What is encryption? Explained with a sealed envelope

In one sentence: Encryption scrambles information with a secret key so that only someone holding the right key can turn it back into something readable, which keeps your data private while it travels and while it is stored.

The everyday picture

Think about sending a postcard. Your words are written on the outside. The sorting office, the van driver and anyone who picks it up off the doormat can read every line.

Now picture sending the same note in a sealed envelope instead. But this is a special envelope. Its seal can only be opened with one particular key, and only the person you are writing to has it. Anyone else who handles it on the way sees an envelope, not your words.

Encryption turns your data from a postcard into that sealed envelope. It still travels the same roads. It just stops being readable to everyone it passes.

How it works, step by step

1. You start with plaintext (the note on the postcard). This is any readable data: an email, a customer list, a payment form.
2. Encryption scrambles it with a key (sealing the envelope). A recipe called an algorithm uses a secret key to turn the readable data into ciphertext: data that looks like nonsense. The US National Institute of Standards and Technology (NIST) describes encryption as exactly this change from plaintext to ciphertext, using an algorithm and a key.
3. The ciphertext travels or sits in storage (the envelope goes through the post, or waits in a drawer). Anyone who grabs it on the way sees only scrambled data.
4. The right key unscrambles it (the recipient opens the seal). This is called decryption. Without the correct key, the data stays unreadable.
5. Keys come in two styles. With symmetric encryption, the same key seals and opens, so you must hand that key over safely. With asymmetric encryption, there are two keys: a public key anyone can use to seal an envelope to you, and a private key only you keep, which is the only one that opens it.

Where the picture stops

• A real envelope can be torn open. Strong encryption cannot be opened without the key in any practical time; the UK Information Commissioner's Office (ICO) notes that guessing every possible key is possible in theory but, depending on the key, can take an extremely long time.
• An envelope still shows the address. Encryption is similar, but it may hide less than you expect: the ICO points out that some details about a message, such as where it is going, may not be encrypted.
• Once the recipient opens the envelope, the note is readable again. Data that was encrypted only on its journey is readable on the device that receives it, unless that device encrypts it too.

Why it matters for your business

• Customer trust. Your website should use HTTPS on every page, which encrypts what visitors type between their browser and your server. The ICO's guidance says to use HTTPS across the whole site and avoid old, weak versions.
• Lost laptops become less risky. Encrypting stored data, on laptops, phones, servers, USB sticks and backups, means a stolen device does not hand over readable files.
• Two places to protect. Data needs protecting while it travels (in transit) and while it sits in storage (at rest). Covering one does not cover the other.
• Keys are the real valuables. Encryption is only as safe as its keys. If a key leaks, the envelope is open to whoever has it. If you lose the only key, your own data stays locked.

An example

Imagine a 12-person design studio. One of its laptops is left on a train. Because the laptop's storage was encrypted and protected by a strong password, whoever finds it sees only scrambled data. The studio changes the account passwords, restores the files from an encrypted backup, and carries on. Without encryption, every client file on that laptop could have been read.

Frequently asked questions

Is HTTPS the same as encryption?

HTTPS is one use of it. It is the normal web connection (HTTP) wrapped in an encryption layer called TLS, so pages and forms travel sealed between the browser and the website.

Can encryption be broken?

In theory someone could try every possible key. With modern encryption, set up properly, that can take so long it is not practical. That is why keeping keys and passwords safe matters as much as the encryption itself.

What happens if I lose the key?

The data stays scrambled, for you as well as for everyone else. That is why recovery keys and passwords for encrypted devices and backups need to be stored safely.

What is the difference between encryption in transit and at rest?

In transit protects data while it moves across a network, like a sealed envelope in the post. At rest protects data while it is stored on a device or server, like a sealed envelope kept in a drawer.

Related explainers

• What is a zero-day? Explained with a faulty door lock
• What are backups? Explained with a spare key at a friend's house
• What is DNS? Explained with your phone's contacts list

Sources

• NIST Computer Security Resource Center: encryption (glossary)
• ICO: What is encryption?
• ICO: Encryption and data transfer