The basic idea
Encryption turns readable information, called plaintext, into scrambled information, called ciphertext, using a mathematical procedure and a secret value called a key. Someone who intercepts or steals the ciphertext sees what looks like random data. Someone who has the right key can reverse the process, which is called decryption.
The procedure itself, known as a cipher or algorithm, is usually public. Well-regarded systems are designed so that security depends on the key staying secret, not on hiding how the method works. Widely reviewed, standardized methods are generally preferred over homemade ones, because subtle flaws in new designs are easy to miss.
Two main approaches
Symmetric encryption uses the same key to lock and unlock the data. It is fast and well suited to large amounts of information, such as a whole disk or a large file. The difficulty is sharing the key safely with the person who needs it.
Public-key (asymmetric) encryption uses a pair of mathematically linked keys. One, the public key, can be shared openly and is used to encrypt or to verify. The other, the private key, is kept secret and is used to decrypt or to sign. This approach solves the problem of exchanging secrets with strangers, but it is slower, so real systems often combine the two: public-key methods set up a shared secret, and a symmetric cipher then protects the bulk of the data.
A related tool is hashing, which produces a fixed-size fingerprint of data. Hashing is one-way and is not encryption, but it is commonly used for checking that data has not changed and for storing passwords in a form that is hard to reverse.
Data at rest
Data at rest is information sitting in storage: on a laptop, phone, server, database or backup drive. Common forms of protection include:
- Full-disk or device encryption, which protects everything on a device if it is lost or stolen while powered off.
- File or folder encryption, which protects selected items.
- Database or storage-service encryption, often offered by cloud providers and managed through settings.
- Encrypted backups, which matter because copies are easy to overlook yet hold the same information as the originals.
Encryption at rest helps most against physical theft and against someone gaining access to raw storage. It helps less when an attacker logs in as a legitimate user, because the system then decrypts the data on their behalf.
Data in transit
Data in transit is information moving between devices or across networks. When a website address begins with “https,” the connection between the browser and the site is typically protected by a protocol that encrypts the traffic, so that people on the same network or along the route cannot easily read it. Email, messaging, file transfer and remote administration have their own protective protocols and settings.
Some messaging tools use end-to-end encryption, where only the sender and recipient hold the keys and the service in between cannot read the content. That differs from encryption that protects data only on the way to a provider, where the provider can still read it once it arrives. The distinction matters when deciding how much to trust a service with sensitive material.
A virtual private network is one way to add encryption to a connection, but it covers only part of the journey and has limits that are covered elsewhere.
Keys are the weak and strong point
Strong encryption can be undermined by poor key handling. Questions that matter include:
- Where are keys stored? Keeping a key next to the data it protects offers little benefit.
- Who can use them? Access to keys should be limited and reviewed, in line with least privilege.
- What if a key is lost? Properly encrypted data without its key is generally unrecoverable. That is the point of encryption, but it means recovery planning matters.
- How are keys rotated or retired? Many organizations change keys periodically and revoke them if exposure is suspected.
Organizations often use dedicated key management services or hardware to reduce these risks. Individuals face a smaller version of the same problem with passphrases and recovery codes, which is one reason password managers are popular for keeping them safe.
What encryption does not do
Encryption is valuable, but it is not a complete solution.
- It does not stop phishing or stolen credentials. If an attacker tricks someone into giving up a password, they may unlock the data legitimately.
- It does not protect data while in use. Information must be decrypted to be read or processed, and it can be exposed in memory or on screen.
- It does not hide everything. Metadata, such as who contacted whom and when, may remain visible depending on the system.
- It does not guarantee correct implementation. Outdated protocols, weak settings and software bugs can undermine otherwise strong algorithms.
- It does not replace backups. Encrypted data can still be deleted or corrupted.
Encryption is also not the same as a legal safe harbor. Some rules treat encrypted data differently when assessing the impact of a breach, but the details depend on place and circumstance, so organizations should check with qualified advisers.
Looking ahead
Researchers study how future quantum computing might affect certain public-key methods, and standards bodies have been working on alternatives. Whether and when this becomes a practical concern is uncertain, but it is one reason long-lived sensitive data is sometimes handled with extra planning.
Practical takeaways
For most people, good encryption habits are simple: turn on device encryption, keep software updated, use services that protect connections, protect recovery information, and be cautious about unfamiliar links. For organizations, the sensible approach is to know where sensitive data sits, encrypt it where the risk justifies it, manage keys carefully and treat encryption as one layer among several. This is general information and not security or compliance advice for any particular situation.