The basic idea
Encryption is a way of scrambling information so that only people with the right secret can read it. The original message is called plaintext. After scrambling, it becomes ciphertext, which looks like meaningless noise. Anyone who intercepts the ciphertext but lacks the secret should not be able to make sense of it.
The idea is very old. Ancient ciphers shifted letters of the alphabet by a fixed amount, which is easy to crack today. Modern encryption uses mathematics, applied by computers, that is designed to be practically impossible to reverse without the secret.
What a key is
The scrambling process is called an algorithm, and it is usually public. What stays secret is the key, a long string of data that controls how the scrambling is done. A helpful comparison is a lock: many people can buy the same model of lock, and its design is no secret, but only the right key opens yours.
This design is deliberate. Security that depends on keeping the method hidden tends to fail once the method leaks. Security that depends only on the key means a widely examined method can be trusted if the key is kept safe. The longer the key, the more possible combinations an attacker would need to try, which is why key length matters.
Two main styles
Symmetric encryption uses the same key to lock and unlock. It is fast and good for large amounts of data. The difficulty is getting the shared key to the other person safely. If you must send the key over the same channel an eavesdropper is watching, the scheme falls apart.
Asymmetric (public-key) encryption uses a pair of linked keys. One is a public key that you can share with anyone. The other is a private key that you keep to yourself. Something locked with the public key can only be opened with the matching private key. A rough picture is a mailbox with a slot: anyone can drop a letter in, but only the owner has the key to take letters out.
In practice, systems often combine the two. Public-key methods are used at the start to agree on a shared secret safely, and then faster symmetric encryption protects the rest of the conversation.
Encryption in transit
When you visit a website whose address starts with “https” and see a padlock-style icon, your connection to that site is encrypted. This protects the data moving between your device and the site from being read by others along the way, such as someone on the same public network. The wider machinery of how data travels is described in the article on internet infrastructure.
This is called encryption in transit. It does not mean the site itself is trustworthy. A padlock says the connection is private, not that the site’s owner is honest. Scam sites can use it too.
End-to-end encryption
In many messaging apps, your message goes from your phone to the company’s servers and then on to the recipient. If only the connection is encrypted, the company can potentially read the message when it arrives at the server.
End-to-end encryption (often shortened to E2EE) is designed so that only the sender and the intended recipient hold the keys. The message is scrambled on your device and only unscrambled on theirs. The company running the service moves the ciphertext along but, if the system works as intended, cannot read it. Many popular messaging apps offer this in some form, though it is worth checking whether it is on by default and for which features, such as group chats or backups.
Encryption at rest
Data can also be encrypted while stored: on a phone, a laptop disk or a server. If a device is lost or stolen, encryption at rest, combined with a strong passcode, makes it much harder for someone to read what is on it. Many modern phones do this by default, although the details depend on the device and settings.
What encryption does not do
It is easy to over-trust the word “encrypted”. It generally does not protect against:
- Compromised devices. If malware or a thief has access to your unlocked phone, the messages are readable there. Encryption protects the journey, not the endpoints.
- Weak passwords or stolen logins. If someone gets into your account, they may see everything you can.
- Metadata. Even when content is hidden, information such as who contacted whom, when and how often may still be visible, depending on the service.
- The other person. The recipient can screenshot or share what you send.
- Backups. Messages saved in a cloud backup may be protected differently from the live conversation.
- Tricking you. A phishing message does not need to break encryption if it can convince you to hand over a password.
Why people disagree about it
Encryption is at the center of a long public debate. Privacy advocates and many security experts argue that strong encryption protects ordinary users, journalists, businesses and vulnerable people. Some law enforcement and government bodies argue that it can make investigations harder. Proposals to create special access often meet the objection that a weakness built for one party could be found and abused by others. This is a part of the broader tension known as privacy versus security, and views differ.
Looking ahead
Researchers expect that future quantum computing could eventually break some of today’s public-key methods, and work is under way on new methods designed to resist such machines. For ordinary users, the practical advice stays the same: keep software updated so that improved methods reach your devices.
Practical takeaways
- Look for https when entering personal information.
- Choose messaging tools with end-to-end encryption if privacy matters, and learn what they cover.
- Use a screen lock and keep device encryption on.
- Protect accounts with strong passwords and an extra login step.
- Remember that encryption protects data in specific places, not everywhere.