What Is Encryption? Symmetric vs Public-Key Simply Explained

In everyday life

You unlock your phone. You send a photo in a messaging app. You buy something online. In every one of these moments, encryption is working behind the scenes.

So how does encryption hide the contents? You might think it is safer to keep the method secret. In fact, it is the other way around.

What encryption is: making data unreadable without the key

Encryption means converting data with a set method so that its meaning can no longer be read. The data before conversion, which anyone can read, is called "plaintext." For example, the message "Meet me at the station at 10 tomorrow" is plaintext.

Besides the method, the conversion uses a "key." A key is a secret value fed into the method. In modern encryption it is a very long number. The same plaintext gives a completely different result with a different key. The unreadable data that comes out is called "ciphertext."

The person who receives the ciphertext uses the correct key to turn it back into plaintext. This is called "decryption." To anyone without the key, the ciphertext looks like a random string of characters.

A cipher from about 2,000 years ago: the Caesar cipher

Let's look at an old example. Julius Caesar of ancient Rome wrote letters with the letters shifted. He replaced each letter with the one three places later, so A became D, B became E, and so on. The Roman historian Suetonius recorded this in the early 2nd century.

This method is called the "Caesar cipher." Here, the number of places to shift is the key. With a key of 3, "HELLO" becomes "KHOOR." The receiver can read it by shifting back the same number of places.

Today, the Caesar cipher is easy to break. The English alphabet has 26 letters, so there are only 25 meaningful shifts, from 1 to 25. Try them all, and one of them will give a sentence that makes sense.

Trying every possible key one after another like this is called a "brute-force attack." When there are few candidates, the cipher falls quickly. That is why modern encryption has an enormous number of possible keys.

Publish the method, keep only the key secret

The step-by-step method of encryption is called an "algorithm." In the Caesar cipher, "shift the letters" is the algorithm and "3" is the key. So which should be kept secret, the algorithm or the key?

The answer is "only the key." In 1883, Kerckhoffs, a Dutch-born linguist teaching in France, published a paper on what military ciphers need. One rule was that "the method need not be secret, and it should not matter if it falls into enemy hands." This idea is called "Kerckhoffs's principle." It is a foundation of how ciphers are designed today.

One reason is that devices and software are handed out in huge numbers. Take them apart, and the method will leak sooner or later. A leaked key, by contrast, can simply be replaced. And when the method is public, experts around the world look for its weak points. A method that survives years of study without being broken can be trusted.

Symmetric-key encryption: the same key locks and unlocks

A method that uses the same key to encrypt and to decrypt, like the Caesar cipher, is called symmetric-key encryption. The sender and the receiver must both hold the same key. Its math is light, so even large data such as video can be encrypted quickly.

Today's leading example is AES. The US National Institute of Standards and Technology (NIST) invited candidates from around the world. It compared them in public over three years. In 2000 it chose a method by two Belgian researchers, and in 2001 it made it a standard.

An AES key can be 128, 192 or 256 bits long. A bit is a single digit that is either 0 or 1. A 128-bit key is a row of 128 zeros and ones. The number of possible rows is 2 multiplied by itself 128 times. That is about 3.4×10³⁸ (a 39-digit number).

Imagine a machine that could try a billion billion keys per second (1 followed by 18 zeros). Even then, trying every key would take about 11 trillion years. That is roughly 780 times the 13.8 billion years since the universe began. On average you would hit the key halfway through, but that is still hundreds of times the age of the universe.

How do you hand over the key?

Symmetric-key encryption has a big headache. Before you can talk in code, you and the other person must already hold the same key. Send the key over the internet as is, and someone on the way can see it. Handing it over in person is safe, but you can't meet an online shop before your first purchase.

This headache is called the "key distribution problem." It gets worse as the number of people grows. Suppose each of 100 people wants to talk privately with every other one. Every pair needs its own key. That is 100 × 99 ÷ 2, or 4,950 keys.

Public-key cryptography: separate keys to lock and unlock

The key distribution problem was solved by public-key cryptography. It uses a matched pair of keys. One key locks (encrypts) and the other unlocks (decrypts). The receiver makes this key pair themselves.

One of the two is a "public key" that anyone may see. It can even be posted on the internet. The other is a "private key" that only its owner holds. The system is designed so that working out the private key from the public key would take impractically long on today's computers.

Here is how it is used. Someone who wants to send B a secret message encrypts it with B's public key. Only B, who holds the private key, can open that ciphertext. No secret needs to be shared in advance, so it works even with someone you have never met.

The first to publish this idea openly were Diffie and Hellman in the United States. Their 1976 paper showed how two people with no shared secret could build the same key just by exchanging messages. This method is called Diffie–Hellman key exchange. It still plays a central role in today's HTTPS.

The next year, in 1977, Rivest, Shamir and Adleman devised the RSA cryptosystem. The name comes from their initials. Its protection rests on how hard it is to split a large number into the prime numbers that multiply to make it. This is called prime factorization.

Today, elliptic-curve cryptography is also widely used, because it reaches the same strength with shorter keys. At GCHQ, a UK government agency, a similar method was invented in the early 1970s. It was kept secret until 1997.

Digital signatures: swapping the keys' roles

A key pair also works with the roles swapped. A mark that B makes with B's private key can be checked with B's public key. Only B holds the private key, so a mark that checks out is proof that "B made it." This mark is called a digital signature.

A signature is tied to the contents of the document. If even one character of the document is changed, the check fails. So a signature tells you two things: "who made it" and "whether it was changed on the way." Signatures are used on software update files and HTTPS certificates.

Two points to keep in mind. First, a signature does not hide the contents. Anyone can read a signed document. Second, describing a signature as "encrypting with the private key" is a simplification that fits only RSA. Signatures in elliptic-curve cryptography, for example, use a calculation that is separate from encryption.

In practice, the two are combined

Public-key cryptography has a weakness too. Its math is heavy, so it is not suited to encrypting large data in one go. Symmetric-key encryption is fast, but it had the problem of handing over the key.

So the two are combined. First, public-key techniques are used to share a symmetric key with the other side, just for that session. The actual data is then encrypted with that symmetric key, using AES or a similar method. Public-key cryptography handles the key, and symmetric-key encryption handles the data. Each does the job it is good at. IT certification exams call this combination a "hybrid cryptosystem."

Textbooks often describe it as "encrypt the symmetric key with the other side's public key and send it." That is a correct description of the basic form. However, today's HTTPS (the version called TLS 1.3) does not send the key itself. With Diffie–Hellman key exchange, both sides send each other one-time ingredients and each builds the same symmetric key. This way, even if a private key is stolen later, past traffic cannot be read. "What Does HTTPS Mean?" explains this in more detail.

How is hashing different from encryption?

A hash function often appears alongside encryption. It calculates a short value of fixed length from data of any length. This value is called a hash value. The same data always gives the same value, and changing one character gives a completely different value.

The big difference is whether it can be undone. Hashing has no procedure for going back at all. For example, services store passwords as hash values. "How Are Passwords Cracked?" explains more. Hashing is also used in digital signatures, to boil a long document down to a short value.

Where encryption protects you

Web traffic (HTTPS)

On "https://" pages, the traffic between the browser and the server is encrypted. It uses a hybrid cryptosystem together with signatures.

Data on your phone

The photos and messages stored on your phone are also encrypted inside the device. Apple explains that on an iPhone, setting a passcode turns this encryption on automatically. For Android, Google requires file-by-file encryption on devices launching with Android 10 or later. The key is made from your passcode and a secret value inside the device. This makes it hard to pull the data out of a stolen phone.

Messaging apps

If each leg of the trip is encrypted separately, the message is turned back into readable form once on the operator's server. There is also a way to keep a message encrypted all the way from the sender's device to the receiver's device. This is called "end-to-end encryption." Only the devices at the two ends hold the keys. So even the company that relays the messages cannot read them.

WhatsApp began using this method for all messages and calls in April 2016. LINE, a messaging app popular in Japan, has also used it by default since 2016. It covers text messages and more, in chats that meet certain conditions. However, it cannot hide the record of who sent what to whom, and when.

Wi-Fi

Wi-Fi also encrypts the radio link between your phone and the router. The main methods today are WPA2 and WPA3, which started in 2018 ("How Does Wi-Fi Work?"). Wi-Fi encryption protects only the radio part of the trip.

Quantum computers and the future of encryption

There is also a worry about the future. A "quantum computer" calculates using the properties of quantum mechanics. In 1994, Peter Shor showed a procedure that would let a quantum computer quickly solve problems such as prime factorization. If large quantum computers are built, they will break RSA, elliptic-curve cryptography and Diffie–Hellman key exchange.

As of 2026, no machine is that large and accurate yet ("What Is a Quantum Computer?"). Even so, ciphertext collected today could be decrypted in the future. So a switch has begun to new public-key methods that are thought to be hard even for quantum computers. These are called post-quantum cryptography. NIST published the first three standards in August 2024.

The impact on symmetric-key encryption is thought to be smaller by comparison. Grover's procedure, shown in 1996, cuts the work of brute force only to about its "square root." It is as if the key length were halved. For AES-128, the work becomes about 2 to the 64th power tries. So longer keys (such as AES-256) are considered enough to prepare.

Common myths

By the numbers

DES was the US standard symmetric-key cipher before AES. In 1999, its key was found using a purpose-built machine and about 100,000 PCs. AES-128 has about 4.7×10²¹ times as many possible keys. That is why today's attackers go after easy-to-guess passwords and tricks that fool people, rather than brute-forcing keys.

Learn more

• Compare types of public-key cryptography in a table: RSA vs Elliptic-Curve vs Post-Quantum Cryptography
• How AES encrypts long data: block cipher modes of operation, authenticated encryption (methods that encrypt and detect tampering in one step)
• Protecting past traffic: forward secrecy (the property that past traffic stays unreadable even if a private key leaks later)
• Dedicated parts for storing keys: TPM vs HSM vs Secure Element
• Calculate how long brute force takes: the password brute-force time calculator