Protecting Your Data: How Encryption Works and Where It's Used

You probably see the word encryption when using websites, apps, computers, and other connected devices. But what does encryption actually mean, and how does it help protect your information?

Encryption converts readable data into an encoded form that unauthorized people cannot easily understand. A cryptographic key is used to encrypt the data and, when appropriate, decrypt it.

Encryption is used to protect information when it is stored on a device and when it is transmitted over a network. It helps protect everything from personal files and online accounts to financial information and business data.

What is encryption?

Encryption is a process that transforms readable information, called plaintext, into an encoded form called ciphertext.

A cryptographic key is used as part of the process. Someone with the appropriate key can decrypt the ciphertext and return it to readable information.

Think of encryption like putting a message inside a locked box. Anyone might be able to see the box, but only someone with the right key can open it and read what's inside.

Modern encryption uses complex mathematical algorithms rather than simple substitution methods. The strength of an encryption system depends on factors such as the algorithm, key management, implementation, and how the technology is used.

Why is encryption important?

Encryption helps protect your information from unauthorized access.

You use encrypted technology more often than you may realize. For example, encryption can help protect:

• Online banking information
• Credit card and payment information
• Personal messages
• Email and attachments
• Photos and other files
• Business documents
• Passwords and account information
• Data stored on computers and mobile devices

Encryption can protect data in two important situations:

Data in transit

Data in transit is information moving from one device or system to another.

For example, when you visit a website using HTTPS, encryption helps protect information exchanged between your device and the website.

Data at rest

Data at rest is information stored on a device, drive, server, or other storage system.

For example, full-device encryption can help protect files if a laptop is lost or stolen. Microsoft describes BitLocker as a Windows feature designed to protect data from exposure if a device is lost, stolen, or improperly decommissioned.

What are the two main types of encryption?

Modern encryption generally falls into two broad categories: symmetric encryption and asymmetric encryption.

Symmetric encryption

Symmetric encryption uses the same secret key to encrypt and decrypt data.

The key must be kept secure because someone who obtains it may be able to decrypt the protected information.

Symmetric encryption is efficient and is commonly used to encrypt large amounts of data.

One of the best-known modern symmetric encryption algorithms is Advanced Encryption Standard (AES).

Asymmetric encryption

Asymmetric encryption uses two related keys: a public key and a private key.

The public key can be shared with others, while the private key is kept secret.

Asymmetric cryptography can be used for secure communication, authentication, and digital signatures. It is generally less efficient than symmetric encryption for encrypting large amounts of data.

RSA is a well-known example of a public-key cryptographic algorithm.

Modern security systems can use both types together. Asymmetric cryptography can help establish trust or exchange information securely, while symmetric encryption can then protect the actual data efficiently.

What are encryption algorithms?

An encryption algorithm is the mathematical method used to transform data into ciphertext and, when applicable, back into readable data.

Some algorithms you may encounter include:

AES

Advanced Encryption Standard (AES) is a widely used symmetric encryption algorithm.

AES supports 128-bit, 192-bit, and 256-bit keys and is used in many security applications and products.

RSA

RSA is a public-key cryptographic algorithm that uses a public and private key pair.

RSA is commonly associated with authentication, digital signatures, and secure key-related operations rather than encrypting large amounts of data.

DES and 3DES

Data Encryption Standard (DES) and Triple DES (3DES) are older encryption technologies.

DES is no longer considered appropriate for modern security, while 3DES has also been deprecated for many uses. Modern systems generally use newer cryptographic technologies such as AES instead. NIST has documented the security and transition concerns associated with 3DES.

What is an encryption protocol?

An encryption algorithm is the mathematical method used to protect data. An encryption protocol is a broader set of rules and technologies that uses cryptography to secure communication or information.

One of the most important examples is Transport Layer Security (TLS).

Transport Layer Security (TLS)

TLS is a security protocol that helps protect data transmitted over a network.

TLS is commonly used for:

• Web browsing
• Online shopping
• Banking
• Email
• Other internet-based communications

When a website uses HTTPS, TLS helps protect the connection between your device and the website.

For example, when you enter information into a secure website, TLS helps prevent unauthorized parties from simply reading that information while it travels between your device and the website.

How does encryption protect your computer?

Encryption can protect data stored directly on your computer.

Windows device encryption and BitLocker

Windows includes encryption features designed to help protect data stored on compatible devices.

BitLocker can encrypt an entire drive or volume, helping protect information if a computer is lost, stolen, or accessed offline. Microsoft recommends BitLocker as part of Windows data protection and documents its use with hardware security features such as a Trusted Platform Module (TPM).

Some Windows devices also support Device Encryption, which simplifies enabling encryption on supported devices.

Windows 11 also includes Personal Data Encryption on supported configurations. Unlike BitLocker, which protects an entire volume, Personal Data Encryption focuses on individual files and can use Windows Hello for Business to help protect access to encrypted content.

The encryption features available to you can vary depending on your Windows edition, device hardware, and configuration.

Does encryption make my data completely secure?

No. Encryption is an important security measure, but it does not protect against every threat.

For example, encryption cannot necessarily protect you if someone gains access to your account because you shared your password or approved a fraudulent login request.

Encryption works best as part of a broader security strategy that includes:

• Strong, unique passwords
• Multifactor authentication
• Regular software and security updates
• Secure devices
• Trusted applications and websites
• Regular data backups
• Safe handling of links and attachments

It's also important to protect your encryption keys and recovery information. Losing access to an encryption key or recovery key can make protected data difficult or impossible to recover.

How can I protect my data?

You can take several simple steps to improve the security of your information:

Keep your devices updated

Install operating system and application updates when they become available. Updates can include important security fixes.

Use strong passwords

Use unique passwords for important accounts and avoid reusing the same password across multiple services.

Enable multifactor authentication

Multifactor authentication provides an additional layer of protection if someone obtains your password.

Use encrypted connections

Look for HTTPS when entering sensitive information on websites. HTTPS indicates that the website uses a secure connection protected by TLS.

Enable device encryption

If your computer supports features such as Windows Device Encryption or BitLocker, consider using them to help protect stored data.

Back up important information

Encryption can protect data from unauthorized access, but it does not replace backups. Keep appropriate backups of important files in case your device is lost, damaged, or affected by malware.

Frequently Asked Questions About Encryption

What is encryption in simple terms?

Encryption changes readable information into an encoded form that is difficult for unauthorized people to understand. A cryptographic key is used to encrypt the data and, when appropriate, decrypt it.

What is the difference between symmetric and asymmetric encryption?

Symmetric encryption uses one shared secret key to encrypt and decrypt data. Asymmetric encryption uses a public and private key pair.

What is AES encryption?

AES, or Advanced Encryption Standard, is a widely used symmetric encryption algorithm. It supports 128-bit, 192-bit, and 256-bit keys and is commonly used to protect stored and transmitted data.

What is TLS encryption?

TLS, or Transport Layer Security, is a security protocol that helps protect data transmitted over networks. HTTPS websites use TLS to help secure communication between your device and the website.

Does encryption protect data if my laptop is stolen?

Device or drive encryption can help protect stored data if a laptop is lost or stolen. For example, BitLocker is designed to help prevent unauthorized access to data on a Windows device when the device is offline.

Do I need to encrypt my computer?

Using device or drive encryption is an important way to protect stored data, particularly on laptops and other portable devices. Many modern Windows devices support encryption features such as Device Encryption or BitLocker.

The Bottom Line

Encryption helps protect your data by converting readable information into an encoded form that unauthorized people cannot easily understand.

You encounter encryption throughout everyday technology, including secure websites, online banking, messaging, cloud services, and computer storage.

Symmetric encryption, such as AES, is commonly used to efficiently protect data. Asymmetric cryptography, such as RSA, uses public and private keys for functions such as authentication and secure key-related operations. Protocols such as TLS use cryptography to protect information as it travels across networks.

For your own devices, keep encryption enabled when available, protect your passwords and recovery keys, keep your software updated, and use multifactor authentication to add additional layers of protection.