What is Encryption?
Updated: 3 days ago
Encryption is the process of transforming readable information, called plaintext, into an unreadable form, called ciphertext, using a cryptographic algorithm and a key. An authorised recipient uses the correct key, or a related key in a public-key system, to recover the original data. Encryption matters because intercepted or stolen data should remain unintelligible to somebody who does not have the required key.
Encryption can protect data while it is travelling across a network and while it is stored on a device, server, backup or removable drive. It does not automatically hide every piece of metadata, make a compromised device safe, or prove who you are communicating with. The algorithm, key management, protocol and endpoint security all matter.
How does encryption work?
At its simplest, encryption takes plaintext, processes it with a cryptographic algorithm and key, and produces ciphertext. Decryption applies the required keying material and algorithm to recover the plaintext. A well-designed modern encryption system should make the ciphertext computationally impractical to turn back into useful plaintext without the required key.
Plaintext: the readable data before encryption.
Algorithm or cipher: the defined mathematical process used to transform the data.
Key: secret or private information that controls the cryptographic transformation.
Ciphertext: the protected output produced by encryption.
Decryption: the process that recovers readable data for an authorised party.
NIST describes the Advanced Encryption Standard (AES) as a symmetric block cipher for protecting electronic data. AES supports 128, 192 and 256-bit keys and operates on 128-bit blocks.
Symmetric vs asymmetric encryption
Modern systems commonly use both symmetric and asymmetric cryptography because they solve different problems.
Symmetric encryption: the same secret key is used for encryption and decryption. It is efficient for protecting large volumes of data. AES is a widely used example.
Asymmetric encryption: a mathematically related public and private key pair is used. The keys perform different roles and support capabilities such as key establishment, authentication and digital signatures.
Hybrid systems: protocols can use public-key cryptography to establish or authenticate keying material, then use efficient symmetric encryption to protect the actual application data.
This hybrid approach is central to secure internet protocols such as TLS. In TLS 1.3, protected records use authenticated encryption with associated data, known as AEAD, so confidentiality and integrity protection are combined.
Encryption in transit
Encryption in transit protects data while it moves between systems. If somebody can observe traffic on a network, properly implemented encryption is intended to prevent them from understanding the protected content.
HTTPS: web traffic protected using TLS between the browser or client and the HTTPS endpoint.
VPN: a protected tunnel that can encrypt traffic between a device or network and a VPN endpoint.
DNS over HTTPS and DNS over TLS: methods for encrypting DNS traffic between a client and a compatible resolver.
WiFi security: WPA2 or WPA3 can encrypt the wireless link between a device and the access point, but that is not the same as end-to-end application encryption.
For web traffic, see What is HTTPS?. For encrypted tunnels, see What is VPN?.
The UK Information Commissioner's Office explains that encrypting personal information in transit can protect against interception and recommends encrypted communications where available. Its guidance points to HTTPS and TLS as examples. Read the ICO guidance on encryption and data transfer.
Encryption at rest
Encryption at rest protects stored data. This can include a laptop's internal storage, a smartphone, a USB drive, a database, a server volume or a backup. The aim is to make the stored information unreadable without the required key or credentials.
Full-disk encryption: protects an entire storage volume and is particularly useful when a device is lost or stolen.
File or folder encryption: protects selected data rather than the whole storage device.
Database encryption: can protect database files, selected fields or application-managed data depending on the design.
Backup encryption: protects copies of data that may be stored away from the original system.
The ICO recommends enabling storage encryption on devices that hold personal information and notes that full-disk encryption is built into most modern operating systems. Read the ICO guidance on encryption and data storage.
What encryption does not protect
Encryption is a security control, not a magic invisibility layer. Its protection depends on where encryption starts, where decryption happens and what information sits outside the encrypted content.
A compromised endpoint: if malware or an attacker controls a device after data has been decrypted, encryption cannot make that readable data inaccessible to the compromised device.
Weak key management: exposed, copied, poorly generated or lost keys can defeat the protection or permanently lock authorised users out.
All metadata: an observer may still learn information such as IP addresses, connection timing, traffic volume or the service being contacted, depending on the protocol and network path.
Identity by itself: encryption can protect confidentiality, but authentication is needed to establish who is at the other end.
Integrity by itself: plain encryption alone is not automatically tamper protection. Modern protocols commonly use authenticated encryption or a separate integrity mechanism.
Encryption, hashing and encoding are different
Encryption: designed to be reversible with the correct key.
Hashing: designed to produce a fixed-length digest and is normally intended to be one-way rather than decrypted.
Encoding: changes representation so data can be stored or transported in a required format. Base64 is encoding, not encryption.
Obfuscation: makes something harder to read but is not a substitute for cryptographically sound encryption.
Does encryption slow down broadband?
Encryption requires processing, but on modern devices and network equipment the practical impact is often small compared with the speed of the connection, the remote service and other bottlenecks. The result depends on the cipher, protocol, hardware acceleration, packet size, CPU capability and whether traffic is being encrypted once or several times.
A 1 Gbps broadband connection carries up to 1 billion bits per second at the line-rate level. An encryption implementation that can only process 600 Mbps would become the bottleneck before the broadband link. A device or router capable of encrypting well above 1 Gbps would not impose that same ceiling on a 1 Gbps connection.
Techie Broadband practical calculation: if a VPN router can sustain 600 Mbps of encrypted throughput on a 1 Gbps service, the encryption or VPN processing ceiling is 60% of the nominal broadband rate. That does not mean encryption itself always costs 40%. It means that specific device and workload cannot process encrypted traffic faster than 600 Mbps.
Where encryption sits in a broadband connection
Your broadband access network and your application encryption are different layers. FTTP, FTTC, cable, fixed wireless and mobile broadband move traffic between your premises and the provider network. Protocols such as TLS can protect application data across that wider path.
An IPv4 or IPv6 packet can carry encrypted application traffic. The IP header still needs enough visible routing information for networks to deliver the packet. Encryption at a higher layer does not remove the need for IP routing.
This is why packet inspection has limits when payloads are encrypted. Network devices can often still inspect unencrypted headers and metadata, but they may not be able to read the protected application content without participating in a permitted decryption or inspection architecture.
Encryption and UK data protection
For organisations handling personal information in the UK, encryption is also relevant to data protection risk management. The UK GDPR requires appropriate technical and organisational measures for security. Encryption is specifically recognised as an example of a measure that may be appropriate, depending on the risks and circumstances.
The ICO states that UK GDPR does not require every item of personal information to be encrypted in every circumstance, but it recommends encryption for personal information stored or transmitted where appropriate. Read the ICO encryption and data protection guidance.
How to check whether your connection is encrypted
Check the application protocol: for websites, confirm the connection uses HTTPS rather than plain HTTP.
Inspect the certificate and connection details: modern browsers can show information about the secure connection and certificate.
Check VPN status separately: a VPN application should show whether its tunnel is connected, but HTTPS can still protect web traffic without a VPN.
Check DNS privacy separately: using a custom DNS resolver does not automatically mean DNS queries are encrypted. DoH or DoT requires compatible configuration.
Check stored-data encryption: confirm whether full-disk or device encryption is enabled on the operating system, not merely whether the login account has a password.
Keep software current: encryption depends on implementations as well as algorithms. Security updates can address weaknesses in protocol and software implementations.
Common encryption misconceptions
Encryption means nobody can see anything: false. Protected content may be unreadable, while metadata and routing information can remain visible.
HTTPS makes a website trustworthy: false. HTTPS protects the connection to the site you reached. It does not guarantee that the site itself is honest or safe.
A VPN encrypts everything end to end: not necessarily. The VPN protects traffic to the VPN endpoint. Beyond that endpoint, application protocols such as HTTPS still matter.
Longer keys always mean a system is better: not by themselves. Algorithm design, key management, implementation quality and the security goal all matter.
Encrypted data is anonymous data: not automatically. If an organisation retains the means to decrypt personal information, the ICO notes that encrypted data can still be personal information from that organisation's perspective.
Frequently asked questions
What is the difference between encryption and decryption?
Encryption transforms readable plaintext into ciphertext. Decryption uses the required keying material to recover the plaintext for an authorised party.
Is AES encryption secure?
AES is a widely standardised symmetric cipher. Security depends on using an appropriate key size and mode, secure key generation and storage, and a sound implementation. Calling something AES does not by itself prove the whole system is secure.
Is HTTPS encryption?
HTTPS uses TLS to protect HTTP communications. The encryption protects data in transit between the client and the TLS endpoint, alongside authentication and integrity protections provided by the protocol.
Does a VPN use encryption?
Most security-focused VPN protocols use encryption to protect traffic through the VPN tunnel. The exact algorithms, key exchange and scope depend on the VPN protocol and configuration.
Can encrypted data be hacked?
Encryption reduces the usefulness of stolen or intercepted data when implemented correctly, but systems can still fail through stolen keys, weak passwords, software vulnerabilities, compromised endpoints, poor configuration or obsolete cryptography.
Key takeaway
Encryption protects information by converting readable plaintext into ciphertext using cryptographic algorithms and keys. Symmetric encryption is efficient for protecting data, while asymmetric cryptography supports functions such as key establishment and authentication. Real systems often combine both. For broadband users, encryption commonly appears in HTTPS, TLS, VPNs, encrypted DNS and device storage. It protects data within a defined scope, but it does not make devices, networks or people automatically trustworthy.
The IETF's TLS 1.3 specification defines how modern TLS protects client-server communications against eavesdropping, tampering and message forgery.
To explore the related technical concepts used in this Encryption guide, visit our broadband terminology guide.
