Private Messages on the Mastodon
Nothing is private on the internet
... Without first making some efforts to make it actually private first. I'll walk you through few different routes you can take to make it private, but first let's go over a few things with Mastodon and what to expect when using it.
When you connects to Mastodon website, you're connecting to an instance that runs Mastodon, Pleroma, or other software similar to Mastodon which is essentially on a server owned by someone else. When you transmit a “private” message on that website, those can be visible/readable to the site owner at anytime.
What about End to End Encryption?
End to end encryption couldn't be done from the webpage itself, because there are few problems with that idea. If you plans on writing a javascript snippet into a webpage either by patching Mastodon, developing browser plugin, or by injecting javascript into webpage via web console, all of those can be intercepted and modified by the server itself.