---
title: "How do I enable encryption in Groundwire?"
topic: "Security & Encryption"
updated: 2026-07-09
canonical: https://acrobits.net/resources/knowledge-base/how-do-i-enable-encryption-in-groundwire/
summary: "Enable encryption in Groundwire under Settings → SIP Accounts, where three layers are available: TLS for SIP signaling, SRTP for media, and ZRTP for end-to-end voice encryption. Your VoIP provider must support TLS and SRTP for those layers to work; ZRTP is negotiated directly between endpoints."
---

# How do I enable encryption in Groundwire?

> Enable encryption in Groundwire under Settings → SIP Accounts, where three layers are available: TLS for SIP signaling, SRTP for media, and ZRTP for end-to-end voice encryption. Your VoIP provider must support TLS and SRTP for those layers to work; ZRTP is negotiated directly between endpoints.

Enable encryption in Groundwire under **Settings → SIP Accounts**, where three layers are available: [TLS](/voip-glossary/tls/) for SIP signaling, [SRTP](/voip-glossary/srtp/) for media, and [ZRTP](/voip-glossary/zrtp/) for end-to-end voice encryption. Your VoIP provider must support TLS and SRTP for those layers to work; ZRTP is negotiated directly between endpoints.

## Step 1: enable TLS transport for signaling

Enable TLS transport in Groundwire to encrypt SIP signaling, including call setup and registration. Navigate to Settings → SIP Accounts, select your account, and change the Transport Protocol from UDP to "TLS (sips)" or "TLS (sip)". The port will automatically update to 5061. This encrypts signaling data.

Your VoIP provider must support TLS on port 5061. If calls fail after you enable TLS, your provider may not support it.

## Step 2: enable SRTP for media

SRTP encryption secures the actual audio stream between your device and your provider's server. To enable SRTP in Groundwire, go to Settings → SIP Accounts, select your account, and then navigate to Account-Specific Settings. Here, you'll find the SRTP option, which you can enable.

Many providers that support TLS also support SRTP. If you experience one-way audio after enabling SRTP, confirm that both TLS and SRTP are enabled.

## Step 3: enable ZRTP for end-to-end encryption

Groundwire also offers ZRTP for end-to-end encryption. ZRTP negotiates keys directly between the two call participants, so the provider cannot decrypt the audio. To enable ZRTP in Groundwire, go to Settings → SIP Accounts, select your account, and then tap on Secure Calls to enable ZRTP.

On the first call after enabling ZRTP, both parties will see a Short Authentication String (SAS). Read the SAS aloud to verify the call. After the first call, SAS verification may be automatic.

## How to verify encryption during a call

During a call, a lock icon appears when SRTP is active, and ZRTP shows the SAS code and a shield icon. If no icon appears, encryption may not be active for that call; check your settings and confirm your provider supports the required protocols. For ZRTP, both parties in the call must support it.

## Which providers support TLS, SRTP, and ZRTP

Several [VoIP providers support the encryption protocols](/resources/knowledge-base/groundwire-compatibility/) offered by Groundwire. VoIP.ms supports both TLS and SRTP, which can be enabled in their Account Settings under the Advanced section. Twilio requires TLS by default and also supports SRTP. Telnyx offers both TLS and SRTP, and Vonage supports TLS.

ZRTP is provider-independent, as it is negotiated between the endpoints, but both softphones involved in the call must support it. When both ends of the call use Groundwire, ZRTP is supported.

For the wider picture on private calling, see [are there encrypted VoIP apps that don't log calls?](/blog/groundwire/are-there-encrypted-voip-apps-that-dont-log-calls/)

{
  "@context": "https://schema.org",
  "@type": "FAQPage",
  "mainEntity": [
    {
      "@type": "Question",
      "name": "How do I enable encryption in Groundwire?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enable encryption in Groundwire under Settings → SIP Accounts, where three layers are available: TLS for SIP signaling, SRTP for media, and ZRTP for end-to-end voice encryption. Your VoIP provider must support TLS and SRTP for those layers to work; ZRTP is negotiated directly between endpoints."
      }
    }
  ]
}