WhatsApp messages are end-to-end encrypted:
Signal Protocol: Provides forward secrecy. Compromising one key doesn't decrypt past messages.
Key exchange: When you first message someone, devices exchange public keys. Server facilitates but can't read messages.
Per-message keys: Each message uses a unique key derived from the session. Even if one message is compromised, others remain secure.
Group encryption: Each member has the group's symmetric key. Key rotates when members leave.
Trade-off: Server can't read messages, so can't filter spam or provide search. All processing happens on device.