What Is Encryption? The Fundamental That Powers Every Secure Interaction You Have Online

Right now, your phone is encrypting something.

Every message you send. Every banking transaction you make. Every time you load a page with a padlock in the address bar. Encryption is happening — silently, instantly, billions of times a second — and most people have no idea what it actually does.

That’s worth fixing. Not because encryption is complicated. But because understanding it changes how you read the word “secure” — and whether you believe it.

This article explains what encryption is, how it works, what it protects you from, and — critically — what it doesn’t. By the end, you’ll have a working mental model that actually holds up in the real world.

You’re Already Using Encryption — Right Now

You don’t have to opt in to encryption. You’re already in.

When you open WhatsApp, your messages are encrypted before they leave your phone. When you log into your bank, your password travels through an encrypted channel. When you type your card number into a checkout page, encryption scrambles it before it touches the internet. The padlock icon in your browser? That’s your browser confirming an encrypted connection is active.

Encryption is not a feature you turn on. It’s infrastructure — like the plumbing in a building. You don’t think about it. It just runs.

To make it concrete: here is what actually happens when you log into your bank. Your browser and the bank’s server exchange cryptographic credentials and agree on a shared secret — all in under 300 milliseconds. Every byte of data that follows — your username, your password, your account balance — travels inside an encrypted tunnel that your internet provider, your router, and anyone sitting on the same public Wi-Fi cannot read. You see a login screen. Under the hood, three separate cryptographic operations have already completed before you typed a single character.

The problem is that “encrypted” has become a marketing word. Every app, every service, and every bank claims it. And because most people don’t know what encryption actually does, they cannot tell a strong implementation from a weak one — or a real claim from a vague one.

That’s the gap this article closes.

That’s it. Everything else is detail built on top of that one idea.

How Encryption Actually Works — No Maths Required

Think of encryption like a lockbox with a specific combination.

You put your message in the box. You lock it with a combination that only you and the intended recipient know. Anyone who intercepts the locked box sees nothing useful — just a sealed metal container. The recipient opens it with the same combination and reads the message.

That’s symmetric encryption in one paragraph — the same “combination” (called a key) locks and unlocks the box on both sides.

Now imagine a different scenario. You want to receive private messages from anyone — strangers included — without sharing a secret combination with each of them first. So instead, you install a public letterbox on your front door. Anyone can drop a letter in (they use your public key to encrypt it). But only you have the key to open the letterbox and read what’s inside (your private key).

That’s asymmetric encryption — and it solves a problem symmetric encryption can’t: how do you share a secret with someone you’ve never met?

In real life, almost every secure connection uses both. When your browser connects to a bank’s website, it uses asymmetric encryption to establish a secure channel and agree on a shared secret. Then it switches to symmetric encryption for the actual data transfer — because symmetric is much faster for large volumes of data. This is what TLS (the protocol behind HTTPS) does under the hood.

The process is called a TLS handshake, and it happens in milliseconds every time you visit a secure website. You never see it. It just works.

There is also a third concept worth knowing: hashing. Hashing is a one-way process — it converts data into a fixed-length string that cannot be reversed. Unlike encryption, there is no key and no decryption step. When a website stores your password, it should store a hash of your password, not the password itself. When you log in, the site hashes what you typed and compares it to the stored hash. If a database is breached, the attacker gets hashes — not passwords. Whether that protects you depends entirely on how the hashing was done. Weak algorithms (MD5, SHA-1) can be cracked quickly. Strong ones (bcrypt, Argon2) cannot, practically speaking.

The Two Types of Encryption — and Why Both Exist

Encryption broadly divides into two families. Every implementation you encounter sits in one of them.

Symmetric Encryption

One key. Same key encrypts and decrypts. Fast, efficient, excellent for large data volumes.

Where you see it: File encryption on your laptop (BitLocker on Windows, FileVault on Mac), database encryption in banking systems, encrypted cloud storage, the data transfer phase of every HTTPS connection after the handshake.

The weakness: Key distribution. If both sides need the same key, how do you securely get that key to the other person in the first place? You cannot send it over an unencrypted channel — that defeats the purpose entirely. This is the key distribution problem, and it is why symmetric encryption alone is impractical for internet communication between strangers.

The most important algorithm: AES (Advanced Encryption Standard) — specifically AES-256. Adopted as a US federal standard in 2001. Used everywhere from WhatsApp to banking systems to government infrastructure. When something is AES-256 encrypted, the encryption itself is not the weak point. The implementation around it usually is.

Asymmetric Encryption

Two keys. Public key encrypts. Private key decrypts. Slower and more computationally expensive — but it solves the key distribution problem that symmetric encryption cannot.

Where you see it: The TLS handshake that establishes every HTTPS connection, email encryption (PGP/GPG), digital signatures on software packages, certificate verification when your browser checks whether a website is who it claims to be.

The weakness: Speed. Asymmetric encryption is orders of magnitude slower than symmetric. You would not use it to encrypt a 10GB database. You use it to securely exchange a symmetric key — then hand the actual data transfer off to symmetric encryption.

The most important algorithms: RSA (2048-bit minimum, 4096-bit for sensitive applications) and ECC (Elliptic Curve Cryptography — achieves equivalent security to RSA with much smaller keys, making it well suited to mobile devices and environments where computing power is limited).

Why Both Exist

Not because one is better. Because they solve different problems. Symmetric is faster but requires a pre-shared secret. Asymmetric solves the secret-sharing problem but is too slow for bulk data. Every real-world secure system combines them — asymmetric to establish trust and exchange a session key, symmetric to transfer data from that point on.

This is not an either/or. It is always both.

What Encryption Protects You From — and What It Doesn’t

A Note on What’s Coming Next: Post-Quantum Cryptography

Current encryption standards — AES-256, RSA, ECC — are secure against every computer that exists today. But quantum computers, if they reach sufficient scale, would break RSA and ECC by solving the underlying mathematical problems in hours rather than centuries.

This is not a today problem. Practically useful quantum computers capable of breaking RSA-2048 do not yet exist. But the timeline is shortening. In 2024, NIST finalised its first post-quantum cryptographic standards — new algorithms specifically designed to resist attacks from both classical and quantum computers. Major technology companies and government agencies are already beginning migration planning.

For most readers, this requires no action today. For anyone responsible for systems with a long data sensitivity horizon — financial records, health data, legal records — post-quantum migration is already a legitimate risk management question worth understanding. The encryption you choose today for long-lived data may need to last well beyond the point where quantum threats become real.

This is a topic Threat Manifest will cover in more depth as standards and timelines mature. For now, the key point is that encryption is not static — it evolves as computing power and threats evolve alongside it.

Where to Go From Here

Encryption is the foundation. Everything built on top of it — secure messaging, banking security, compliance frameworks, password managers — depends on getting this fundamental right.

Encryption requirements run through every major compliance framework on this site. SWIFT CSCF controls reference cryptographic requirements directly across multiple mandatory controls. PCI DSS v4.0 Requirement 4 mandates encrypted transmission of cardholder data. ISO 27001 Annex A.10 addresses cryptography as a dedicated control category.

If you are implementing encryption controls in a regulated environment and need assessment-level guidance, the consulting page explains how I work with banks and financial institutions on exactly this.

Encryption is not magic. It is mathematics — well-understood, rigorously tested, and publicly scrutinised. The algorithm is rarely the problem. The implementation, the configuration, and the context around it almost always are. Understanding the difference is where real security knowledge begins.

External reference: NIST Cryptographic Standards and Guidelines — the authoritative source for encryption standards used globally, including the newly finalised post-quantum standards.

“Anyone claiming their product is "secure because it uses encryption" is giving you one piece of a much larger picture.”