Data encryption is the process of transforming readable data, called plaintext, into an unintelligible representation called ciphertext by applying a mathematical algorithm and a cryptographic key. The purpose is to prevent unauthorised parties from understanding the protected information even if they obtain, intercept, copy or otherwise gain access to the encrypted data. Encryption is a fundamental security control used to protect information in storage, during transmission and sometimes while it is being processed.
Modern encryption is normally based on well-studied cryptographic algorithms rather than on keeping the algorithm secret; security instead depends primarily on protecting the cryptographic key. When authorised software or a person possesses the appropriate key and uses the corresponding cryptographic operation, ciphertext can be transformed back into usable plaintext.
Encryption therefore provides confidentiality, although encryption alone does not necessarily prove who created the information, guarantee that it has not been modified, or establish that a particular person is authorised to access it. Those additional properties are normally provided through authentication, authorisation, integrity mechanisms and related security controls.
Modern encryption is broadly divided into symmetric and asymmetric cryptography. Symmetric encryption uses the same secret key, or closely related secret material, for encryption and decryption, making it computationally efficient and suitable for protecting large quantities of data. Algorithms such as AES are widely used for symmetric encryption, while secure modes of operation determine how the underlying block cipher is applied to real data. Asymmetric cryptography uses a mathematically related public key and private key.
Information encrypted with one key may be processed using the corresponding key according to the cryptographic scheme, while digital-signature systems use private keys to create signatures that can be checked with public keys. Public-key cryptography is particularly useful for key establishment, authentication and digital signatures, but it is generally more computationally expensive than symmetric encryption for bulk data protection. Consequently, practical secure protocols frequently combine the two approaches, using asymmetric techniques to establish or authenticate secret session material and symmetric encryption to protect the subsequent data exchange efficiently.
Encryption can protect data at several stages of its lifecycle. Data at rest refers to information stored on devices or systems, including files on computers, databases, backups, removable storage and mobile devices. Full-disk encryption can protect stored information if a device is lost or stolen, while database, application-level or file-level encryption can provide more selective protection. Data in transit refers to information moving across networks, where encryption can prevent intermediaries from simply reading intercepted communications.
HTTPS, for example, normally uses Transport Layer Security to protect web communications between a client and server. Encrypted messaging systems can protect message contents during communication, although the exact security properties depend on their architecture and implementation. Data in use presents a different challenge because software generally needs information in a usable form to perform calculations on it. Techniques such as trusted execution environments, secure enclaves, tokenisation and specialised forms of privacy-preserving computation can address particular aspects of this problem, but they are not equivalent to ordinary encryption and have different security and performance characteristics.
Cryptographic security depends heavily on key management. A mathematically strong encryption algorithm can provide little practical protection if keys are predictable, exposed, reused improperly, stored insecurely or accessible to unauthorised users. Key management includes generating sufficiently random keys, distributing them securely, storing them appropriately, controlling access, rotating them when required, revoking compromised keys, maintaining appropriate backups and securely destroying keys when they are no longer needed.
Passwords should generally not be treated as encryption keys directly because human-chosen passwords have insufficient entropy and can be vulnerable to guessing attacks. Password-derived keys are instead normally produced using specialised password-based key derivation functions designed to make large-scale guessing more expensive. In enterprise environments, hardware security modules and key-management systems can provide controlled cryptographic key generation and storage. Certificate authorities and public-key infrastructures can also associate public keys with identities through digitally signed certificates. Thus, encryption is not simply an algorithmic operation; secure implementation requires an entire operational system for managing the secrets on which the cryptography depends.
Encryption is closely related to, but distinct from, hashing, encoding, tokenisation and digital signatures. A cryptographic hash function transforms data into a fixed-size digest designed to make it computationally difficult to recover the original input or find different inputs with the same digest. Hashing is therefore not normally reversible and is not a substitute for encryption when the original information must later be recovered.
Encoding, such as Base64 encoding, changes data into another representation for compatibility or transport and is not intended to provide secrecy. Tokenisation replaces sensitive information with tokens whose useful meaning depends on a separate mapping system. Digital signatures use cryptographic techniques to provide evidence associated with the signer and the integrity of signed data, rather than simply hiding its contents.
Authenticated encryption schemes combine confidentiality with integrity protection by producing ciphertext together with authentication information that allows recipients to detect unauthorised modification. Understanding these distinctions is important because calling every transformation of data encryption can lead to incorrect security designs and false assumptions about what protection a particular mechanism actually provides.
Encryption is used throughout computing and communications because sensitive information routinely crosses boundaries where unauthorised access is possible. Websites use encrypted transport to protect credentials, payment information, account activity and other communications. Virtual private networks can encrypt network traffic between endpoints or across particular network segments. Cloud platforms commonly provide encryption for storage volumes, object storage, databases, backups and network connections. Organisations can encrypt laptops and mobile devices to reduce exposure when hardware is lost.
Backups may be encrypted so that possession of backup media does not automatically reveal the information stored on it. Databases may use encryption to protect particularly sensitive fields, although application architecture and access controls remain important because authorised applications must generally decrypt data before using it. Email encryption can protect message contents in appropriate architectures, but ordinary transport encryption does not necessarily mean that only the intended recipient can access a message. Encryption is also used in authentication protocols, software update mechanisms, payment systems, remote administration and secure network protocols. The precise protection therefore depends on where encryption is applied, which endpoints possess the keys and what happens to the data before and after encryption.
Encryption has important limitations. It does not automatically protect data after an attacker has compromised an authorised endpoint, stolen valid credentials, obtained an active decryption key or persuaded an authorised application to reveal plaintext. If malware operates on a computer while a user is viewing an encrypted document, the malware may potentially access the document after it has been decrypted for legitimate use. Encryption also cannot by itself determine whether a user should be permitted to access information.
Poorly configured cryptographic protocols, obsolete algorithms, weak keys, insecure random-number generation, implementation vulnerabilities and incorrect certificate validation can undermine otherwise sound cryptographic primitives. Encryption may also create operational challenges involving performance, key recovery, auditing, searchability and incident response. In some systems, losing the only valid decryption key can make data permanently inaccessible, while retaining excessive recovery capabilities can increase the consequences of key compromise. Effective security therefore treats encryption as one layer in a broader defence strategy involving authentication, access control, secure software, monitoring, backups, endpoint protection and governance rather than as a complete security solution by itself.
The historical development of encryption extends from manually designed substitution and transposition ciphers to modern mathematical cryptography. Classical systems often attempted to obscure messages through transformations such as replacing letters or rearranging symbols, but many could be defeated through statistical analysis and other forms of cryptanalysis. The development of electronic computing dramatically changed both cryptography and cryptanalysis because computers could perform enormous numbers of mathematical operations rapidly.
Modern cryptography consequently relies on formally specified algorithms, computational assumptions, security models, cryptanalysis and carefully designed protocols. Important developments include the standardisation of symmetric algorithms, the emergence of public-key cryptography in the 1970s, widespread adoption of public-key infrastructure, and later advances in authenticated encryption and modern key-exchange protocols. Quantum computing has also influenced current cryptographic research because sufficiently capable quantum computers could threaten some widely used public-key systems through algorithms such as Shor's algorithm. This has contributed to the development and standardisation of post-quantum cryptographic algorithms intended to resist known quantum attacks. The modern understanding of encryption therefore encompasses not only secrecy but also protocol design, implementation security, lifecycle management and adaptation to changing computational threats.
