Instagram doesn't recognise. It also recommends a strong, unique password you haven't used elsewhere, avoiding personal details like names and birthdays, and never giving your password to anyone you don't know and trust.

Instagram's View your recent login activity page says you can see devices that recently logged into your account in Settings, under Password and security, then Where you're logged in. Choose your account, then Select devices to log out, pick the devices and tap Log out. In the older Login Activity view, tap This Wasn't Me on any login you don't recognise and follow the steps to reset your password and secure the account.

#What common mistakes should I avoid?

• Sharing sensitive documents in Instagram DMs.
• Sharing your login with a manager or agency.
• Ignoring unknown devices in Accounts Center.
• Assuming deleted messages are gone from the other person's phone.

Meta's Securing your Meta Account with two-factor authentication page says two-factor authentication asks for a code when there's a login attempt from a device Meta doesn't recognise. Turn it on in Accounts Center, under Password and security, then Two-factor authentication. You can choose an authentication app, which Meta recommends, a text message, or WhatsApp. If you lose your phone, a backup code lets you log in, and Meta says you shouldn't tap Trust this device on a public or shared device.

Instagram's Review recent emails page says you can see official Instagram emails sent in the last 14 days from Settings: open Meta Account (or Accounts Center), then Login and security, then Recent emails. Security and login emails are listed under Security. Instagram says official security messages are only sent to your email address, from @support.facebook.com, @support.instagram.com, @facebookmail.com, @mail.instagram.com or @global.metamail.com, and that Instagram will never contact you about profile security through Direct Messages.

Meta's Prohibited Commercial Practices policy says Meta prohibits content that deceives people out of money, property or personal information, including false job offers, celebrity and brand bait, investment schemes with guaranteed returns, giveaway schemes and romance schemes. It also lists links that appear to lead to legitimate sites but instead lead to scam sites. Meta says its enforcement isn't perfect and it may not detect every violation, so reporting helps.

#How do I keep the account safe while I sort this out?

• Never share a login code, password or backup code with anyone, including people who say they work for Meta, the police or a recovery service.
• Make sure the email address and phone number on the account are ones you still control, and remove any you do not recognise.
• Turn on two-factor authentication where the platform offers it, ideally with an authenticator app, and keep your backup codes somewhere offline.
• Log in only from the official app or by typing the address yourself, not from links in messages, comments or ads.
• Keep screenshots of every notice, email and step you take, with dates, in case you need them for a review or a report.
• Make one careful attempt at each official step rather than many rushed ones, because repeated failed attempts can trigger extra checks.

#When It Is Safer to Get Expert Help

Ask for help before you appeal if the account matters to your income, your business or your memories, if you have already had one appeal rejected, or if you cannot tell whether the problem is a bug, a restriction or a hack. That is where most avoidable losses happen.

AwareXone is independent and not affiliated with Meta, Instagram, Facebook, WhatsApp or Threads. Recovery work is best-effort and the platform makes the final decision.