Are text messages encrypted? What businesses should know

Standard SMS text messages are not end-to-end encrypted, so carriers and every system that relays them can read the content. iMessage between Apple devices is end-to-end encrypted, and RCS is in some cases, but a business text sent through any texting platform should be treated as readable by the systems it passes through. If you searched "encrypted text message" because you want to send something sensitive to a customer, the practical answer is to send a link to a place where they log in, not the sensitive data itself.

Below we cover which channels are encrypted, what encryption actually protects, what a business should never put in a text, and the patterns that let you keep texting without leaking things you shouldn't. We make Ready, a business texting platform and API, so we'll also say plainly what Ready does and doesn't do here. Ready does not offer an encryption feature for SMS, and we won't pretend otherwise.

The short version: which texts are encrypted

The row that matters most for businesses is the first one. Almost all business texting in the US is SMS over registered 10DLC numbers, and none of it is end-to-end encrypted.

On Ready, outbound message templates are also checked by an AI content screen run by an AI provider (a subprocessor) before they send, and AI writing features send the text you ask them to work on to that provider. The privacy policy has the details.

Why standard SMS isn't private

SMS was designed in the 1980s as a signaling feature, not a secure messaging system. The radio link between a phone and the cell tower is usually encrypted on modern networks, but that only protects one hop. Once the message reaches the carrier's network, it travels and is stored in plain text.

Business texting adds more hops. A message sent from an app usually goes from the app to its messaging provider, from the provider to a carrier aggregator, then to the recipient's carrier and finally to the phone. Every one of those systems can read the message, and several of them have to. Carriers scan content to filter spam and phishing, which is exactly why a registered campaign can still get messages blocked for what they say (we explain that in the content-level filtering post). Your texting provider reads inbound replies to catch STOP and process opt-outs. None of this is a flaw in a given vendor. It's how the channel works.

There are risks beyond the network too:

• Lock-screen previews. Most phones show the first line of a text without unlocking. A medical result or account balance on a lock screen is visible to anyone holding the phone.
• Shared and recycled numbers. Family members share phones, and carriers reassign disconnected numbers. The person who receives your text may not be the person who gave you the number.
• SIM swapping. An attacker who talks a carrier into moving a number to a new SIM receives every text sent to it, including one-time codes.
• Phishing look-alikes. Customers can't verify that a text really came from you, which is why scammers impersonate banks and delivery companies by SMS.

iMessage, RCS and the blue line: encrypted, with conditions

iMessage encrypts messages end to end between Apple devices, so Apple can't read them in transit. The conditions matter. If the recipient isn't on iMessage, the message falls back to SMS and loses that protection. iCloud backups of messages are only end-to-end encrypted if the user has turned on Apple's Advanced Data Protection. And encryption ends at the device: anyone who can unlock the phone can read the thread.

RCS is the newer standard that replaced SMS in Google Messages and now works on iPhones too. Chats between Google Messages users are end-to-end encrypted. Cross-platform RCS between iPhone and Android mostly isn't yet, although the industry standard now includes end-to-end encryption and support is rolling out. Business RCS, where a brand sends from a verified agent, isn't end-to-end encrypted, because the business's platform composes and receives the messages.

That last point applies to any business channel, including ours. Ready's blue line sends texts as iMessage, so they show up blue on iPhones with the business's name and photo. The blue line costs $99 a month per line, plus 6 cents a segment for each text sent or received. It's a deliverability and presentation feature, and we cover the tradeoffs in blue bubble texting for business. We don't sell it as a security feature. Your message is written and stored in a business platform before it ever reaches iMessage, and texts to Android phones go out as regular SMS from the account's regular number. Treat blue line content the same way you treat SMS content.

What an encrypted text message protects, and what it doesn't

Even a true end-to-end encrypted text message only protects the content while it moves between devices. It does not:

• Prove the recipient is the right person. If you have the wrong number, encryption delivers your secret to the wrong person.
• Stop the recipient from screenshotting, forwarding or leaving the phone unlocked.
• Hide metadata. Who texted whom and when is often still visible to the service.
• Protect the copy stored in your CRM, help desk or texting platform.
• Make the channel compliant with a regulation by itself. HIPAA, GLBA and PCI rules care about the whole handling of the data, not just transit.

For a business, encryption is the wrong place to start. Start with a simpler question: if this text were read by the wrong person, would it hurt the customer? If yes, don't put it in a text.

What a business should never send by text

Whatever channel you use, keep these out of message bodies:

1. Passwords and password-reset values. Send a reset link that expires, never the password itself.
2. Full account, card or routing numbers. The last four digits are enough for a customer to recognize the account.
3. Social Security numbers, full dates of birth, driver's license numbers. These are the raw material of identity theft.
4. Protected health information beyond logistics. "Your appointment is Tuesday at 10 AM" is logistics. A diagnosis, test result, medication or the name of a specialty clinic is health information. If you're a HIPAA-covered entity, have your compliance counsel set the line before anyone texts patients.
5. Wire or payment instructions. Changed bank details sent by text are a classic fraud pattern. Customers should never learn to trust them.
6. Security answers, PINs and gate or lockbox codes that stay valid. If a code must be sent, make it short-lived.

One-time login codes are a gray area. They're widely used and better than no second factor, but SIM swapping makes SMS the weakest second factor. If you send them, make them expire within minutes, say in the text that you'll never ask for the code, and offer an authenticator app for higher-risk accounts.

Safer patterns: send the link, not the data

The secure-link pattern

The standard approach is to text a notification and keep the sensitive content behind a login:

• Instead of: "Hi Dana, your lab results are in: A1C 7.2, LDL 160."
• Send: "Hi Dana, a new message from Lakeview Clinic is in your patient portal: https://portal.lakeviewclinic.example. Reply STOP to opt out."

• Instead of: "Your balance on account 4417-2290-1183 is $2,340.18."
• Send: "Your statement for the account ending 1183 is ready. Log in to view it: https://app.example.com/statements"

A few rules make this pattern work:

• Use your own domain. Generic link shorteners are a common spam signal and teach customers to tap unknown links. Ready's terms don't allow them: the pre-send filter sends a text with one to a content review, and a text that review blocks is billed at 5 times its normal cost. Your branded domain is easier to trust and to verify.
• Require login on the other side. A link that opens the document with no authentication is just the sensitive data with an extra step. If you use tokenized links, make them expire and limit how many times they work.
• Keep the preview boring. Assume the first line will show on a lock screen.

It also keeps costs predictable. A notification text under 160 plain characters is one segment. On Ready's Standard rate of $0.0075/segment plus a $0.0045 carrier fee, 1,000 of those notifications cost 1,000 × $0.0075 = $8 plus the carrier fees. Long texts packed with details split into several segments and cost more for less security. For reminder wording that stays on the safe side, see our appointment reminder SMS templates.

Ready's all-in prices per segment include the carrier fee but not screening: Scrub lists and Number validation, the two switches in Settings under Compliance, each add $0.003 per segment when switched on, shown as screening on your bill, and both are off by default. Unless you turn the opt-out footer off, the first text to each contact, and one again from time to time, also gets "Reply STOP to opt out" and your business name if the message does not already have them, so a text close to the segment limit can bill one more segment.

Sending it from your app

If you send from your own software, the API call is the same as any other text. The safety comes from what's in the body. With Ready's messages API, you POST /v1/messages to https://api.tryready.com with your X-API-Key header and an Idempotency-Key header (any UUID) so a retry never sends twice:

{"to": "+12125550199", "body": "Your statement for the account ending 1183 is ready. Log in to view it: https://app.example.com/statements", "consent_attested": true}

consent_attested is your promise that the recipient agreed to texts. For more on how registered sending from an app works, see A2P SMS API.

Don't invite sensitive replies

Two-way texting means customers will sometimes text you their card number or symptoms. Plan for it:

• Put "Please don't text card numbers or medical details" in templates and auto-replies.
• Train staff to move the conversation to a secure portal or a phone call, and not to repeat sensitive details back in the thread.
• Remember that replies are stored in your inbox and any connected CRM, so set retention and access rules there.

Where Ready fits, and where it doesn't

Ready is built for registered, compliant business texting, not for encrypted messaging. What we do handle is the compliance side that keeps texts going to the right, consenting people: automatic STOP and opt-out handling across campaigns, quiet-hours holds based on the recipient's area, litigator and DNC scrubbing, number validation, and a record of the sender's opt-in attestation for bulk and API sends. Those reduce risk. They don't make SMS a secure channel, and compliance remains the sender's responsibility.

If your use case requires sending sensitive content itself, such as clinical conversations or financial documents, use a secure portal or a messaging tool built for that purpose, and use SMS to tell people something is waiting.

The practical takeaway

Treat every business text as a postcard: readable along the way and possibly read by the wrong person. Keep message bodies to logistics and notifications, put anything sensitive behind a login on your own domain, and tell customers not to text you sensitive details. If you want to try that pattern, the first 20 one-to-one texts on Ready are free, with a card on file required to send; you can sign up here.

FAQ

Are SMS text messages encrypted?

Not end to end. The radio link to the tower is usually encrypted on modern networks, but carriers and the systems that relay business texts can read the content, and messages are stored in plain text along the way.

Is iMessage end-to-end encrypted?

Yes, between Apple devices. If the recipient isn't on iMessage, the message falls back to SMS. iCloud message backups are only end-to-end encrypted with Advanced Data Protection turned on.

Is RCS encrypted?

In some cases. Chats between Google Messages users are end-to-end encrypted. Cross-platform RCS between iPhone and Android mostly isn't yet, and business RCS from branded agents isn't.

Can a business send an encrypted text message to customers?

Not over standard SMS. Even business iMessage or RCS passes through the business's own platform, which handles the content before it's sent. The reliable approach is to text a link to a secure portal where the customer logs in.

Can we text patients appointment reminders?

Many practices do, keeping the text to logistics such as date, time and location, and leaving diagnoses, results and medications out. HIPAA requirements depend on your situation, so have your compliance counsel approve the templates before you send.