How Encryption Works: A Guide to Digital Privacy Protection

Encryption is the process of converting readable information, known as plaintext, into an unreadable form called ciphertext, using a mathematical algorithm and a secret value called a key. Only someone who has the matching key can reverse the process and recover the original data. This single mechanism underlies most of what people call "digital privacy" today, from secure messaging to online banking.

Two basic types: symmetric and asymmetric

Cryptographic systems generally fall into two categories. Symmetric encryption uses a single secret key to both lock and unlock data: both the sender and the receiver must already have the same key, according to privacy company Proton. This makes symmetric encryption fast, but it creates a practical problem — the key itself has to be shared somehow without being intercepted.

Asymmetric encryption solves that problem by using two mathematically linked keys: a public key that can be shared openly, and a private key that is kept secret. Data encrypted with one key can only be decrypted with the other, so there is no need to exchange a secret in advance. The trade-off is speed: Proton notes that asymmetric encryption is roughly 1,000 times slower than symmetric encryption because its underlying mathematics is far more complex.

Because of this trade-off, most real-world systems use a hybrid approach: asymmetric encryption is used briefly to exchange a one-time symmetric key over an open network, and then the fast symmetric algorithm handles the actual bulk data. This combination powers HTTPS website connections, virtual private networks (VPNs) and encrypted email, Proton explains.

AES: the standard behind most everyday encryption

The most widely used symmetric algorithm is the Advanced Encryption Standard (AES), published by the U.S. National Institute of Standards and Technology (NIST) on November 26, 2001, as Federal Information Processing Standard (FIPS) 197. AES supports key lengths of 128, 192 or 256 bits and processes data in 128-bit blocks. NIST describes it as a FIPS-approved algorithm that can be used to protect electronic data, and it is used across government and commercial systems worldwide.

What makes encryption "end-to-end"

Not all encryption offers the same level of protection. Standard encryption "in transit," such as the TLS protocol used in HTTPS, protects data only while it moves between a device and a server — but the data can still be readable once it reaches that server. End-to-end encryption (E2EE) goes further: according to IBM, data stays encrypted in transit and is only decrypted on the recipient's device, meaning even the service provider carrying the message cannot read its content.

IBM describes E2EE as working in four stages: an algorithm turns the message into ciphertext; the ciphertext travels across the network looking like random characters to any interceptor; the recipient's device uses a private or shared key to restore the original message; and the data is then checked for integrity to confirm it was not tampered with in transit. IBM lists messaging platforms such as WhatsApp, Signal and Apple's iMessage, as well as password managers like 1Password and Bitwarden, as examples of services that apply end-to-end encryption.

Why quantum computers are changing encryption standards

Regulators are already preparing for a future threat: sufficiently powerful quantum computers could, in theory, break the mathematical problems that today's asymmetric encryption relies on. On August 13, 2024, NIST approved three new Federal Information Processing Standards built specifically to resist attacks from both classical and quantum computers, according to NIST's Computer Security Resource Center (CSRC).

The three standards are FIPS 203, the Module-Lattice-Based Key-Encapsulation Mechanism Standard (derived from the CRYSTALS-Kyber submission); FIPS 204, the Module-Lattice-Based Digital Signature Standard (derived from CRYSTALS-Dilithium); and FIPS 205, the Stateless Hash-Based Digital Signature Standard (derived from SPHINCS+). NIST's CSRC states the standards are "designed to resist future attacks by quantum computers, which threaten the security of current standards," covering both key exchange and the digital signatures used to verify that data has not been altered.

What this means for everyday privacy

For most people, the practical takeaway is that encryption already protects much of daily digital life by default — HTTPS secures web browsing, AES secures files and Wi-Fi traffic, and E2EE protects many popular messaging apps. The ongoing shift toward post-quantum standards is mainly a background infrastructure change, managed by standards bodies, device makers and service providers, rather than something individual users need to configure themselves.