How Encryption Works: From Plain Text to Secret Code
Encryption scrambles your data so only the right key can read it. Learn how symmetric and public-key encryption work together, where HTTPS uses them, and what encryption cannot protect you from.
Every time you open a banking app, send a WhatsApp message, or see the padlock next to a website address, encryption is working quietly in the background. It is the reason a stolen laptop or an intercepted message is usually useless to whoever takes it. Here is what encryption actually does, and how two very different kinds of it work together to keep the internet usable.
Scrambling data with a key
Encryption turns readable data, called plaintext, into scrambled data, called ciphertext, using a mathematical procedure called an algorithm plus a secret value called a key. The algorithm is public and well studied; the key is what stays secret. Anyone holding the right key can run the process in reverse and recover the original data. Without the key, the ciphertext looks like random noise, and reversing it by guessing the key, known as a brute-force attack, takes far too long to be practical with a strong modern key.
This matters whether data is "at rest" (stored on a drive) or "in transit" (travelling across a network). Both need protection, because a stolen phone and an intercepted Wi-Fi connection are both ways an attacker can get at your data.
Two kinds of encryption, used together
Symmetric encryption
One single key both locks and unlocks the data. Both sides must already share that same secret key. It is fast, which makes it the right tool for encrypting large amounts of data, such as a whole file or a video call. AES is the standard algorithm here, built into NIST's own FIPS 197 specification and used almost everywhere.
Asymmetric encryption
Also called public-key encryption, it uses a matched pair of keys instead of one. A public key, which anyone can see, encrypts the data; only the matching private key, kept secret by its owner, can decrypt it. This solves the problem symmetric encryption cannot: two sides who have never met still need a way to agree on a shared secret without sending that secret in the open. RSA and elliptic-curve cryptography are the common algorithms here.
Combining the two
Asymmetric encryption is too slow for large data, so real systems use it only to exchange a temporary symmetric key safely. Once both sides hold that shared key, they switch to fast symmetric encryption for the actual data. This handshake is exactly what happens every time you open an HTTPS website.
How HTTPS uses this every day
The padlock in your browser's address bar means the connection uses Transport Layer Security (TLS), the modern name for what used to be called SSL. When you open an HTTPS site, your browser and the website's server briefly use asymmetric encryption to agree on a one-time symmetric key, then use that key for the rest of the session. This is why HTTPS pages load quickly despite using "slow" public-key cryptography: the slow part only happens for a split second at the start.
What encryption protects, and what it does not
Encryption is very good at three things: keeping data private from anyone without the key, stopping data from being quietly altered in transit, and making a lost or stolen device's storage unreadable if it was encrypted at rest. It is why regulations like GDPR and India's own data-protection rules push companies to encrypt user data.
Encryption does not protect you from a scam that tricks you into typing your password into a fake but encrypted site, or from malware already running on your own unlocked device, or from someone who has your actual password. The padlock confirms the connection to a site is private; it says nothing about whether that site is trustworthy.
What most people miss
- A padlock is not a trust seal. It means the connection is private, not that the site behind it is honest. Scam sites use HTTPS too.
- Longer keys are not automatically "more encrypted." They are harder to brute-force, but a strong algorithm with a shorter key can still outlast a weak algorithm with a longer one. Trust standards bodies like NIST over marketing claims.
- Quantum computers are the reason encryption keeps changing. A sufficiently powerful quantum computer could eventually break today's common asymmetric algorithms, which is why NIST is already finalising new "post-quantum" encryption standards designed to resist that.
- End-to-end encryption is a specific promise. It means only the sender and receiver hold the keys, not even the app's own company. A service that is merely "encrypted" may still hold the key itself and be able to read your data.
