---
title: "How do I enable encryption in Groundwire?"
topic: "Security & Encryption"
updated: 2026-05-05
canonical: https://acrobits.net/resources/knowledge-base/how-do-i-enable-encryption-in-groundwire/
summary: "Groundwire supports TLS for SIP signaling, SRTP for media, and ZRTP for end-to-end voice encryption. Enable each in Settings → SIP Accounts. Your VoIP provider must support TLS and SRTP for those layers; ZRTP is negotiated end-to-end between Groundwire users."
---

# How do I enable encryption in Groundwire?

> Groundwire supports TLS for SIP signaling, SRTP for media, and ZRTP for end-to-end voice encryption. Enable each in Settings → SIP Accounts. Your VoIP provider must support TLS and SRTP for those layers; ZRTP is negotiated end-to-end between Groundwire users.

Groundwire supports three encryption layers: [TLS](/voip-glossary/tls/) for SIP signaling, [SRTP](/voip-glossary/srtp/) for media, and [ZRTP](/voip-glossary/zrtp/) for end-to-end voice encryption. Enable each in **Settings → SIP Accounts**. Your VoIP provider must support TLS and SRTP for those layers to work; ZRTP is negotiated directly between endpoints.

## Step 1 — Enable TLS transport (signaling encryption)

To encrypt all SIP signaling, which includes call setup and registration, you'll need to enable TLS transport in Groundwire. Navigate to Settings → SIP Accounts, select your account, and change the Transport Protocol from UDP to "TLS (sips)" or "TLS (sip)". The port will automatically update to 5061. This change encrypts your signaling data, protecting it from potential eavesdropping.

It's essential to verify with your VoIP provider that they support TLS on port 5061. If you encounter call failures after enabling TLS, it may indicate that your provider does not support this protocol, and you should contact them for assistance.

## Step 2 — Enable SRTP (media encryption)

SRTP encryption secures the actual audio stream between your device and your provider's server. To enable SRTP in Groundwire, go to Settings → SIP Accounts, select your account, and then navigate to Account-Specific Settings. Here, you'll find the SRTP option, which you can enable.

Most providers that support TLS also support SRTP, making it a common encryption protocol in the VoIP industry. If you experience one-way audio after enabling SRTP, ensure that both TLS and SRTP are enabled together, as they often work in tandem for optimal security.

## Step 3 — Enable ZRTP (end-to-end encryption)

For the highest level of security, Groundwire offers ZRTP, which provides end-to-end encryption. This means that the encryption keys are negotiated directly between the two call participants, ensuring that even your VoIP provider cannot decrypt the audio. To enable ZRTP in Groundwire, go to Settings → SIP Accounts, select your account, and then tap on Secure Calls to enable ZRTP.

On the first call after enabling ZRTP, both parties will see a Short Authentication String (SAS). It's crucial to read this string aloud to verify that there is no man-in-the-middle attack. For subsequent calls, the SAS verification will be automatic.

## How do I verify encryption is active during a call?

During a call, Groundwire provides visual cues to indicate active encryption. A lock icon will appear when SRTP is active, and for ZRTP, you'll see the SAS code along with a shield icon. If no icon appears, it means encryption is not active for that call. In such cases, you should check your settings and confirm with your provider that they support the required encryption protocols. Note that for ZRTP to work, both parties in the call must support this protocol.

## Which providers support TLS, SRTP, and ZRTP?

Several [VoIP providers support the encryption protocols](/resources/knowledge-base/groundwire-compatibility/) offered by Groundwire. VoIP.ms supports both TLS and SRTP, which can be enabled in their Account Settings under the Advanced section. Twilio requires TLS by default and also supports SRTP. Telnyx offers both TLS and SRTP, and Vonage supports TLS.

ZRTP is provider-independent, as it is negotiated between the endpoints, but both softphones involved in the call must support it. When using Groundwire for both ends of a call, ZRTP is always supported.

For the wider picture on private calling, see [are there encrypted VoIP apps that don't log calls?](/blog/groundwire/are-there-encrypted-voip-apps-that-dont-log-calls/)

{
  "@context": "https://schema.org",
  "@type": "FAQPage",
  "mainEntity": [
    {
      "@type": "Question",
      "name": "How do I enable encryption in Groundwire?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Groundwire supports TLS for SIP signaling, SRTP for media, and ZRTP for end-to-end voice encryption. Enable each in Settings → SIP Accounts. Your VoIP provider must support TLS and SRTP for those layers; ZRTP is negotiated end-to-end between Groundwire users."
      }
    }
  ]
}