Every time you type a password into a website, send a message on WhatsApp, or make an online payment, encryption is protecting your data. But what actually is encryption, and how does it work? This guide explains the fundamentals — from Caesar ciphers to AES-256 — without requiring a mathematics degree.
The core concept
Encryption transforms readable data (plaintext) into unreadable scrambled data (ciphertext) using a mathematical algorithm and a secret value called a key. The same key (or a related key) can reverse the process, converting ciphertext back to plaintext (decryption).
Without the key, the ciphertext is computationally indistinguishable from random noise — it reveals nothing about the original data.
Symmetric vs asymmetric encryption
There are two fundamental types of encryption, each used for different purposes:
Symmetric encryption
The same key encrypts and decrypts. Fast and efficient for bulk data.
- AES-256 (most common)
- ChaCha20-Poly1305
- 3DES (legacy)
Problem: Both parties need the same key — how do you share it securely?
Asymmetric encryption
A key pair: public key encrypts, private key decrypts. Solves the key exchange problem.
- RSA (2048/4096-bit)
- Elliptic Curve (ECDSA, ECDH)
Problem: Slow — 1000× slower than AES. Not used for bulk data.
In practice, both types are used together: asymmetric encryption securely exchanges a symmetric key, then symmetric encryption handles the actual data. This is exactly how TLS/HTTPS works.
AES-256: the standard for data encryption
AES (Advanced Encryption Standard) is the gold standard for symmetric encryption. AES-256 uses a 256-bit key and processes data in 128-bit blocks through 14 rounds of mathematical transformations (substitution, permutation, mixing, and key addition).
Why AES-256?
- Standardized by NIST in 2001 after a public competition
- No known practical attacks against AES-256 when implemented correctly
- Hardware acceleration (AES-NI) makes it extremely fast on modern CPUs
- Used by governments, banks, messaging apps, and password managers worldwide
AES-256 used in GCM mode (AES-256-GCM) is authenticated encryption — it simultaneously encrypts data and produces a tag that verifies the ciphertext hasn't been tampered with. This is the recommended mode for most applications.
RSA: the public key standard
RSA is based on the mathematical difficulty of factoring the product of two very large prime numbers. Its security relies on the fact that multiplying two 2048-bit primes takes milliseconds, but factoring their product would take longer than the age of the universe with current computers.
RSA is used for:
- TLS certificates to prove server identity
- Digital signatures (signing software, documents)
- Key exchange (encrypting a symmetric key for transmission)
RSA is being gradually replaced by Elliptic Curve Cryptography (ECC), which achieves equivalent security with much smaller keys — a 256-bit ECC key is considered as secure as a 3072-bit RSA key.
How TLS/HTTPS protects your data
When you visit an HTTPS website, TLS (Transport Layer Security) runs an automated process called the TLS handshake that establishes encrypted communication:
- Your browser requests the server's TLS certificate
- The certificate contains the server's public key and is signed by a trusted Certificate Authority (CA)
- Your browser verifies the certificate is valid and signed by a CA you trust
- Your browser and server use Diffie-Hellman key exchange to negotiate a shared symmetric key — this happens using the asymmetric keys from step 2-3
- All subsequent communication is encrypted with AES-256-GCM (or ChaCha20) using that shared symmetric key
This means even if someone intercepts your encrypted traffic, they see only ciphertext. Without the session key — which was negotiated privately using asymmetric cryptography — they cannot decrypt it.
Encryption vs hashing vs encoding
| Property | Encryption | Hashing | Encoding (Base64) |
|---|---|---|---|
| Reversible? | Yes (with key) | No | Yes (no key needed) |
| Secret key needed? | Yes | No | No |
| Output length | Similar to input | Fixed | ~33% larger |
| Primary purpose | Confidentiality | Verification | Format conversion |
| Example | AES-256-GCM | SHA-256 | Base64 |
End-to-end encryption (E2EE)
End-to-end encryption means only the communicating endpoints can decrypt the data — not the service provider, not the government, not an attacker who intercepts traffic in transit.
With E2EE, messages are encrypted on your device using your recipient's public key before being sent. Only your recipient's private key can decrypt them. The server that relays the message sees only ciphertext.
Apps with true E2EE: Signal, WhatsApp (for messages), Apple iMessage (when both parties have iPhones), ProtonMail. Without E2EE: standard email (SMTP), Telegram (default, not secret chats), most collaboration tools.
Frequently asked questions
Can quantum computers break AES-256?
Grover's algorithm allows quantum computers to perform key searches in O(√N) time rather than O(N), effectively halving the key size. For AES-256, this reduces security from 256 bits to 128 bits — still considered computationally secure. SHA-256 and RSA are more vulnerable; most cryptographers recommend upgrading RSA to post-quantum alternatives when they're standardized.
What's the difference between HTTPS and HTTP?
HTTP transmits data in plaintext — anyone on the same network (your ISP, a coffee shop's WiFi operator) can read it. HTTPS adds TLS, encrypting all data between your browser and the server. Always use HTTPS, especially for login pages, payments, and anything sensitive. Your browser's padlock icon confirms TLS is active.
Is encrypted data completely safe from law enforcement?
Properly implemented encryption is theoretically unbreakable with current technology. However, law enforcement can access encrypted data through other means: device seizure (if the device is unlocked), legal orders compelling key disclosure in some jurisdictions, malware on the endpoint, or attacking the human through social engineering. The math is unbreakable; the people and systems using it are not.