Ever wondered how does encryption work when you pay online? It scrambles readable data into ciphertext with a key, and only the right key unscrambles it. You don’t need maths to follow it.
This guide is part of our look at the types of technology you rely on every day.
| Item | Key fact |
|---|---|
| Symmetric encryption | One key for both encrypting and decrypting |
| Asymmetric encryption | Two keys: one public, one private |
| Caesar cipher example shift | 3 positions in the alphabet |
| Asymmetric speed | Slow, so it is not used for large amounts of data |
| Current TLS standard (April 30, 2026 page) | TLS 1.3 |
These figures come from a symmetric, asymmetric and hybrid encryption explainer and a TLS walkthrough dated April 30, 2026. Standards and recommendations can change, so check the source before you rely on them.
What encryption actually does to your data
Encryption converts readable data (plaintext) into an unreadable format (ciphertext) so that only authorised recipients can read it. The secret ingredient is a key, which is a piece of information the scrambling method needs in order to lock or unlock the message.
The idea is old. The Caesar cipher was used by Julius Caesar over 2,000 years ago, and it simply shifted every letter by a fixed number, so “HELLO” shifted by three became “KHOOR”. The shift is the key.
That cipher is only a teaching example today, since the Caesar cipher is not secure for modern use. Anyone with patience can try every possible shift, which is why modern methods rely on far more complex maths.
Later machines raised the stakes. Germany’s Enigma machine used mechanical rotors to turn messages into unreadable jumbles of letters, and breaking it took mathematicians, engineers and codebreakers at Bletchley Park, according to the Cycle learning centre.
Symmetric encryption: one key for locking and unlocking
With symmetric encryption, the sender and the recipient share the same secret key. Think of it as two people each holding a copy of the same house key.
- Strength: it is fast and efficient, which suits large files and constant streams of data.
- Weakness: both sides must get the key safely, and anyone who obtains it can decrypt everything.
- Examples: AES, 3DES and IDEA are the modern algorithms named in the DEV Community explainer.
The weakness is the real puzzle. If you simply send the key over the wire, anyone intercepting the connection gets the key too, and from that point can read all the traffic.
Asymmetric encryption: a public key and a private key
Asymmetric encryption solves the sharing problem by using a pair of keys. The public key is shared freely, while the private key is kept secret.
The Cycle guide offers a mailbox picture: anyone can drop a letter in, but only the person with the mailbox key can open it. So if Alice wants to write to Bob, she locks her message with Bob’s public key, and only Bob’s private key can unlock it.
Oddly, once Alice has encrypted her message, even she can’t read it unless she has the private key, as the DEV Community explainer points out. RSA and ECC (Elliptic Curve Cryptography) are the modern examples it lists.
The catch is speed. Asymmetric algorithms are inconvenient for encrypting large amounts of data because they are slow.
Why do websites use both types together?
Each type covers the other’s weak spot. Asymmetric encryption is secure but slow, while symmetric encryption is fast but needs a safe way to share its key. Hybrid encryption is not a standalone type but a scheme that combines both methods.
Here is the usual flow when Alice sends Bob a message:
- Bob generates a public and private key pair and shares the public key.
- Alice creates a symmetric key and encrypts it with Bob’s public key.
- She encrypts her message with the symmetric key.
- She sends Bob the encrypted key and the encrypted message.
- Bob decrypts the key with his private key, then uses it to decrypt the message.
From then on, the slow asymmetric step is no longer needed, because both sides hold a key that only they know.
What happens when you open an HTTPS website?
Your browser and the site run a short negotiation called the TLS handshake before any page content moves. In simplified form it goes like this, based on the TLS walkthrough:
- Your browser sends a hello message to start the connection.
- The server replies with its certificate, which holds its public key.
- Your browser generates a symmetric key and encrypts it using the server’s public key from the certificate.
- The server decrypts that key with its private key.
- Both sides now use the shared symmetric key for all the actual data.
The server sends a certificate rather than a bare public key. That is a document containing the public key along with the server’s domain name, validity dates, and a digital signature from a Certificate Authority, which lets your browser trust that the key belongs to the site you meant to visit.
The walkthrough describes TLS 1.3 as the current standard, as of its April 30, 2026 date. It also says TLS 1.3 removed RSA key exchange entirely in favour of Ephemeral Diffie-Hellman (ECDHE), so real-world handshakes differ in detail from the simple version above.
The payoff is that nobody in between, such as your ISP, your router or a Wi-Fi hotspot, can read the content. They can still see that you connected to a particular server, because the IP address is visible, but the bytes they carry are meaningless ciphertext.
Where encryption still has limits
Encryption is only as strong as its keys. If keys are weak, reused or poorly protected, the whole system collapses, and the Cycle guide calls key management one of the hardest parts of real-world cryptography.
It is also easy to forget how far things have come. On the early internet, passwords were often sent in plain text, and anyone with a network sniffer could eavesdrop. Today the padlock icon in your browser signals that your login details and payment information are being protected.
If you want to see how protecting a connection works as an everyday tool, our explainer on what is a vpn and how does it work is a natural next step. For a very different building block of modern technology, you can also read about what is artificial intelligence.
Frequently asked questions
What is the difference between symmetric and asymmetric encryption?
Show answer
Symmetric encryption uses the same key to encrypt and decrypt, while asymmetric encryption uses two different keys, one public and one private.
Why not use asymmetric encryption for everything?
Show answer
Asymmetric algorithms are slow, so they are inconvenient for large amounts of data. That is why HTTPS uses them for the handshake and then switches to symmetric encryption for speed.
Can someone read my data if they intercept it?
Show answer
On an HTTPS connection they would only see ciphertext. The symmetric key was exchanged inside an asymmetric-encrypted envelope, so it never appears in plain form on the network.
What does a certificate do?
Show answer
A certificate carries a server’s public key, domain name and validity dates, plus a Certificate Authority’s digital signature. Your browser uses that signature to check the key really belongs to the site.
