By default, Zoom encrypts in-meeting and in-webinar presentation content at the application layer during transit using TLS 1.2 with 256-bit AES GCM encryption algorithm for the desktop and mobile clients.

For dial-in participants joining by phone, the audio is encrypted until it leaves Zoom's data centers and is transferred to the participant's phone network.

Media channel encryption can be required for H.323 and SIP devices joining Zoom meetings; this provides partial encryption for the H.323 or SIP device's connection. This setting is configured at the account level, group, or user level. Media channel encryption will also need to be enabled on these devices when joining your Zoom meeting or they will receive an error and be unable to join.

If the meeting is only partially encrypted, due to connections such as phone dial-in, SIP/H.323 devices or streaming via RTMP, meeting participants on supported devices will see a warning icon to indicate partially encrypted connections.

For additional protection, users may also enable end-to-end encryption (E2EE). End-to-end encryption requires meeting participants to join from the Zoom desktop client, mobile app, or Zoom Rooms and limits some meeting features.

Zoom Phone supports secure voice calls for connections between the Zoom Cloud and the Zoom desktop client, mobile app, web browser/client, and supported SIP devices. During call setup, Zoom Phone uses SIP over TLS 1.2 with Advanced Encryption Standard (AES) 256-bit algorithm for these connections. The Zoom desktop client, mobile app, and web browser/client connections encrypt call media to the Zoom Cloud using SRTP with AES 256-bit encryption algorithm. SIP devices configured with SRTP use AES-128 or AES-256 bit algorithm to encrypt call media for connections to the Zoom Cloud, otherwise unencrypted RTP is used as a fallback. 

Important: By default, AES-128-bit encryption is enabled for call media transmitted by supported SIP devices. Admins can upgrade SIP devices to AES-256 bit encryption using the web portal. Fax lines may not support full encryption.

This article covers:

• How to use the partially encrypted meeting warning
• To enable SIP/H.323 media channel encryption
  • Account
  • Group
  • User

Prerequisites for encrypting SIP/H.323 media channel encryption

To enable SIP/H.323 media channel encryption

• Free, Pro, Business, Enterprise, Education or API Account

To view the partially encrypted connections warning

• Zoom desktop client for Windows, macOS, or Linux: Global minimum version or higher
• Zoom mobile app for Android or iOS: Global minimum version or higher

How to use the partially encrypted meeting warning

When you are in a Zoom meeting, you will see a shield icon with a check mark  indicating that the meeting is encrypted. However, if any endpoints which cannot use encryption, or can only be partially encrypted, join the meeting, you will see a yellow shield icon with an exclamation point (!) instead. If you see a shield with a lock icon , that means the meeting is using end-to-end encryption.

You can also view details of unencrypted or partially encrypted connections by clicking the shield icon, then clicking Exceptions next to Encryption. This will list any unencrypted or partially encrypted connections.

In addition, the shield icon will display with a yellow shield icon with an exclamation point (!)  if media and signaling are not encrypted, or there are issues validating the TLS certificate:

Media encrypted	Signaling encrypted	TLS certificate valid	Shield color
Yes	Yes	Yes
Yes	Yes	No
Yes	No	No
No	No	No

Note: Due to the H.323 protocol does not support call signaling, H.323 devices will always have a yellow shield icon even though the media channels are encrypted. 

How to enable the SIP/H.323 media channel encryption

Account

1. Sign in to the Zoom web portal as an admin with the privilege to edit account settings.
2. In the navigation panel, click Account Management then Account Settings.
3. Under In Meeting (Basic), verify that Require Encryption for 3rd Party Endpoints (H323/SIP) is enabled.
4. If the setting is disabled, click the toggle to enable it. If a verification dialog displays, click Turn On to verify the change.
5. (Optional) If you want to make this setting mandatory for all users in your account, click the lock icon , and then click Lock to confirm the setting.

Group

1. Sign in to the Zoom web portal as an admin with the privilege to edit groups.
2. In the navigation panel, click User Management then Groups.
3. Click the applicable group name from the list, then click the Settings tab.
4. Under In Meeting (Basic), verify that Require Encryption for 3rd Party Endpoints (SIP/H.323) is enabled.
5. If the setting is disabled, click the toggle to enable it. If a verification dialog displays, click Turn On to verify the change.
   Note: If the option is grayed out, it has been locked at the account level and needs to be changed at that level.
6. (Optional) If you want to make this setting mandatory for all users in the group, click the lock icon , and then click Lock to confirm the setting.

User

1. Sign in to the Zoom web portal.
2. In the navigation panel, click Settings.
3. Under In Meeting (Basic), verify that Require Encryption for 3rd Party Endpoints (SIP/H.323) is enabled.
4. If the setting is disabled, click the toggle to enable it. If a verification dialog displays, click Turn On to verify the change.
   Note: If the option is grayed out, it has been locked at either the group or account level. You need to contact your Zoom admin.