Encryption Basics: What It Protects and What It Does Not

Encryption is a way of scrambling information so that only someone with the right secret can read it. Messengers use it, web browsers use it, and phones use it to protect what is stored on them. It runs quietly behind many everyday actions, which is why people often hear the word without knowing what it does.

This entry explains the core idea, the two main families of methods, and the two places where encryption is applied. Then it spends equal time on the limits, because the common mistake is to treat "encrypted" as a synonym for "safe". Encryption protects one specific property of data, and it leaves other risks exactly where they were.

Plaintext, ciphertext and keys

Three terms cover the basics:

• Plaintext is the readable data: a message, a photo, a document.
• Ciphertext is the scrambled result. It looks like random characters.
• A key is a secret value that controls the scrambling. The method, called a cipher or algorithm, is usually public. The key is the part that must stay secret.

Keeping the method public is deliberate. A method that many experts have tested for years is more trustworthy than a private trick that nobody has examined. The security rests on the key.

A toy example

The oldest teaching example is the Caesar cipher: shift every letter forward by a fixed number of places. With a shift of 3 (the key), A becomes D, B becomes E, and so on.

So HELLO becomes KHOOR. Anyone who knows the shift can reverse it by moving three places back. This cipher is also trivial to break, since there are only 25 possible shifts to try. Real systems use mathematics that makes trying every key impossible in practice. The toy example only shows the shape: plaintext, key, ciphertext, and back again.

Symmetric and public-key encryption

There are two families of methods, and they solve different problems.

Symmetric encryption

With symmetric encryption, the same key does both jobs. The widely used standard is the Advanced Encryption Standard, or AES. NIST's FIPS 197 specifies three versions, AES-128, AES-192 and AES-256. The number in each name is the key length in bits, and all three work on blocks of 128 bits. Longer keys give a larger space of possible keys.

The challenge is delivery. If two people have never met, how do they agree on a shared key without someone listening in?

Public-key encryption

Public-key (asymmetric) methods answer that problem. You publish a public key that anyone can use to lock a message for you. Only your private key, which you never share, can unlock it. Think of an open padlock that you hand out freely. Anyone can snap it shut, but only you hold the key to open it.

How they work together

Real systems combine the two. In a web connection, the two sides use public-key methods to establish a shared secret, and then switch to fast symmetric encryption for the actual data. That is the pattern behind HTTPS, which relies on the Transport Layer Security protocol, TLS. The current TLS 1.3 specification (RFC 9846) says the protocol is designed to prevent eavesdropping, tampering and message forgery. To see where this fits when you load a site, read what happens when you open a web page.

Where encryption is used

Data exists in two states, and encryption protects each one in a different way.

A stolen laptop shows the difference. Without disk encryption, a thief can remove the drive and read the files. With it, the thief gets ciphertext. This is why encrypting backups, as discussed in backup basics, is good practice.

A related idea that is not encryption: hashing

A hash is a one-way fingerprint of data. You can turn a password into a fixed-length string, but you cannot turn the string back. Services store hashes so that a stolen database does not reveal the actual passwords. NIST's password rules tell services to salt and hash stored passwords. A salt is a random extra value added before hashing so that two people with the same password do not get the same result.

The key difference: encryption is meant to be reversed by someone with the key. Hashing is not meant to be reversed at all.

What encryption does not protect

This is the part to remember. Encryption keeps data unreadable to people without the key. It does not do the following.

• Protect the endpoints. Data must be readable on your device to be used. If malware controls the device, it sees the data after it is decrypted.
• Verify who you are talking to. A connection can be fully encrypted and still go to a fake site. The FTC notes that scammers can build fake sites that use encryption, and that encryption protects data in transit but not from whoever runs a malicious site.
• Defend against a stolen or guessed key. If the password that unlocks the disk is weak, the encryption is only as strong as that password.
• Hide everything about the connection. Even when content is encrypted, an observer may still see which server you contact and when.
• Recover from a lost key. If the only key is lost, the data may be gone for good. Encryption works against you here, which is why recovery keys must be stored carefully.
• Replace other controls. It does not prevent deletion, data loss or someone with authorized access misusing information. That requires backups and access controls, discussed in the CIA triad.

Common mistakes

• Treating the padlock as a trust badge. The padlock means the connection is encrypted. It does not mean the site is honest.
• Inventing your own cipher. Home-made schemes are almost always weak. Use well-reviewed standards from trusted libraries and tools.
• Confusing encryption with hashing or with encoding. Encoding formats such as Base64 only change representation. They use no secret, so they protect nothing.
• Using a short key password. The strongest cipher fails when the unlock password is guessable.
• Not storing recovery keys. A lost key can mean permanent loss of the data.
• Believing "encrypted" means "private from the service". If the provider holds the keys, the provider can read the data.

FAQ

What is the difference between encryption and a password?

A password proves who you are. Encryption scrambles data. They connect when a password is used to create or unlock the key.

Is stronger encryption always better?

A longer key gives a larger space to search, but weak passwords, bugs and stolen keys are more common problems than breaking the cipher. Good implementation matters as much as key length.

What does end-to-end encryption mean?

Only the two communicating devices hold the keys, so the service in the middle cannot read the messages. This depends on how the service is built, so read its description carefully.

Can encrypted data be broken?

With modern, well-reviewed methods and good keys, guessing the key is not practical. Attackers usually go around the encryption instead, through the endpoint, the password or the person.

Where should I look next?

Look at how encryption supports public Wi-Fi safety and read the rest of the Security Basics area.