WhatsApp's group video calls went from 4 participants in 2018 to 32 by 2022. That's a massive jump for an app handling 100 billion messages a day. Scaling encrypted real-time video to dozens of users at once is a serious engineering problem. Here's how they solved it—and what you can learn for your own projects.
How WhatsApp Group Video Calls Work Under the Hood
WhatsApp relies on a proprietary real-time communication stack that builds on the Signal Protocol for end-to-end encryption. Unlike one-to-one calls, group video calls require a selective forwarding unit (SFU) architecture. Each participant sends their audio and video stream to a central server, which then distributes only the streams each client needs. This reduces bandwidth on the sender side and allows the server to manage varying network conditions.
The client-side code uses a modified version of WebRTC, optimized for mobile battery life and low latency. Key components include:
- Adaptive bitrate control – The system dynamically adjusts video resolution (from 180p to 720p) and frame rate (15–30 fps) based on available bandwidth and device CPU load.
- Packet loss concealment – When UDP packets drop, the decoder interpolates missing frames to avoid visible glitches, a technique borrowed from VoIP telephony.
- Audio prioritization – The SFU gives higher priority to the active speaker’s audio stream, so speech stays clear even when video quality degrades.
For developers, this architecture highlights the trade-off between latency and quality. WhatsApp chooses to keep latency below 200 milliseconds for most calls, which means occasional resolution drops rather than buffering. Understanding these design decisions helps when building your own real-time applications.
Security and Privacy Implications for Developers
WhatsApp claims end-to-end encryption (E2EE) for all group video calls. This means the SFU never sees the decrypted media. Each client encrypts its stream with a unique per-session key derived from the group’s shared secret. The server only sees encrypted packets and routing metadata (participant IDs, timing).
However, E2EE does not eliminate all risks. Developers should be aware of the following attack surfaces:
- Endpoint compromise – If a participant’s device is infected with spyware, the attacker can access the decrypted stream locally. This is why digital hygiene (regular updates, no sideloaded apps) matters even with strong encryption.
- Metadata exposure – While call content is encrypted, WhatsApp (and its parent Meta) can see who called whom, for how long, and from which IP addresses. For privacy-sensitive projects, consider using a protocol that also obscures metadata, such as the Signal app itself.
- Key verification – WhatsApp does not display security codes for group calls by default. Developers building communication tools should implement out-of-band key verification (e.g., QR codes) so users can confirm no man-in-the-middle is present.
A practical takeaway: when auditing a video call feature, test that encryption keys rotate when a participant leaves or is removed. WhatsApp does this correctly, but many custom implementations reuse keys across sessions.
Practical Tips for Testing Video Call Features in Your Own Apps
If you are building or testing a group video call system, replicate real-world network conditions. Tools like tc (traffic control) on Linux let you simulate packet loss, latency, and bandwidth limits. For example:
sudo tc qdisc add dev eth0 root netem delay 100ms 20ms loss 5%This adds 100 ms of latency with 20 ms jitter and 5% packet loss – similar to a weak 4G connection. Run your call under these conditions and observe how the adaptive bitrate algorithm responds. Does it drop resolution gracefully? Does audio remain intelligible?
Another essential test is scalability. With 32 participants, the SFU must handle 32 inbound streams and up to 31 outbound streams per user. Stress test your server with synthetic clients that send dummy video frames. Measure CPU and memory usage on the server; WhatsApp reportedly uses a lightweight C++ SFU that can run on commodity hardware.
For security testing, use a local test environment (not production) and verify that:
- No plaintext media appears in server logs or packet captures.
- Encryption keys are tied to the call session and expire after the call ends.
- A participant cannot inject a forged stream into an ongoing call.
These checks align with the principles of defensive development: assume the network is hostile and the server is untrusted.
What This Means for Digital Hygiene and Data Protection
For end users – including developers testing their own apps – group video calls introduce unique privacy risks. The camera and microphone are active simultaneously. Malware that gains camera access can record everything. On Android, restrict app permissions to “only while using the app.” On iOS, the orange and green indicators show when the mic or camera is active.
Another risk: the call invitation link. WhatsApp generates a temporary join link that can be shared. If that link leaks, an attacker could join the call. Developers should implement expiration and revocation of invite links in their own applications. WhatsApp does not yet allow revoking a specific link after creation; the only option is to reset all group invite links.
Finally, WhatsApp’s group video calls show that strong encryption and a smooth user experience aren't mutually exclusive. The same team also tackled link previews—a feature that could leak metadata if not handled carefully. They designed a system that fetches previews without exposing the full URL to the server, a pattern worth studying. If you're building a real-time communication app, start by implementing key rotation on participant changes and testing under simulated network conditions. That's where the real engineering happens.
