Encryption is the process of transforming readable data, called plaintext, into unreadable ciphertext using an algorithm and a secret key, so that only someone holding the right key can decrypt it back to the original. In cybersecurity, encryption is the primary means of keeping data confidential whether it is stored on a device or travelling across a network. Its purpose is simple: information that falls into the wrong hands should be worthless without the key.
You use encryption dozens of times a day without noticing, every time a website loads over HTTPS, a message is sent through a modern messenger, or a phone is unlocked. This guide explains the meaning of encryption, how encryption and decryption work, what an encryption key is, the two main types of encryption, why encryption matters, where it is used, and what it cannot do.
The meaning of encryption
The word comes from cryptography, the study of secret writing, and the idea is older than computers: substitute or rearrange the letters of a message according to a rule that the recipient knows and an interceptor does not. Modern encryption keeps the idea and replaces the rule with mathematics that no computer can undo without the key.
Computer encryption operates on data as numbers. An algorithm, also called a cipher, takes plaintext and a key and produces ciphertext that is statistically indistinguishable from random noise. Change one bit of the key and the ciphertext changes completely. Without the key, recovering the plaintext from good ciphertext requires trying every possible key, which for modern key sizes would take longer than the age of the universe.
Encryption and decryption
Encryption and decryption are the two directions of the same operation. Encryption takes plaintext and a key and produces ciphertext. Decryption takes ciphertext and the corresponding key and produces the plaintext. If the wrong key is used, decryption produces noise, not a partially correct result, so there is no way to tell whether a guess was close.
The strength of the arrangement rests on two things: the algorithm must have no shortcuts, which is why modern algorithms are published and attacked publicly by researchers for years before being trusted; and the key must remain secret, which is where most real-world failures happen. The algorithm is public. The key is the secret.
What an encryption key is
An encryption key is a string of bits, in practice a very large random number. Its length determines how many possible keys exist: a 128-bit key has 2 to the power of 128 possibilities, a 256-bit key vastly more. The AES-256 guide on this site explains what those numbers mean for security.
Keys come from two places. They can be generated randomly by software or hardware for a single session or file, or derived from a password through a deliberately slow function, which is how a password you can remember becomes a key a computer can use. The second path is only as strong as the password, which is why weak passwords undermine strong encryption.
Two kinds of encryption
Symmetric encryption uses one key for both encryption and decryption. It is fast and is used for the bulk of data protection: encrypting files, disks, and the contents of network connections. AES is the dominant symmetric algorithm. Its challenge is that both parties must have the same key, which has to be shared somehow.
Asymmetric encryption, also called public-key encryption, uses a pair of keys: a public key that anyone may have and a private key that only the owner holds. Data encrypted with the public key can only be decrypted with the private key. This solves the key-sharing problem, since you can publish your public key and anyone can send you something only you can read. It is slower, so it is used to exchange symmetric keys and to create digital signatures rather than to encrypt large amounts of data. RSA and elliptic-curve algorithms are the common examples.
Almost every real system combines both: asymmetric encryption to agree on a key, symmetric encryption to protect the data. The symmetric versus asymmetric guide on this site goes deeper.
Why encryption matters
Data lives in two states, and both are exposed. Data at rest sits on laptops, phones, servers and backup drives that are lost, stolen, sold second-hand and breached. Data in transit crosses Wi-Fi networks, ISPs and internet routers that anyone in a position to observe can read. Encryption addresses both: a stolen encrypted laptop yields nothing, and an observed encrypted connection reveals only that a connection exists.
Beyond confidentiality, encryption-based techniques provide integrity, detecting whether data has been altered, and authentication, proving who sent something. A website's HTTPS certificate, a signed software update and a passkey all rest on the same mathematics. Without encryption, online banking, private messaging, remote work and electronic commerce could not exist in any trustworthy form.
Where you already use encryption
- Websites. HTTPS encrypts the connection between your browser and the site, so your ISP and anyone on the network see which site you visited but not what you did there.
- Messaging. End-to-end encrypted messengers encrypt on your device with keys the provider does not hold, so not even the provider can read messages.
- Phones and laptops. Full-disk encryption protects everything stored on the device, tied to your passcode; a lost phone is a brick to a thief.
- Wi-Fi. WPA2 and WPA3 encrypt traffic between your device and the router.
- Passwords. Password managers store your credentials in an encrypted vault; websites store password hashes rather than passwords.
- Payments. Card transactions and banking apps encrypt in transit and at rest.
- VPNs. A VPN encrypts all traffic between your device and the VPN server, as the VPN guides on this site explain.
What encryption does not do
Encryption protects the content of data from those without the key. It does not hide that data exists, how much there is, or who exchanged it; that is metadata, and the anonymity guides on this site address it. It does not protect data that has already been decrypted for use: malware on a device reads what you read. It does not help if the key is weak, stored alongside the data, or handed to a third party. And it cannot be partially strong: a system that keeps a spare key "for recovery" has a door that anyone who obtains the spare key can open.
A five-question checklist for judging encryption claims
- What algorithm is used, and is it a current published standard such as AES, ChaCha20, RSA or elliptic-curve cryptography?
- Who holds the keys: you alone, or the service as well?
- Is data encrypted in transit, at rest, or end to end, and which of those does the claim actually mean?
- How are keys derived and protected: from a strong password, in hardware, or in a file next to the data?
- Has the implementation been reviewed by anyone independent, since good algorithms are routinely undermined by bad implementations?
What standards bodies and cryptographers emphasise
The account above follows the way encryption is defined and taught by those who set the standards.
Standards bodies define encryption as the transformation of data to conceal its content and specify approved algorithms and key lengths, emphasising that security depends on key secrecy and correct implementation rather than on hiding the algorithm.
Cryptographers teaching the subject stress the principle that a system should remain secure even if everything about it except the key is public, and point out that most practical breaks target key management and implementation rather than the mathematics.
Security educators describe encryption as necessary but not sufficient, since it protects confidentiality and integrity while leaving metadata, endpoint compromise and human error to other defences.
Start with what you already have
Turn on full-disk encryption on your laptop and phone, use a messenger that encrypts end to end, check for the padlock before typing anything into a website, and keep your passwords in an encrypted manager. Those four steps put strong encryption between your data and everyone who should not have it, and the rest of this section explains each in the depth you want.
Frequently asked questions
What is the meaning of encryption in simple terms?
Encryption is the process of transforming readable information into an unreadable form using a mathematical procedure and a secret key, so that only someone with the right key can turn it back into the original. It protects the confidentiality of data whether it is stored or being sent.
What is the difference between encryption and decryption?
Encryption converts plaintext into ciphertext using a key. Decryption is the reverse: converting ciphertext back into plaintext using the corresponding key. Together they let data be protected while stored or transmitted and read again by the intended party.
What is an encryption key?
A piece of secret data, usually a long random number, that controls the output of an encryption algorithm. The same algorithm with a different key produces completely different ciphertext. Keeping the key secret is what keeps the data secret; the algorithm itself is usually public.
Why is encryption important in cybersecurity?
Because data is constantly stored on devices that can be lost or stolen and sent over networks that can be observed. Encryption makes that data useless to anyone without the key, protecting passwords, messages, payments, health records and business data from thieves, eavesdroppers and unauthorised insiders.
Is encryption the same as hashing or encoding?
No. Encoding, such as Base64, changes the format of data without any secret and is reversible by anyone. Hashing produces a fixed-size fingerprint of data that cannot be reversed. Encryption is reversible only with the key, which is what makes it useful for confidentiality.
Last reviewed and updated on . Plain text version: /encryption/what-is-encryption.txt.
