Cybersecurity
Encryption Fundamentals Explained Simply
Encryption is the technology that keeps your messages, your banking, and your files private on the internet. It scrambles information so that only someone with the right key can read it — and it is built into almost everything you do online. This guide explains how it works, in plain English, without the maths.
Try the tools: Encryption Learning Lab · SHA-256 Hash Generator · SHA-512 Hash Generator · MD5 Educational Demonstrator · Base64 Encoder · Base64 Decoder · URL Encoder · URL Decoder · Caesar Cipher Simulator · ROT13 Encoder / Decoder · Hashing Algorithm Explorer · Text Encryption Demonstrator · Text Decryption Demonstrator · Security Header Learning Tool
Note. Encryption protects content, not metadata. It hides what you say and what you send, but not necessarily who you are talking to, when, or how much you send. That distinction — encrypted does not mean private — is explained in our guide on end-to-end encryption.
What encryption is
Encryption turns readable information — plaintext — into scrambled information — ciphertext — using a key. Only someone with the right key can reverse the process, called decryption, and read the original. Anyone without the key sees only meaningless characters. The process is designed so that the scrambled output gives no usable clues about the original.
A useful analogy is a locked box. The encryption algorithm is the design of the lock: public, standardised, and tested by experts for years. The key is your copy of the key to that lock: secret, and the only thing that opens the box. Knowing how the lock is built does not help you open it without the key — which is why modern encryption does not depend on secrecy of the method, only on secrecy of the key.
You use encryption constantly. Every time you visit a website with a padlock icon, your connection is encrypted. Your messages are encrypted in transit. Your phone encrypts its storage so that a thief cannot read your photos. Your bank, your email, your cloud drive — all of them depend on encryption working silently in the background.
Symmetric and asymmetric encryption
There are two main kinds of encryption, and most real systems use both. Symmetric encryption uses one shared key for both locking and unlocking: if you and a friend have the same key, you can both encrypt and decrypt each other's messages. It is fast and efficient, which is why it is used to encrypt the bulk of the data — the actual files, messages and video streams.
The problem with symmetric encryption is sharing the key. If you have never met the person you are messaging, how do you get them the key safely, without anyone intercepting it? That is the problem asymmetric encryption solves. It uses a key pair: a public key that anyone can use to encrypt a message to you, and a private key that only you hold, which decrypts it. Anyone can lock a box addressed to you; only you can open it.
In practice, the two are combined. Asymmetric encryption is used to agree a symmetric key safely — the digital handshake at the start of a secure connection — and then symmetric encryption does the heavy work of encrypting the data itself. That combination is what happens every time your browser connects to a secure website, in a fraction of a second.
Encryption in transit and encryption at rest
Encryption in transit protects data while it moves — between your device and a website, between your phone and a messaging server. When you visit a secure website, the connection is encrypted, which means your internet provider, the Wi-Fi operator, and anyone else watching the network can see that you are connected, but not what you are sending or receiving.
Encryption at rest protects data while it is stored — on your phone, your laptop, or a company's servers. If your laptop is stolen, full-disk encryption means the thief cannot read your files without your password. If a company's database is stolen, encryption at rest means the stolen data is scrambled — though that protection depends on the encryption keys being stored separately from the data, which is not always the case.
Both kinds matter, and neither is complete on its own. Data encrypted in transit can still be read by the service at either end. Data encrypted at rest can still be read by anyone who can log into the system that holds the keys. Knowing which kind is in use, and who holds the keys, is the question that decides how much privacy you actually have.
Keys: the part that matters most
In modern encryption, the algorithm is not the secret — the key is. The algorithms used everywhere today, such as AES for symmetric encryption, are public standards that have been studied by cryptographers for decades. Their strength comes from the key: a long, random secret that is computationally infeasible to guess. A 256-bit key has so many possibilities that trying them all would take longer than the age of the universe with any computer we can build.
That is why key management — creating, storing, sharing, rotating and revoking keys — is the real work of encryption. A perfect algorithm with a weak key is as useless as a strong lock with the key left in the door. Passwords are often the weakest keys, because people choose them by hand; the keys that protect your messages and your devices are generated randomly, which is why they are strong.
If you lose a key, you lose the data. There is no master key and no recovery shortcut in a well-designed system — which is why backups of keys and recovery methods matter, and why the question of who holds the keys is the most important question in any encryption claim.
What encryption does not do
Encryption hides content, not context. When you send an encrypted message, the service can still see who you messaged, when, how often, and how large the message was — that is metadata, and it can reveal a great deal even when the words are hidden. Encryption also does not protect a device that is unlocked, an account whose password is stolen, or data that is decrypted for processing on a company's servers.
Encryption does not make a website honest. A phishing site can use encryption — the padlock only means the connection is encrypted, not that the people behind it are trustworthy. And encryption does not protect you from the person at the other end: an encrypted message can still be screenshotted, forwarded, or stored by the recipient.
It also does not protect data that the service itself must read to work. A cloud service that searches your files, scans your photos, or shows you targeted adverts based on your messages is reading your data — which means it holds the keys. End-to-end encryption, covered in its own guide, is the variant where even the service cannot read the content.
Encryption you already use
You are already surrounded by encryption. The padlock in your browser means your connection to that website is encrypted — check it before entering passwords or payment details, and be suspicious of a login page without it. Your phone encrypts its storage, and turning on a strong screen lock is what makes that encryption meaningful. Messaging apps offer encrypted chats — check whether yours uses end-to-end encryption, where even the company cannot read your messages.
For files, you can encrypt documents and archives with tools built into your operating system, and for email, some providers offer encryption options for sensitive messages. The practical rule is simple: use the encryption that is already available — keep your software updated, use secure websites, turn on your phone's screen lock, and choose messaging apps with end-to-end encryption for sensitive conversations.
None of this requires technical skill. Encryption is a background service, like the brakes on a car: you do not operate it directly, but you should know it is there, use it properly, and notice when it is missing.
Sources
- National Cyber Security Centre (UK) — Encryption guidance — last checked 14 November 2026.
- NIST — Cryptographic standards — last checked 14 November 2026.
- CISA — Cybersecurity best practices — last checked 14 November 2026.
Last checked: 14 November 2026.
Frequently asked questions
What is encryption in simple terms?
Encryption scrambles information using a key, so that only someone with the right key can read it. It turns readable text into meaningless characters, and the process can only be reversed by the key holder.
What is the difference between symmetric and asymmetric encryption?
Symmetric encryption uses one shared key for both encrypting and decrypting, and is fast. Asymmetric encryption uses a key pair — a public key to encrypt and a private key to decrypt. Real systems use both: asymmetric encryption agrees the key safely, then symmetric encryption does the work.
Does encryption make me anonymous?
No. Encryption hides what you send, but not necessarily who you are talking to, when, or how much you send. That surrounding information is called metadata, and it can reveal a great deal even when the content is hidden.
Is a website safe if it has a padlock icon?
The padlock means the connection is encrypted, not that the website is honest. Phishing sites use encryption too. Always check the address is the real one before entering passwords or payment details.
What is a key in encryption?
A key is the secret that makes encryption work. The algorithm is public and standardised; the key is private and random. Losing a key means losing the data, and a weak key makes even the strongest algorithm useless.